Executive Summary and Provider Overview

Quick-Reference Attributes

Overall Assessment

Stark Industries Solutions Ltd is a UK-registered, Russia-aligned bulletproof hosting provider that emerged two weeks before Russia's full-scale invasion of Ukraine in February 2022 and rapidly became "prime real estate" for Kremlin-linked cyberattacks and disinformation campaigns. Operated through a layered corporate structure by Moldovan brothers Iurie and Ivan Neculiti, with Dutch infrastructure managers Youssef Zinad and Andrey Nesterenko, Stark hosted credential-harvesting operations for Russian state-aligned espionage clusters, DDoS infrastructure for hacktivist group NoName057(16), and server capacity for major cybercrime groups including FIN7 and multiple ransomware ecosystems.

The provider demonstrated exceptional resilience against regulatory pressure. When EU sanctions were announced on 20 May 2025, the Neculiti brothers had already transferred AS44477 to a freshly-created RIPE organization (PQ Hosting Plus S.R.L.) on 16 May, migrated Russian infrastructure to UFO Hosting LLC as early as 10 April, and within weeks rebranded operations as THE.Hosting under Dutch entity WorkTitans B.V. with a new ASN (AS209847, created 24 June 2025). GreyNoise data confirmed a seamless migration of malicious activity between the two ASNs between August and November 2025, with virtually identical behavioral signatures, VPN profiles, and scanning patterns.

As of June 2026, Dutch FIOD arrested Zinad and Nesterenko on 18 May 2026 and seized 800+ servers from five locations. Despite this, AS209847 remains active with over 200 prefixes still routing as of 6 June 2026, confirmed by direct RIPE NCC RIPEstat query. The Neculiti brothers remain at large and sanctioned. The overall assessment is Degraded: infrastructure substantially disrupted but not dismantled, with high reconstitution capacity demonstrated by prior rebranding behavior.

GreyNoise blog header for "The Stark Industries Shell Game," documenting the seamless migration of malicious infrastructure from AS44477 (PQ Hosting Plus) to AS209847 (WorkTitans B.V. / THE.Hosting) between August and November 2025.

GreyNoise, November 2025

GreyNoise Global Observation Grid data showing the migration of malicious activity from AS44477 (peak Aug 18 to Sep 15, near-complete abandonment by Nov 10, 2025) to AS209847 (ramp-up begins Aug 25; maintained post-AS44477).

GreyNoise, November 2025

GreyNoise daily unique tag distribution showing virtually identical behavioral signatures across the AS44477 to AS209847 transition. The post-migration ASN achieved the same malicious activity volume with a smaller IP footprint.

GreyNoise, November 2025

Dutch FIOD (Tax Intelligence and Investigation Service) enforcement action against Stark Industries / WorkTitans infrastructure, May 2026. Raids conducted at three business addresses in Enschede and Almere, and two data centers in Dronten and Schiphol-Rijk.

BleepingComputer / FIOD, May 2026

Servers seized during the FIOD raids at Stark Industries / WorkTitans / MIRhosting facilities, May 18-22, 2026. FIOD seized over 800 servers, plus laptops, phones, and administrative records from five locations.

FIOD / BleepingComputer, May 2026

Lineage and Organizational Heritage

Brand and Entity Structure

Evidentiary Pillars for Lineage

Infrastructure continuity (CONFIRMED): GreyNoise Global Observation Grid data confirms a seamless migration of malicious activity from AS44477 (PQ Hosting Plus S.R.L.) to AS209847 (WorkTitans B.V.) between August and November 2025. The two ASNs share 24 VPN service signatures in common, with near-identical behavioral tags, JA4T hashes, scanning patterns, and geographic distribution. Recorded Future Insikt independently tracked prefix migration and client reappearance on AS209847.

Personnel continuity (CONFIRMED): EU and French sanctions registers identify Iurie and Ivan Neculiti as controlling both Stark Industries Solutions Ltd and PQ Hosting / PQ Hosting Plus via shared phone numbers and corporate records. KrebsOnSecurity documented that Nesterenko included Zinad in email correspondence as early as 2024, linking MIRhosting and WorkTitans to a shared operator circle. Dutch Chamber of Commerce records confirm WorkTitans' sole shareholder is Fezzy B.V., tied to Zinad.

