--===============3594005051263608816==
Content-Type: multipart/alternative; boundary="===============5725479500399676091=="
MIME-Version: 1.0

--===============5725479500399676091==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Cybersecurity and Infrastructure Security Agency (CISA)

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infras= tructure Security Agency. This information has recently been updated and is=
now available.

CISA Urges Endpoint Management System Hardening After Cyberattack Against U=
S Organization [ https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-ur= ges-endpoint-management-system-hardening-after-cyberattack-against-us-organ= ization?utm_source=3DIranHardening202603&utm_medium=3DGovDelivery ] 03/18/2= 026 05:30 PM EST=20

CISA is aware of malicious cyber activity targeting endpoint management sys= tems of U.S. organizations based on the March 11, 2026 cyberattack against = U.S.-based medical technology firm Stryker Corporation, which affected thei=
r Microsoft environment.1 [ https://www.cisa.gov/news-events/alerts/2026/03= /18/cisa-urges-endpoint-management-system-hardening-after-cyberattack-again= st-us-organization#note1 ]=C2=A0To defend against similar malicious cyber a= ctivity, CISA urges organizations to harden endpoint management system conf= igurations using the recommendations and resources provided in this alert. = CISA is conducting enhanced coordination with federal partners, including t=
he Federal Bureau of Investigation (FBI), to identify additional threats an=
d determine mitigation actions.

To defend against similar malicious activity that misuses legitimate endpoi=
nt management software, CISA urges organizations to implement Microsoft=E2= =80=99s newly released=C2=A0best practices for securing Microsoft Intune [ = https://techcommunity.microsoft.com/blog/intunecustomersuccess/best-practic= es-for-securing-microsoft-intune/4502117 ]; the principles of these recomme= ndations can be applied to Intune and more broadly to other endpoint manage= ment software:=C2=A0


* *Use principles of least privilege*=C2=A0when designing administrative = roles.=20
* Leverage Microsoft Intune=E2=80=99s role-based access control (RBAC) to=
assign the minimum permissions necessary to each role for completing day-t= o-day operations=E2=80=94permissions include what actions the role can take=
, and what users and devices it can apply that action to.=20

* *Enforce phishing-resistant multi-factor authentication (MFA) and privi= leged access hygiene*.=20
* Use Microsoft Entra ID capabilities (including Conditional Access, MFA,=
risk signals, and privileged access controls) to block unauthorized access=
to privileged actions in Microsoft Intune.=20

* *Configure access policies to require=C2=A0**Multi Admin Approval in Mi= crosoft Intune* [ https://learn.microsoft.com/en-us/intune/intune-service/f= undamentals/multi-admin-approval ].=20
* Set up policies that require a second administrative account=E2=80=99s = approval to allow changes to sensitive or high-impact actions (such as devi=
ce wiping), applications, scripts, RBAC, configurations, etc. =C2=A0=20

Additionally, CISA recommends reviewing the following resources to strength=
en defenses against similar malicious cyber activity:


* Microsoft resources:=20
* For recommendations on securing Microsoft Intune, see=C2=A0Best practic=
es for securing Microsoft Intune [ https://techcommunity.microsoft.com/blog= /intunecustomersuccess/best-practices-for-securing-microsoft-intune/4502117=
].=20
* For guidance on implementing Multi Admin Approval in Microsoft Intune, = see=C2=A0Use Access policies to implement Multi Admin Approval [ https://le= arn.microsoft.com/en-us/intune/intune-service/fundamentals/multi-admin-appr= oval ].=20
* For recommendations on configuring Microsoft Intune using zero trust pr= inciples, see=C2=A0Configure Microsoft Intune for increased security [ http= s://learn.microsoft.com/en-us/intune/intune-service/protect/zero-trust-conf= igure-security?toc=3D/security/zero-trust/assessment/toc.json&bc=3D/securit= y/zero-trust/assessment/toc.json ].=20
* For guidance on implementing Microsoft Intune RBAC policies, see=C2=A0R= ole-based access control (RBAC) with Microsoft Intune [ https://learn.micro= soft.com/en-us/intune/intune-service/fundamentals/role-based-access-control=
].=20
* For guidance on deploying Privileged Identity Management (PIM) across M= icrosoft Intune, Entra ID, and other Microsoft software, see=C2=A0Plan a Pr= ivileged Identity Management deployment [ https://learn.microsoft.com/en-us= /entra/id-governance/privileged-identity-management/pim-deployment-plan ]. = =C2=A0=20

