Bulletproof Host Stark Industries Evades EU Sanctions Date: September 11, 2025 Source: Krebs on Security --- Overview Stark Industries Solutions Ltd., a bulletproof hosting provider notorious for Kremlin-linked cyberattacks and disinformation, sidestepped EU financial sanctions imposed in May 2025. Despite sanctions on its Moldovan conduit PQ Hosting and owners Yuri and Ivan Neculiti, Stark has repeatedly rebranded and transferred assets to related corporate entities, negating the impact of sanctions. --- Key Details Background: Stark Industries Solutions emerged two weeks before Russia invaded Ukraine in 2022. It quickly became a major platform for Russian cyber warfare, including massive DDoS attacks, Russian-language proxies/VPNs, malware linked to Russia-backed groups, and dissemination of fake news. EU Sanctions (May 2025): The EU sanctioned PQ Hosting (Moldovan ISP serving as Stark's internet gateway) and the Neculiti brothers for their involvement in Russia’s hybrid warfare efforts. Evasion Tactics: Nearly two weeks before sanctions, Stark rebranded to the[.]hosting, controlled by Dutch entity WorkTitans BV (AS209847) as of June 24, 2025. Neculiti brothers reportedly received advance notice from media reports about the sanctions. They shifted Stark’s network assets to PQ Hosting Plus S.R.L, another Moldovan company linked via phone number reuse to the original PQ Hosting. These maneuvers indicate attempts to obfuscate ownership and maintain uninterrupted hosting services under new entities. Related Entities and Individuals: MIRhosting: A Netherlands-based hosting provider run by Andrey Nesterenko, linked to Stark’s operations but not mentioned in the sanctions. Nesterenko is a concert pianist with past ties to cyber warfare hosting. WorkTitans BV: Dutch company doing business also as Misfits Media and WT Hosting, connected to Stark’s assets. Youssef Zinad: Named in Dutch Chamber of Commerce incorporation documents as the founder of WorkTitans and linked to websites hosted by MIRhosting. He appears closely connected to MIRhosting operations, sharing contact details and promotional activity. Fezzy B.V.: Sole shareholder of WorkTitans, linked to Zinad via phone number and Facebook profile. Historical Context: Innovation IT Solutions Corp., associated with Nesterenko, hosted a hacktivist site during the 2008 Russia-Georgia war — possibly the first physical conflict coupled with simultaneous cyber warfare. --- Analysis and Conclusion The Recorded Future report states the EU sanctions against Stark Industries were largely ineffective. Affiliated infrastructure remains operational, and services have been quickly reestablished under new brands without significant disruption. Stark Industries demonstrates the resilience and adaptability of bulletproof hosting providers to evade legal and political pressure. MIRhosting appears to be a critical but overlooked component in maintaining Stark’s operations across infrastructure shifts. --- Tags and Categories Tags: Andrey Nesterenko, AS209847, DomainTools, Ivan Neculiti, MIRhosting, Misfits Media, PQ Hosting, PQ Hosting Plus S.R.L., Recorded Future, Stark Industries Solutions Ltd, WorkTitans B.V., WT Hosting, Youssef Zinad, Yuri Neculiti Categories: A Little Sunshine, Latest Warnings, Ne'er-Do-Well News, Russia's War on Ukraine --- References Recorded Future report on Stark Industries EU sanctions document: EUR-Lex KrebsOnSecurity coverage of Stark and MIRhosting (May 2024 and September 2025) --- This summary provides a standalone briefing on the ongoing challenges of enforcing sanctions on bulletproof