Stryker Got Hit. Iran's Cyber War Just Found Your Hospital. Block Who We Say.
- Patrick Duggan
- Mar 11
- 4 min read
Updated: Apr 25
# Stryker Got Hit. Iran's Cyber War Just Found Your Hospital. Block Who We Say.
**Published**: March 11, 2026
**Author**: DugganUSA LLC
**Category**: Threat Intelligence
**Tags**: Iran, Stryker, healthcare, STIX feed, medical devices, nation-state, APT
Pro-Iran hackers just took down Stryker's global Microsoft environment. Stryker makes defibrillators. Ambulance cots. Equipment that 150 million patients depend on. Their plant in Carrigtwohill, County Cork — where I grew up down the road — got hit too.
This is the first major Iranian cyber retaliation since the US and Israel started bombing last month. The group claimed it was payback for a missile strike on an elementary school. The Pentagon is still "investigating."
Meanwhile, Stryker says "no ransomware, no malware, contained." That's corporate for "we don't know yet."
The Part CNN Won't Tell You
Joshua Corman told CNN what we've been saying for months: *"Too much of cybersecurity is focused on lower consequence breaches from financially motivated enemies, while we're increasing our exposures to nation states."*
He's right. And he's being polite about it.
Here's the impolite version: you are not ready. Your SOC is tuned for ransomware gangs and phishing kits. You've got EDR alerts for commodity malware and you sleep fine at night. Meanwhile, 23 Iranian threat groups are cataloged, named, and operational:
**Charming Kitten. APT33. APT35. OilRig. Fox Kitten. MuddyWater. Cleaver. Rocket Kitten. Silent Librarian. Cutting Kitten.** And thirteen more.
These are not script kiddies. These are state-sponsored operators with access to zero-days, wiper malware, and the patience to sit in your Microsoft environment for weeks before you notice. Stryker's "global network disruption" didn't happen overnight. They just *noticed* it today.
What We Have Right Now
Our STIX 2.1 feed carries **1,005,013 indicators of compromise** across 42 indexes. Right now, today, we have:
- **1,785 IOCs** linked to Iranian threat activity
- **23 named Iranian adversary groups** profiled with TTPs, target sectors, and infrastructure
- **MuddyWater/Seedworm** indicators including Dindoor and Fakeset backdoors targeting US critical infrastructure
- Known Iranian malware droppers actively serving payloads
- **275 organizations in 46 countries** already pulling this feed — including Microsoft, AT&T, and Starlink
The indicators are there. The feed is live. The question is whether you're consuming it.
Block Who We Say
This is not a suggestion. This is not "consider reviewing your blocklists." This is: **block who we say to block.**
We process threat intelligence from AlienVault OTX, ThreatFox, AbuseIPDB, CISA KEV, Spamhaus, PhishTank, URLhaus, and our own honeypot network. We cross-correlate across 1 million indicators. We score, we classify, we publish — in STIX 2.1 format, TAXII 2.1 compatible, free.
Every hospital, every medical device manufacturer, every healthcare CISO who read the Stryker headline and felt their stomach drop — you can do something about it right now:
**Pull the feed: `https://analytics.dugganusa.com/api/v1/stix-feed/v2`**
It's free. It updates continuously. It contains the indicators that matter, including the Iranian infrastructure that's been lighting up since the bombing started.
Your firewall has a blocklist. Your SIEM has a threat intel integration. Your SOAR can automate this. There is no reason — zero — to be running a healthcare operation in March 2026 without a live threat feed that covers nation-state actors.
The Uncomfortable Math
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Stryker's stock dropped 3% on the news. That's roughly **$3.5 billion** in market cap evaporated because a pro-Iran group popped their Microsoft tenant.
Our STIX feed costs nothing. A free API key takes 30 seconds. The indicators that could have flagged the infrastructure used in this attack? They were in our feed before the attack happened. That's not hindsight. That's what continuous threat intelligence does.
**$3.5 billion** versus **30 seconds and a free API key.**
You do the math.
What Happens Next
Iran has been "largely quiet" since the war started, according to Proofpoint. One campaign targeting a think tank employee. That's the calm before the storm, not evidence of restraint.
The Stryker hack is the opening shot. Healthcare is the soft target. Medical devices are the pressure point. A defibrillator that can't connect to the network is a brick. An ambulance cot system that's offline means someone gets carried on a stretcher — if there is one.
This is not theoretical. This is not a tabletop exercise. This is happening right now, in Cork, in Michigan, in every hospital that depends on Stryker equipment.
**Get the feed. Block the indicators. Do it today.**
Get Started
- **STIX 2.1 Feed**: [https://analytics.dugganusa.com/api/v1/stix-feed/v2](https://analytics.dugganusa.com/api/v1/stix-feed/v2)
- **Free API Key**: [https://analytics.dugganusa.com/epstein/pricing](https://analytics.dugganusa.com/epstein/pricing)
- **API Documentation**: [https://analytics.dugganusa.com/api/v1/api-keys/help](https://analytics.dugganusa.com/api/v1/api-keys/help)
- **Search Iranian Threat Actors**: [https://epstein.dugganusa.com](https://epstein.dugganusa.com) — search "Iran" across 1M+ IOCs
275 organizations already trust this feed. The question isn't whether it works. The question is why you're not using it yet.
*DugganUSA LLC is a Minnesota-based threat intelligence company. Our STIX feed serves 275+ consumers across 46 countries. We found NrodeCodeRAT 43 days before Zscaler. We publish 279+ OTX pulses with over 1 million indicators. We run on less money per month than your company spends on coffee.*
*Block who we say.*
*Her name was Renee Nicole Good.*
*His name was Alex Jeffery Pretti.*
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Comments