* CISA resources:=20
* For guidance on implementing phishing-resistant multifactor authenticat= ion (MFA), see=C2=A0Implementing Phishing-Resistant MFA [ https://www.cisa.= gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-= mfa-508c.pdf ].=C2=A0=20

*Disclaimer*

The information in this report is being provided =E2=80=9Cas is=E2=80=9D fo=
r informational purposes only. CISA does not endorse any commercial entity,=
product, company, or service, including any entities, products, or service=
s linked within this document. Any reference to specific commercial entitie=
s, products, processes, or services by service mark, trademark, manufacture=
r, or otherwise, does not constitute or imply endorsement, recommendation, =
or favoring by CISA. =C2=A0

*Acknowledgements*

Microsoft and Stryker contributed to this alert.=C2=A0

*Notes*=20

1 For updates from Stryker on the incident, see =E2=80=9CCustomer Updates: = Stryker Network Disruption,=E2=80=9D Stryker, last modified March 15, 2026,= =C2=A0https://www.stryker.com/us/en/about/news/2026/a-message-to-our-custom= ers-03-2026.html.

Please share your thoughts with us through this this anonymous survey [ htt= ps://cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?Source=3DGov= Deliveryhttps://www.cisa.gov/news-events/alerts/2026/03/18/cisa-urges-endpo= int-management-system-hardening-after-cyberattack-against-us-organization ]=
. We appreciate your feedback!

This product is provided subject to this=C2=A0Notification [ https://www.ci= sa.gov/notification ]=C2=A0and this=C2=A0Privacy & Use [ https://www.cisa.g= ov/privacy-policy ]=C2=A0policy.

body { font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight=
: normal; font-style: normal; color: #333333; }=20

Having trouble viewing this message?=C2=A0View it as a webpage [ https://co= ntent.govdelivery.com/accounts/USDHSCISA/bulletins/40ef439 ].=C2=A0 [ https= ://content.govdelivery.com/accounts/USDHS/bulletins/292141e ]

You are subscribed to updates from the Cybersecurity and Infrastructure Sec= urity Agency [ https://www.cisa.gov ] (CISA)
Manage Subscriptions [ https://public.govdelivery.com/accounts/USDHSCISA/su= bscriber/edit?preferences=3Dtrue#tab1 ]=C2=A0=C2=A0|=C2=A0=C2=A0Privacy Pol= icy [ https://www.cisa.gov/privacy-policy ]=C2=A0=C2=A0|=C2=A0 Help [ https= ://subscriberhelp.granicus.com/s/article/Subscriber-Help-Center ] [ https:/= /insights.govdelivery.com/Communications/Subscriber_Help_Center ]

Connect with CISA:=20
Facebook [ https://www.facebook.com/CISA ]=C2=A0 |=C2=A0 Twitter [ https://= twitter.com/CISAgov ]=C2=A0 |=C2=A0 Instagram [ https://Instagram.com/cisag=
ov ]=C2=A0 |=C2=A0 LinkedIn [ https://www.linkedin.com/company/cybersecurit= y-and-infrastructure-security-agency ]=C2=A0 |=C2=A0=C2=A0 YouTube [ https:= //www.youtube.com/channel/UCxyq9roe-npgzrVwbpoAy0A ]

