MDR
Solutions
Partners
About
Resources
March 11, 2026
Handala conducts destructive campaigns focused on wiping devices, not extortion. They target infrastructure and service providers globally to maximize disruption.
High-privilege Microsoft Intune and Entra ID admin accounts used to manage corporate fleets. Applies to Windows, macOS, and mobile devices enrolled under these identity providers.
Devices can be factory reset at scale, interrupting business operations. Loss of eSIM data blocks cellular access and MFA codes, delaying account recovery.
Attackers exploit hijacked admin identities to issue legitimate management commands. Reliance on central portals means one compromised account can affect entire fleets.
Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.
Discuss Your Security ExposureExplore Threat HuntingAssess your risk
Identify affected systems
Plan remediation
Practical, vendor-aligned guidance
Get expert support
From our 24/7 security team
Get the latest threat intelligence and security advisories from Smarttech247.
View All Threat UpdatesDownload the complete analysis, including detailed technical findings and references.
Refer to Smarttech247 Threat Report “Destructive ‘Wipe’ Operations via Hijacked Identity Providers.” Monitor Handala-related advisories and Microsoft guidance on Intune and Entra ID hardening.
.jpg)