Preemptive sanctions evasion (CONFIRMED): Insikt Group documents the Neculiti brothers received advance notice of EU sanctions via leaked Moldovan and EU media reporting on 8-9 May 2025, 12 days before the official designation. Between April 10 and May 16, the network migrated Russian infrastructure to UFO Hosting, created ORG-PHPS1-RIPE (PQ Hosting Plus), and transferred AS44477 to the new organization. By the time sanctions landed, the infrastructure was already repositioned.

Disputed Assessments

No substantial public dispute exists about the core Stark / PQ / WorkTitans / MIRhosting lineage. The primary analytical disagreement in open sources concerns how deliberate the state nexus is (see Section 07) rather than whether these entities are linked. MIRhosting publicly denied knowingly supporting illegal operations, claiming it acted on abuse complaints; FIOD's charging theory rejects this framing by treating infrastructure provision to sanctioned entities as sufficient for sanctions violation regardless of stated intent.

Operator Profiles

2.1 Iurie (Iuri / Yuri) NECULITI

Aliases: Iurie Neculiti; Iuri Neculiti; Yuri Neculiti (variations across EU and French sanctions documents). No confirmed online handles or forum nicks in open sources [Intelligence Gap].

Role: CEO of Stark Industries Solutions Ltd; associated with PQ Hosting and PQ Hosting Plus S.R.L. through corporate records and sanctions findings.

Assessed nationality: Moldovan (EU sanctions materials; Moldovan company registration for PQ entities).

Assessed current location: Moldova or EEA region; not publicly confirmed post-sanctions.

Legal status: Sanctioned by EU Council (RUSDA program), 20 May 2025. Mirrored in Belgian, Latvian, French, and other national sanctions registries. No public indictment or arrest as of June 2026.

Designation basis: Providing web-hosting infrastructure used by Russian state-aligned threat actors to conduct cyberattacks, credential harvesting, and influence operations against EU and NATO-aligned targets including government, military, and critical infrastructure.

2.2 Ivan NECULITI

Role: Owner of Stark Industries Solutions Ltd; co-owner of PQ Hosting (Moldova).

Assessed nationality: Moldovan.

Assessed current location: Moldova or EEA region; not publicly confirmed.

Legal status: Sanctioned by EU Council (RUSDA program), 20 May 2025, jointly with Iurie. No public indictment or arrest as of June 2026.

Designation basis: Ownership and control of Stark Industries Solutions and PQ Hosting infrastructure used for cyberattacks and information operations aligned with Russian state interests.

2.3 Youssef ZINAD

Role: Director of WorkTitans B.V.; principal of Fezzy B.V.; linked to MIRhosting operations. Formed WorkTitans B.V. in 2019 using email [email protected].

Age / Location: 57, Amsterdam, Netherlands.

Legal status: Arrested 18 May 2026 by Dutch FIOD. Charged with violating EU sanctions by providing economic resources (hosting and connectivity) to sanctioned Stark-linked entities. Case ongoing; presumed innocent pending trial.

Designation basis: Not individually sanctioned at time of writing. Charged under Dutch sanctions law for infrastructure support to EU-sanctioned entities.

2.4 Andrey NESTERENKO

Role: Co-operator of hosting infrastructure linked to WorkTitans and MIRhosting. Documented in 2024 KrebsOnSecurity email thread that included Zinad in correspondence, establishing the Nesterenko-Zinad-MIRhosting-WorkTitans operational link.

Age / Location: 39, The Hague, Netherlands. Nationality not stated in English-language reporting.

Legal status: Arrested 18 May 2026 by Dutch FIOD. Charged with sanctions violations. Case ongoing; presumed innocent pending trial.

Designation basis: Charged for providing hosting capacity and connectivity to EU-sanctioned Stark-linked entities; not individually sanctioned as of June 2026.