________________________________________________________________________

This email was sent to cisa@toolazy.synchro.net using GovDelivery Communica= tions Cloud, on behalf of: Cybersecurity and Infrastructure Security Agency=
=C2=B7 707 17th St, Suite 4000 =C2=B7 Denver, CO 80202 GovDelivery logo [ = https://subscriberhelp.granicus.com/ ]=20
body .abe-column-block { min-height: 5px; } table.gd_combo_table img {margi= n-left:10px; margin-right:10px;} table.gd_combo_table div.govd_image_displa=
y img, table.gd_combo_table td.gd_combo_image_cell img {margin-left:0px; ma= rgin-right:0px;}

--===============5725479500399676091==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.= w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns=3D"http://www.w3.org/1999/xhtml" xml:lang=3D"en" lang=3D"en"> <head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8"> <title> CISA Urges Endpoint Management System Hardening After Cyberattac=
k Against US Organization
</title>


</head>
<body style=3D"">

<table width=3D"700" border=3D"0" cellspacing=3D"0" cellpadding=3D"0"=
align=3D"center">
<tr>
<td>

<!--[if (gte mso 9)|(IE)]>
<table style=3D"display:none"><tr><td><a name=3D"gd_top" id=3D"gd_top"></= a></td></tr></table>
<![endif]-->
<a name=3D"gd_top" id=3D"gd_top"></a>

=20



<p><img src=3D"https://content.govdelivery.com/attachments/fancy_images/U= SDHSCISA/2020/06/3486054/05152023-gov-delivery-banner-copy_original.png" al= t=3D"Cybersecurity and Infrastructure Security Agency (CISA)" title=3D"" wi= dth=3D"600" height=3D"100"></p>
<p>You are subscribed to Cybersecurity Advisories for Cybersecurity and I= nfrastructure Security Agency. This information has recently been updated a=
nd is now available.</p>
<div class=3D"rss_item" style=3D"margin-bottom: 2em;">
<div class=3D"rss_title" style=3D"font-weight: bold; font-size: 120%; margi=
n: 0 0 0.3em; padding: 0;"><a href=3D"https://www.cisa.gov/news-events/aler= ts/2026/03/18/cisa-urges-endpoint-management-system-hardening-after-cyberat= tack-against-us-organization?utm_source=3DIranHardening202603&utm_medium=3D= GovDelivery" target=3D"_blank" title=3D"CISA Urges Endpoint Management Syst=
em Hardening After Cyberattack Against US Organization" rel=3D"noopener">CI=
SA Urges Endpoint Management System Hardening After Cyberattack Against US = Organization</a></div>
<div class=3D"rss_pub_date" style=3D"font-size: 90%; font-style: italic; co= lor: #666666; margin: 0 0 0.3em; padding: 0;">03/18/2026 05:30 PM EST</div> <div class=3D"l-page-section l-page-section--rich-text csaf-imported">
<div class=3D"l-constrain">
<div class=3D"l-page-section__content">
<p>CISA is aware of malicious cyber activity targeting endpoint management = systems of U.S. organizations based on the March 11, 2026 cyberattack again=
st U.S.-based medical technology firm Stryker Corporation, which affected t= heir Microsoft environment.<a href=3D"https://www.cisa.gov/news-events/aler= ts/2026/03/18/cisa-urges-endpoint-management-system-hardening-after-cyberat= tack-against-us-organization#note1">¹</a><span>=C2=A0</span>To d= efend against similar malicious cyber activity, CISA urges organizations to=
harden endpoint management system configurations using the recommendations=
and resources provided in this alert. CISA is conducting enhanced coordina= tion with federal partners, including the Federal Bureau of Investigation (= FBI), to identify additional threats and determine mitigation actions.</p> <p>To defend against similar malicious activity that misuses legitimate end= point management software, CISA urges organizations to implement Microsoft= =E2=80=99s newly released<span>=C2=A0</span><a href=3D"https://techcommunit= y.microsoft.com/blog/intunecustomersuccess/best-practices-for-securing-micr= osoft-intune/4502117" target=3D"_blank" title=3D"(opens in a new window)" c= lass=3D"ext" data-extlink=3D"" rel=3D"noopener">best practices for securing=
Microsoft Intune</a>; the principles of these recommendations can be appli=
ed to Intune and more broadly to other endpoint management software:=C2=A0<=



<strong>Use principles of least privilege</strong><span>=C2=A0</span>when d= esigning administrative roles.

