When the Management Console Becomes the Weapon
In March, medical technology company Stryker disclosed a cyberattack that disrupted its operations. Public reporting describes a destructive attack claimed by Handala, a group widely associated with Iranian state interests, and says attackers used the company’s own endpoint management platform, Microsoft Intune, to issue remote wipe commands to a very large number of devices. Details are still emerging, and some reported figures vary between sources.
Whatever the final account, the technique deserves attention from every organization. The attackers didn’t need custom malware on each device. They needed access to the system designed to manage all of them.
Admin planes reach everything by design
Every enterprise runs systems whose purpose is to control many other systems at once:
- endpoint and mobile device management platforms
- identity providers and directory services
- cloud management consoles and infrastructure-as-code pipelines
- virtualization management
- backup administration consoles
- remote monitoring and management tools
Collectively, these form the admin plane. Each can push configuration, run scripts, deploy software, disable accounts or wipe devices across the organization. That’s what makes them useful, and it’s what makes them the most valuable target in the environment.
Destructive attacks have shifted toward these platforms because they offer scale with very little effort. One compromised administrator account can do in minutes what used to require a carefully staged malware deployment.
Why admin planes are often under-protected
Admin plane platforms are often managed by infrastructure or end-user computing teams, sometimes outside the security team’s direct oversight. In many organizations:
- administrator roles are broad and permanently assigned
- admin accounts are used from ordinary workstations
- high-impact actions, such as bulk wipes, script deployment and policy changes, run without a second approval
- logs from these platforms aren’t sent to the security team’s monitoring tools
None of these is unusual. Together they mean that one stolen credential can turn the organization’s own tools against it.
Protecting the admin plane
Inventory the platforms and who administers them. List every system that can take action across many devices, accounts or workloads, and every account with administrative rights in each. The number of such accounts is often surprising.
Use dedicated, phishing-resistant admin identities. Administrative work should use separate accounts that require hardware-backed, phishing-resistant authentication, used from dedicated or hardened admin workstations. Keep everyday accounts out of administration.
Grant administrative roles just in time. Permanent administrator assignments should be the exception. Time-limited elevation, with approval for the most powerful roles, reduces the window in which stolen credentials are useful.
Require multiple approvers for destructive actions. Several management platforms now support requiring a second administrator to approve high-impact actions such as device wipes, script deployment or role changes. Turn it on. It turns a single compromised account into a blocked request.
Scope administrative reach. Divide administrative authority by region, business unit or device group, so that no single role can act on the whole estate. This limits the blast radius of any one compromised account.
Send admin plane logs to security monitoring. Bulk actions, new administrator assignments, policy changes and sign-ins from unfamiliar locations should generate alerts. Agree in advance who responds, and how quickly.
Keep recovery out of the admin plane’s reach. If the same identity system that manages devices also manages backups, one compromise can reach both. Backup administration should use separate credentials and, ideally, a separate identity domain.
Rehearse the scenario
Run a tabletop exercise built around a simple question: an attacker has administrator access to your device management platform at 2 a.m. on a Saturday. What can they do, what would alert you, and how long would it take to stop them?
Most organizations find the answers uncomfortable, and the improvements are usually clear: fewer standing administrators, a second approval for destructive actions, and monitoring that someone watches. Each is achievable within a quarter, and each changes what a stolen admin credential can do.