Case Study – 0638

Turning admin tools into attack tools. Not a new pattern, but a pattern becoming more prevalent.

CYBER ATTACK VICTIM:

one of the world’s largest medical technology companies, producing surgical equipment, orthopaedic implants, neurotechnology, emergency-care equipment and robotic-assisted surgical systems.

$25.1 Billion annual revenue (2025).

The company operates a large global manufacturing, distribution and technology environment supplying hospitals and healthcare providers around the world

WHAT HAPPENED?

In March 2026, this organisation succumbs to a cyber attack that caused a global disruption to its internal Microsoft environment. The attack was unusual because the attackers did not use conventional ransomware to cause massive disruption. However, digital forensics incident response (DFIR) investigators established that a malicious file was used to execute commands and conceal its activity.

The victim subsequently confirmed that the threat actor performed a wipe of its internal virtual infrastructure using Microsoft Intune – a legitimate Microsoft mobile/device management platform. The attack rendered laptops, mobile devices and virtual servers inoperable.

In other words:

A security and device-management tool designed to protect and remotely administer computers was weaponised and turned against the organisation.

Threat intelligence reporting indicates that an administrator account was compromised and that the attackers obtained sufficient privileges to use Microsoft Intune's legitimate remote-wipe capabilities against large numbers of endpoints.

Reuters reported that employees saw the logo of an Iran linked hacking group branding on login pages and that devices connected to the organisation’s systems had been wiped.

VICTIM'S SECURITY POSTURE PRIOR TO ATTACK:

👉 Security Governance/Framework:

• Cybersecurity risk integrated into enterprise risk management

• Cross-functional cybersecurity governance involving technology, legal, finance, regulatory and corporate-affairs leadership

• NIST Framework

• Compliance with Sarbanes-Oxley Act

• SOC 2 Type II

• ISO 27001

👉 Security Awareness Program:

• Mandatory security education for employees several times a year

• Frequent cybersecurity communications

• Additional cybersecurity and data-protection training for employees in certain roles

• Formal awareness communications including newsletters, direct email, posters, digital signage, town halls and presentations

• Regular incident-response exercises

• Cybersecurity tabletop exercises involving senior management

• Cybersecurity oversight by the Board of Directors and Audit Committee

👉 Security tools and services:

• Regular testing of cybersecurity tools and methodologies

• Multi-factor Authentication

• Strict complex password policy

• Virtual Private Network (VPN)

• Email security

• Identity Access Management

• Remote device management

• Cybersecurity practices and methodologies leveraging Artificial Intelligence and Machine Learning

• Regular vulnerability scans

• Penetration tests

• Threat intelligence feeds

• Threat modelling

• Real-time intrusion detection

• Multiple Security Operations Centres and Cyber Fusion Centre

• 24/7 Continuous/regular monitoring

• External third parties used to assess cybersecurity maturity and risk-management programme

• Cybersecurity and privacy assessments of third parties

• Internal/External tools to help ensure that these third parties meet security requirements

• Data Loss Prevention (DLP)

• Encryption

• Business-continuity measures

• External cybersecurity expertise

• Cyber incident-response plan

👉 Security Employees:

• Over One hundred cyber security professionals employed

• Two x Cloud Security Professionals (CCSP)

• One x Certified Protection Professional (CPP)

• Thirty-Three x Certified Ethical Hackers (CEH)

• Nine x Certified Information System Security Professional (CISSP)

• Four x Certified Chief Information Security Officer (C|CISO)

• One x Certified IT System Risk (CRISC)

• Three x Certified Information System Auditors (CISA)

• Two x Certified Information System Manager (CISM)

Despite an established cybersecurity programme…

The attacker was able to weaponise the victim’s legitimate management infrastructure into a destructive tool.

All it took was sufficient privileged access to the management plane.

A tool designed to secure, control and remotely wipe compromised devices was itself used to wipe the organisation's devices.

ASSETS COMPROMISED

The attack affected the victim’s internal Microsoft corporate environment.

The threat actor used Microsoft Intune to wipe internal virtual infrastructure, leaving:

• Laptops inoperable

• Mobile devices inoperable

• Virtual servers inoperable

Intelligence reporting suggest that eighty thousand devices were affected. While the attacker claims much larger numbers along with 50TB of data stolen.

RESPONSE

Immediately after detecting the attack, the victim:

• Activated its cybersecurity incident-response plan

• Engaged external cybersecurity specialists

• Brought in Palo Alto Networks Unit 42

• Removed the unauthorised actor from its environment

• Activated business-continuity procedures

• Launched an internal investigation

• Notified applicable regulatory authorities

• Worked with law enforcement

• Worked with government agencies

• Began restoring the affected Microsoft environment

• Prioritised restoration of systems supporting customers, ordering and shipping

• Used alternative/manual processes while normal systems were unavailable

• Communicated with customers, suppliers, vendors and partners

• Gradually restarted manufacturing plants and critical production lines

An extended process that took about a month.

The recovery became a 24/7 operation, prioritising systems directly affecting patient care and the medical-device supply chain.

IMPACT

• Employees unable to access certain corporate IT systems

• Business applications inaccessible

• Electronic ordering capabilities disrupted

• Corporate network services disrupted

The attack disrupted:

Order processing → manufacturing → shipping → distribution of medical equipment.

Employees were unable to access certain IT systems, forcing the company to use manual processes and alternative procedures while infrastructure was restored. The operational disruption caused idle production time and increased manufacturing and supply-chain costs.

Their CFO said that 3rd quarter sales dropped by $45 million.

At a cost of somewhere between $300 and $500 to reprovision and re-enroll per device, it's estimated that the cost of getting endpoints back in working order will be somewhere between $24 million to $40 million. Add the cost of engaging Palo Alto Unit 42 for incident response and other recovery services, the total cost of attack nears the $100 million mark. Or potentially exceeds it.

The incident demonstrates the risk of management-plane compromise.

Endpoint-management platforms such as Microsoft Intune are designed to give administrators enormous centralised control. That is precisely their value.

But once privileged administrative access is compromised:

The same capability that allows security teams to protect thousands of endpoints can allow an attacker to disable thousands of endpoints at once.

☝️ If you can’t see the underlying problem, then loopholes will create an inefficient cybersecurity program.

If an organisation this secure can be breached…

The gap isn’t effort... it’s where you’re focusing.

Register for our 2026 Cyber Threat Briefing to discover cybercrime insight that helps deliver better cyber security.