Stryker wipe used Microsoft Intune abuse, not custom wiper malware

Assessment

Multiple outlets initially framed the Stryker incident as a "wiper attack," implying purpose-built destructive malware. KrebsOnSecurity reported, based on a single anonymous source "with knowledge of the attack," that the actual mechanism was abuse of Microsoft Intune's legitimate remote-wipe administrative function against all enrolled devices simultaneously — corroborated only informally by a Reddit thread of self-identified Stryker employees describing urgent instructions to uninstall Intune. Stryker itself had not, at the time of that reporting, confirmed the specific mechanism. This is a meaningful technical distinction: it describes identity/access-control compromise of an admin console rather than malware deployment, with different detection and containment implications, but is carried in most coverage as settled fact.