Operational and Business Model

Service Model

Stark and its successor brands operated as high-risk, abuse-tolerant infrastructure providers offering VPS and dedicated servers with liberal abuse handling, high-volume bandwidth suitable for DDoS and C2, and optional "bulletproofing" via ASNs resistant to quick de-peering. The provider targeted clients requiring persistent infrastructure immune to abuse complaints, law enforcement requests, and network-level takedown.

Primary service categories: VPS/dedicated servers (Moldova and Netherlands DCs); high-bandwidth nodes for DDoS campaigns; proxy and VPN relay infrastructure; VM images deployable via ISPsystem's VMmanager (enabling rapid re-provisioning).

Verbatim Advertising Copy

Onboarding and Vetting

No detailed documentation of KYC or vetting procedures is available in open sources. Available evidence is consistent with open signup via website with minimal verification, the standard BPH posture. The concentration of high-end state-aligned and criminal actors suggests possible informal vetting for especially sensitive services (dedicated boxes, high-bandwidth nodes), but this is ANALYST INFERENCE not directly evidenced.

Pricing and Service Tiers

Specific price tables and named service tiers are not captured in open sources. Stark's offerings appear in the mid-tier range compared to other BPHs on Russian-language forums, based on OWN-CERT's BPH landscape analysis. No historical price lists or archived website snapshots with pricing are available in the prioritized source set [Intelligence Gap].

Downstream Reseller Chain

Evidence points to downstream use of Stark / PQ / MIRhosting infrastructure via ISPsystem VMmanager installations, enabling third-party resellers to package and sell capacity. Sophos documents widely reused VM images associated with Stark infrastructure that served multiple criminal actors. Specific named reseller brands marketing Stark explicitly are not documented in open sources.

Abuse Handling and LE Posture

Phish.report and similar abuse services list STARK-INDUSTRIES-SOLUTIONS-AS, MD (AS43624) with standard abuse mailbox entries; however, CERT-EU and vendor reporting consistently notes that complaints resulted in slow or no action, consistent with bulletproof behavior. MIRhosting publicly claimed to act on abuse complaints; FIOD's May 2026 enforcement action rejected this as a defense against sanctions liability. The operator set's behavior across multiple rebrands (Stark to THE.Hosting to WorkTitans) demonstrates a consistently adversarial posture toward regulators and LE.

OPSEC and Support Channels

Stark's specific operational communications (Jabber, Telegram, ticketing portals) are not documented in open sources. A ticket-based support system via the stark-industries[.]solutions and later the[.]hosting portals is a reasonable inference from standard BPH operational models. No leaked chat logs or panel screenshots have appeared in the prioritized source set [Intelligence Gap].

Technical Capabilities and Infrastructure Footprint

ASN Summary

Representative IPv4 Ranges (AS209847, Active June 2026)

Direct RIPE NCC query of AS209847 on 6 June 2026 returned the following active /24 prefixes (non-exhaustive selection; 200+ total active prefixes confirmed):

Data Center Footprint

Stark and its successor entities leased or colocated hardware via PQ Hosting, MIRhosting, and WorkTitans rather than owning datacenter real estate directly. MIRhosting provided physical servers and transit to AMS-IX (Amsterdam) and DE-CIX (Frankfurt) as the connectivity backbone.

Upstream Transit Chain

Phase 1 (2022 to mid-2025): PQ Hosting (Moldova) as primary upstream and infrastructure layer; Stark-branded ASNs (AS44477, AS43624) routed via PQ facilities.

Phase 2 (mid-2025 to present): MIRhosting (Almere, Netherlands) as primary colocation and transit provider for WorkTitans / THE.Hosting (AS209847), with high-capacity connections to AMS-IX and DE-CIX Frankfurt. MIRhosting served as the transport layer through which THE.Hosting traffic entered European internet infrastructure.

De-peering events: EU sanctions on PQ Hosting and PQ Hosting Plus (May 2025) triggered financial exclusion and forced migration of RIPE resources to new entities. AS44477 and AS43624 are now fully de-registered. No documented upstream de-peering events targeted AS209847 before the FIOD arrests, explaining its persistence post-sanctions. As of June 2026, AS209847 continues to route despite the May 2026 arrests.