<li>Leverage Microsoft Intune=E2=80=99s role-based access control (RBAC) to=
assign the minimum permissions necessary to each role for completing day-t= o-day operations=E2=80=94permissions include what actions the role can take=
, and what users and devices it can apply that action to.</li>
</ul>
</li>

<strong>Enforce phishing-resistant multi-factor authentication (MFA) and pr= ivileged access hygiene</strong>.

<li>Use Microsoft Entra ID capabilities (including Conditional Access, MFA,=
risk signals, and privileged access controls) to block unauthorized access=
to privileged actions in Microsoft Intune.</li>
</ul>
</li>

<strong>Configure access policies to require<span>=C2=A0</span></strong><a = href=3D"https://learn.microsoft.com/en-us/intune/intune-service/fundamental= s/multi-admin-approval" target=3D"_blank" title=3D"(opens in a new window)"=
class=3D"ext" data-extlink=3D"" rel=3D"noopener"><strong>Multi Admin Appro= val in Microsoft Intune</strong></a>.

<li>Set up policies that require a second administrative account=E2=80=99s = approval to allow changes to sensitive or high-impact actions (such as devi=
ce wiping), applications, scripts, RBAC, configurations, etc. =C2=A0</li>
</ul>
</li>
</ul>
<p>Additionally, CISA recommends reviewing the following resources to stren= gthen defenses against similar malicious cyber activity:</p>

<li>Microsoft resources:

<li>For recommendations on securing Microsoft Intune, see<span>=C2=A0</span= ><a href=3D"https://techcommunity.microsoft.com/blog/intunecustomersuccess/= best-practices-for-securing-microsoft-intune/4502117" target=3D"_blank" tit= le=3D"(opens in a new window)" class=3D"ext" data-extlink=3D"" rel=3D"noope= ner">Best practices for securing Microsoft Intune</a>.</li>
<li>For guidance on implementing Multi Admin Approval in Microsoft Intune, = see<span>=C2=A0</span><a href=3D"https://learn.microsoft.com/en-us/intune/i= ntune-service/fundamentals/multi-admin-approval" target=3D"_blank" title=3D= "(opens in a new window)" class=3D"ext" data-extlink=3D"" rel=3D"noopener">= Use Access policies to implement Multi Admin Approval</a>.</li>
<li>For recommendations on configuring Microsoft Intune using zero trust pr= inciples, see<span>=C2=A0</span><a href=3D"https://learn.microsoft.com/en-u= s/intune/intune-service/protect/zero-trust-configure-security?toc=3D/securi= ty/zero-trust/assessment/toc.json&bc=3D/security/zero-trust/assessment/toc.= json" target=3D"_blank" title=3D"(opens in a new window)" class=3D"ext" dat= a-extlink=3D"" rel=3D"noopener">Configure Microsoft Intune for increased se= curity</a>.</li>
<li>For guidance on implementing Microsoft Intune RBAC policies, see<span>= =C2=A0</span><a href=3D"https://learn.microsoft.com/en-us/intune/intune-ser= vice/fundamentals/role-based-access-control" target=3D"_blank" title=3D"(op= ens in a new window)" class=3D"ext" data-extlink=3D"" rel=3D"noopener">Role= -based access control (RBAC) with Microsoft Intune</a>.</li>
<li>For guidance on deploying Privileged Identity Management (PIM) across M= icrosoft Intune, Entra ID, and other Microsoft software, see<span>=C2=A0</s= pan><a href=3D"https://learn.microsoft.com/en-us/entra/id-governance/privil= eged-identity-management/pim-deployment-plan" target=3D"_blank" title=3D"(o= pens in a new window)" class=3D"ext" data-extlink=3D"" rel=3D"noopener">Pla=
n a Privileged Identity Management deployment</a>. =C2=A0</li>
</ul>
</li>
<li>CISA resources:

