Swarm Brief

On 11 March 2026, an Iranian two-team operation destroyed 200,000 enterprise devices at Stryker without deploying a single piece of malware. One compromised Global Administrator account. One MDM console. Five hours. Swarm Brief 2602 maps the TTPs behind the Handala and MuddyWater operation and the scenario CovertSwarm would run against your environment.