Three Buddy Problem Handala wiper attacks, APT28 implant devs are back, Signal's verification problems
Mar 14, 2026
A fast-paced rundown of a destructive wiper attack on a US medical device company and how MDM abuse enabled mass device wipes. A deep dive into Signal and WhatsApp account-targeting and weaknesses in verification and linked-device design. New research on APT28 developers resurfacing after years away. Updates on Apple patches and fresh exploit samples raising questions about provenance.
AI Snips
Chapters
Transcript
Episode notes
MDM Admin Access Is A Nuclear Option
- MDM and remote-management platforms are high-value attack vectors because they can execute mass wipes or push packages across fleets.
- Costin Raiu and Juan Andres explain Handala abused Microsoft Intune admin access to remotely wipe employee devices and systems at Stryker, causing wide disruption.
Assume Breach And Catch Identity Abuse Early
- Assume identity compromise is possible and focus on early detection rather than perfect prevention.
- Deploy MFA, just-in-time admin, canary tokens and monitoring for unusual admin activity to catch intrusions before a destructive mass wipe.
Governments Can Buy Visibility On Leaked Credentials
- Centralized government monitoring of credential dumps could proactively protect high-risk organizations.
- Ryan Naraine proposes governments pay for services like SpyCloud or VirusTotal to notify affected firms when fresh leaked creds appear.