<li>For guidance on implementing phishing-resistant multifactor authenticat= ion (MFA), see<span>=C2=A0</span><a href=3D"https://www.cisa.gov/sites/defa= ult/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf">= Implementing Phishing-Resistant MFA</a>.=C2=A0</li>
</ul>
</li>
</ul>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided =E2=80=9Cas is=E2=80=9D=
for informational purposes only. CISA does not endorse any commercial enti= ty, product, company, or service, including any entities, products, or serv= ices linked within this document. Any reference to specific commercial enti= ties, products, processes, or services by service mark, trademark, manufact= urer, or otherwise, does not constitute or imply endorsement, recommendatio=
n, or favoring by CISA. =C2=A0</p>
<h2><strong>Acknowledgements</strong></h2>
<p>Microsoft and Stryker contributed to this alert.=C2=A0</p>

<strong>Notes</strong><a id=3D"note1" class=3D"ck-anchor" name=3D"note1"></=

</h2>
<p>1 For updates from Stryker on the incident, see =E2=80=9CCustomer Update=
s: Stryker Network Disruption,=E2=80=9D Stryker, last modified March 15, 20= 26,<span>=C2=A0</span><a href=3D"https://www.stryker.com/us/en/about/news/2= 026/a-message-to-our-customers-03-2026.html" target=3D"_blank" title=3D"(op= ens in a new window)" class=3D"ext" data-extlink=3D"" rel=3D"noopener">http= s://www.stryker.com/us/en/about/news/2026/a-message-to-our-customers-03-202= 6.html</a>.</p>
<p>Please share your thoughts with us through this this <a href=3D"https://= cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?Source=3DGovDeliv= eryhttps://www.cisa.gov/news-events/alerts/2026/03/18/cisa-urges-endpoint-m= anagement-system-hardening-after-cyberattack-against-us-organization" targe= t=3D"_blank" title=3D"anonymous survey" rel=3D"noopener">anonymous survey</= a>. We appreciate your feedback!</p>
</div>
</div>
</div>
<div class=3D"l-constrain l-page-section--rich-text">
<div class=3D"l-page-section__content">
<div class=3D"c-field c-field--name-body c-field--type-text-with-summary c-= field--label-hidden">
<div class=3D"c-field__content">
<p>This product is provided subject to this=C2=A0<a href=3D"https://www.cis= a.gov/notification" target=3D"_blank" title=3D"Notification" rel=3D"noopene= r">Notification</a>=C2=A0and this=C2=A0<a href=3D"https://www.cisa.gov/priv= acy-policy" target=3D"_blank" title=3D"Privacy &amp; Use" rel=3D"noopener">= Privacy &amp; Use</a>=C2=A0policy.</p>
</div>
</div>
</div>
</div>
</div>
<style>body {
font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight: norma=
l; font-style: normal; color: #333333;
}
</style>
=20


