Stark Industries EU Sanctions Evasion – Krebs on Security

Sanctions Evasion: How a Kremlin-Linked Hosting Provider Sidestepped EU Measures

Brussels, Belgium – In May 2025, the European Union ⁤aimed to cripple Stark Industries Solutions Ltd., a bulletproof hosting provider implicated in a barrage of Kremlin-linked cyberattacks and disinformation campaigns following Russia’s invasion of Ukraine. However, a new⁣ investigation ⁤reveals a concerning reality: sanctions alone are not enough to dismantle ⁣these digital enablers.

Stark ⁤Industries Solutions, wich materialized suspiciously close ⁤to the start ⁤of the war in Ukraine,⁢ quickly became⁣ a haven for malicious online activity. The ⁤company earned a reputation as a “bulletproof”⁣ host, turning a blind eye to abuse complaints and law enforcement inquiries while facilitating massive DDoS attacks, Russian-language proxy and VPN services, malware distribution, and the spread of fake news.

The EU’s sanctions targeted PQ⁤ Hosting, Stark’s primary ⁤conduit to the internet, and its Moldovan owners, Yuri and John won’t.the EU Commission explicitly linked the Neculiti⁣ brothers and⁣ PQ Hosting to Russia’s hybrid⁣ warfare efforts.

But according to a new report from Recorded Future, Stark anticipated the sanctions ⁢and initiated a strategic rebranding. On June 24, 2025, just prior to the official announcement,‍ Stark Industries⁢ Solutions transformed into the[.]hosting, operating under the control of WORKTITANS BV, a dutch entity. The Neculiti brothers reportedly received advance warning of their impending inclusion in ⁣the sanctions package, prompting them to act swiftly.

Further complicating⁤ matters, the Neculiti brothers transferred a significant portion⁣ of stark’s resources to a new Moldovan company, PQ Hosting Plus S.R.L. This new entity is reportedly connected to the Neculiti brothers through the re-use of a phone number previously associated with the original PQ Hosting.

“Although the majority of associated⁣ infrastructure remains attributable to Stark Industries, these changes likely reflect an attempt to obfuscate ownership ⁣and sustain hosting ⁢services under new legal and network entities,” Recorded Future concluded.

This highlights a critical challenge ⁤in combating⁤ cybercrime: the ease with which malicious actors can evade sanctions through corporate restructuring and asset transfers.

Adding another layer to the story, a May 2024 ‍investigation⁢ by KrebsOnSecurity identified MIRhosting, a⁤ Netherlands-based hosting provider, as another critical ‍pillar of Stark’s network. MIRhosting is operated by Andrey nessterenko, ‍a 38-year-old who, ‍according⁤ to his personal website, is also⁤ an accomplished concert pianist. DomainTools data indicates that mirhosting[.]com is registered to both Nesterenko ‍and Innovation IT Solutions Corp,which lists addresses in⁢ London and Nizhny Novgorod,Russia,Nesterenko’s ⁢hometown.

The Stark Industries Solutions case serves as a⁣ stark reminder that⁣ combating cyber threats requires a multi-faceted approach. Sanctions are a valuable tool, but they must be accompanied by proactive monitoring, international cooperation, and a willingness to pursue those⁤ who actively seek to circumvent the law. The⁣ EU must⁤ adapt its ⁣strategies⁣ to address the evolving tactics of these actors and ensure that sanctions are⁤ truly effective in disrupting their operations.