Your Business Is Not Too Small to Be an Iranian Hacker's Next Target
Groups linked to Iran's intelligence services are not hand-picking victims. They are scanning the internet for any door left unlocked, and a GPS company and a medical-device maker have already paid the price.
Key points
- Handala, a hacker group attributed by the US Justice Department to Iran's Ministry of Intelligence and Security, remotely wiped data from more than 200,000 computer systems at medical-device maker Stryker in March 2025.
- A separate group, Ababil of Minab, broke into Vyncs, a GPS tracking platform used by logistics companies, taking its systems offline and defacing its website.
- The Stryker breach likely began with stolen login credentials bought from criminal marketplaces, not a sophisticated custom attack.
- A five-year-old software flaw, CVE-2021-22681 (a security vulnerability in industrial control systems that lets an attacker take remote control without a password), is among the weaknesses these groups have recently used.
- Both attacks show that opportunistic scanning, not targeted intelligence work, is how these groups find their victims.
Forget the image of a government war room selecting enemies of state. The Iranian-linked hacker groups making headlines right now are closer to opportunistic burglars testing door handles on every house on the street.
They use tools like Shodan, a search engine that maps internet-connected devices, to find systems with weak passwords or unpatched flaws. A law firm with a forgotten remote-access point, a logistics company with outdated software: both look equally appealing.
The evidence is in the targets themselves. Stryker, the medical-device manufacturer, is not a power grid. Vyncs, the GPS platform hit by Ababil of Minab, is not a water utility. Yet both were breached. Stryker's manufacturing was disrupted badly enough to affect its first-quarter earnings.
How do these groups actually get in?
Mostly through doors companies forgot they left open. Default credentials, meaning the factory-set username and password that comes with a device and was never changed, are a favourite entry point. So are known software flaws that have never been patched, even years after a fix became available.
Joe Slowik, Director of Cybersecurity Alerting Strategy at Dataminr, writing for Dark Reading, calls these groups "largely opportunistic." The Stryker credentials were almost certainly purchased from a criminal marketplace where stolen logins are sold cheaply. No elaborate espionage required.
The attacks often look unimpressive on the surface: a screenshot of an industrial device posted to Telegram, a defaced website, a temporary outage. Easy to dismiss. That is the mistake.
The weakness that let a low-skill group post a screenshot is the same weakness a more capable, more patient attacker could use to cause serious damage. The open door does not care who walks through it.
Four things any organisation can do right now:
- Find out what your business actually exposes to the internet. Internal asset lists are frequently wrong. Forgotten remote-access points are the most common entry route.
- Turn on multi-factor authentication (MFA, a second login check beyond just a password) for every system reachable from outside your office, and make sure no device still runs on its factory-default password.
- Patch old software flaws before new ones arrive. The vulnerabilities these groups use are not cutting-edge; they are just unaddressed.
- Watch the channels these groups actually use. Telegram posts claiming credit can appear within hours of a breach, well before any official advisory lands.
Most of this activity sits in the "moderately disruptive" range today. The real lesson is not the damage done so far. It is the map of unlocked doors these incidents leave behind for whoever comes next.
