EU sanctions fail to halt Stark Industries as hosting network rebrands, resurfaces

A few months after the European Union announced in May 2025 that it had banned Stark Industries Solutions Ltd., the majority of individuals who knew the company made a quick assessment that it would collapse. Contrary to expectations, the company has returned with multiple pseudonyms and investment companies, demonstrating the extent to which such resilient hosting businesses are indeterminable.

Stark made its debut shortly before the outbreak of the war in Ukraine in 2022. Almost immediately, researchers began linking the provider to DDoS campaigns, proxy services, and malware traced back to Kremlin-backed hacking groups. Its reputation grew quickly because it ignored takedown requests and law enforcement complaints, earning the “bulletproof” label.

The EU targeted Stark’s Moldovan partners, PQ Hosting, and its owners, Yuri and Ivan Neculiti, accusing them of supporting Russia’s hybrid warfare tactics. Yet reports show the Neculiti brothers anticipated the crackdown. Local media hinted at the sanctions nearly two weeks before they became official, giving the operators enough time to shift their resources elsewhere.

According to new research by Recorded Future, Stark rebranded as the.hosting in late June under the Dutch company WorkTitans BV. At the same time, much of the infrastructure moved to PQ Hosting Plus S.R.L., another Moldovan firm that used the same phone number as the original provider. These moves allowed Stark’s operations to continue with little interruption.

Investigators also point to the Dutch-based MIRhosting, which Andrey Nesterenko runs, as another critical aspect in the chain. There are corporate records and LinkedIn activities that show the connection between the staff of MIRhosting with WorkTitans, notwithstanding that they have publicly declared that they have no direct involvement. Besides that, the documents disclose that WorkTitans operates under different trade names such as Misfits Media and WT Hosting. The entrepreneur Youssef Zinad connects to both of them, and his contact details link to MIRhosting’s offices in Almere.

These intertwined connections symbolize the resemblances of the operators. Every time regulators take action against one of the entities, the operators distribute the assets to another legal entity and operate under a different brand. Experts say this process is problematic for enforcement as the infrastructure is still there even when the names and the registrations change.

Recorded Future was very straightforward in their assessment: the sanctions made very little interruption, and Stark’s services were almost immediately available under new names. This example shows how politically backed, resourceful networks can still evade the traditional regulatory pressure and make governments fight the time between the decision and the actual enforcement.