<div id=3D"mail_footer">
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; colo=
r: #757575;">Having trouble viewing this message?=C2=A0</span><a href=3D"ht= tps://content.govdelivery.com/accounts/USDHSCISA/bulletins/40ef439" target= =3D"_blank" rel=3D"noopener">View it as a webpage</a>.=C2=A0<a href=3D"http= s://content.govdelivery.com/accounts/USDHS/bulletins/292141e" target=3D"_bl= ank" rel=3D"noopener"></a><span style=3D"font-size: 10.0pt; color: #757575;= "></span></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; color: #= 757575;">You are subscribed to updates from the </span><a href=3D"https://w= ww.cisa.gov"><span style=3D"font-size: 10.0pt;">Cybersecurity and Infrastru= cture Security Agency</span></a><span style=3D"font-size: 10.0pt; color: #7= 57575;"> (CISA)<br></span><a href=3D"https://public.govdelivery.com/account= s/USDHSCISA/subscriber/edit?preferences=3Dtrue#tab1" target=3D"_blank" rel= =3D"noopener"><span style=3D"font-size: 10.0pt; color: #00568c;">Manage Sub= scriptions</span></a>=C2=A0=C2=A0<span style=3D"font-size: 10.0pt; color: #= 757575;">|=C2=A0=C2=A0</span><a href=3D"https://www.cisa.gov/privacy-policy=
" target=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; colo=
r: #00568c;">Privacy Policy</span></a><span style=3D"font-size: 10.0pt; col= or: #757575;">=C2=A0=C2=A0|=C2=A0 <a href=3D"https://subscriberhelp.granicu= s.com/s/article/Subscriber-Help-Center" target=3D"_blank" rel=3D"noopener">= Help</a><a href=3D"https://insights.govdelivery.com/Communications/Subscrib= er_Help_Center" target=3D"_blank" rel=3D"noopener"></a></span><span style= =3D"font-size: 10.0pt; color: #757575;"></span></p>
<p style=3D"text-align: center;"><span style=3D"font-size: 10.0pt; color: #= 757575;">Connect with CISA: <br></span><a href=3D"https://www.facebook.com/= CISA" target=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; = color: #00568c;">Facebook</span></a><span style=3D"font-size: 10.0pt; color=
: #757575;">=C2=A0 |=C2=A0 </span><a href=3D"https://twitter.com/CISAgov" t= arget=3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; color: = #00568c;">Twitter</span></a><span style=3D"font-size: 10.0pt; color: #75757= 5;">=C2=A0 |=C2=A0 </span><a href=3D"https://Instagram.com/cisagov" target= =3D"_blank" rel=3D"noopener"><span style=3D"font-size: 10.0pt; color: #0056= 8c;">Instagram</span></a><span style=3D"font-size: 10.0pt; color: #757575;"= >=C2=A0 |=C2=A0 </span><a href=3D"https://www.linkedin.com/company/cybersec= urity-and-infrastructure-security-agency" target=3D"_blank" rel=3D"noopener= "><span style=3D"font-size: 10.0pt; color: #00568c;">LinkedIn</span></a><sp=
an style=3D"font-size: 10.0pt; color: #757575;">=C2=A0 |=C2=A0=C2=A0 </span= ><a href=3D"https://www.youtube.com/channel/UCxyq9roe-npgzrVwbpoAy0A" targe= t=3D"_self"><span style=3D"font-size: 10.0pt; color: #00568c;">YouTube</spa= n></a><span style=3D"font-size: 10.0pt; color: #757575;"></span></p>

</div>
<div id=3D"tagline">
<hr>
<table style=3D"width: 100%;" border=3D"0" cellspacing=3D"0" cellpadding=3D=

<tbody>

<td style=3D"color: #757575; font-size: 10px; font-family: Arial;" width=3D= "89%">This email was sent to cisa@toolazy.synchro.net using GovDelivery Com= munications Cloud, on behalf of: Cybersecurity and Infrastructure Security = Agency =C2=B7 707 17th St, Suite 4000 =C2=B7 Denver, CO 80202</td>
<td align=3D"right" width=3D"11%"><a href=3D"https://subscriberhelp.granicu= s.com/" target=3D"_blank" rel=3D"noopener"><img src=3D"https://content.govd= elivery.com/images/govd-logo-dark.png" border=3D"0" alt=3D"GovDelivery logo=
" width=3D"115"></a></td>
</tr>
</tbody>
</table>
<style type=3D"text/css">body .abe-column-block { min-height: 5px; } table.= gd_combo_table img {margin-left:10px; margin-right:10px;} table.gd_combo_ta= ble div.govd_image_display img, table.gd_combo_table td.gd_combo_image_cell=
img {margin-left:0px; margin-right:0px;}</style>

</div>
</td>
</tr>
</table>

<img alt=3D"" src=3D"https://links-2.govdelivery.com/CI0/0101019d02e3aa31-9= 3aafa61-70ca-44de-b67b-22b0c512d92c-000000/636FbmPidbF54i3zw5Uzdg7VNQXUI8Ez= 2aDSiOL4xIU=3D449" style=3D"display: none; width: 1px; height: 1px;">
</body>
</html>

--===============5725479500399676091==--

--===============3594005051263608816==--