RIPE abuse contacts: AS43624 (PQ Hosting, MD) listed standard NOC/abuse mailboxes per phish.report. AS209847 (WorkTitans) lists a Dutch address and abuse mailbox in its RIPE object; these were the formal complaint channels for Stark/THE.Hosting traffic after the sanctions rebrand.

Resilience Techniques

• ASN agility: Rapid migration of prefixes from Stark-labeled ASNs to AS209847 while preserving customer base and malicious activity profiles. The transfer of AS44477 to PQ Hosting Plus S.R.L. four days before sanctions was a documented preemptive maneuver.
• Multi-datacenter redundancy: Multiple Dutch facilities (Dronten, Enschede, Almere, Schiphol-Rijk) plus Moldovan facilities provided resilience against single-facility takedowns.
• Rebranding and shell layering: Serial use of Stark, PQ Hosting Plus, THE.Hosting / WorkTitans, with MIRhosting providing the physical layer; each rebrand inserted a new legal entity between the operator and the infrastructure.
• Preemptive intelligence: Demonstrated ability to receive advance warning of sanctions (via leaked EU media, May 2025) and execute infrastructure migration before formal designation.
• VM image standardization: Use of ISPsystem VMmanager installations to enable rapid re-provisioning of customer VMs across infrastructure, reducing the impact of node-level takedowns.

Hosted Activity Types

Blocklist Standing

Known Weaknesses Exploited

Dutch jurisdictional vulnerability: Concentrating physical infrastructure in Netherlands facilities created a jurisdictional exposure that FIOD leveraged in May 2026. Under Dutch sanctions law, providing economic resources (hosting, connectivity) to sanctioned entities constitutes a violation regardless of whether the provider claims ignorance of client identity. This enabled rack-level seizures, not just individual IP takedowns.

Limited operator set: Reliance on a small circle of operators (Neculiti brothers, Zinad, Nesterenko) and known corporate shells (Fezzy B.V., WorkTitans, MIRhosting) allowed sanctions packages to target overlapping individuals and companies, concentrating legal pressure even when technical impact was limited.

Shell company transparency: KrebsOnSecurity traced WorkTitans to Fezzy B.V. to Zinad through public Dutch Chamber of Commerce records and open-source OSINT on phone numbers. The shell structure was legally obfuscating but not operationally opaque.

Financial Infrastructure

Payment Methods

Direct evidence of Stark's payment interfaces is sparse in open sources, consistent with BPH operational security norms.

• Cryptocurrencies (CONFIRMED): GreyNoise and other vendors explicitly list crypto payments as part of Stark's offering. Post-sanctions, crypto is the dominant plausible channel given financial exclusion from EU banking.
• Traditional bank / card payments: Not documented in available sources. EU sanctions effectively cut Stark and PQ entities off from formal EU financial systems from May 2025 onward.

Wallet Clusters and On-Chain Analysis

Three-Phase Laundering Model

The three-phase laundering pattern (acquisition, layering, extraction) cannot be reconstructed from open sources given the absence of wallet IOCs. This remains a significant intelligence gap that limits financial disruption options (OFAC wallet designation, exchange-level blocking).

Sanctions and Risk Ratings

TRM Labs and other risk-rating vendors classify Stark as a high-risk "hybrid threat infrastructure" entity, but specific VASP-level risk scores are not public.

Client Profile and Hosted Operations

Crimeware Verticals by Evidence Tier

Client Geography

Client infrastructure concentrated in Moldova and Netherlands IP ranges, but used to target EU, UK, US, and Ukrainian entities. No evidence of a CIS exclusion zone, consistent with a provider serving Russian state-aligned actors targeting outward rather than protecting domestic interests. Campaign targeting patterns documented in CERT-EU confirm EU and NATO-aligned government, military, energy, and democratic institutions as primary targets.

Notable Hosted Cases

EU/UK hybrid threat sanctions package (May 2025): Stark cited as a key enabler of Russian cyber and information operations in the RUSDA sanctions package. Underlying EU designation narratives summarized in TRM Labs and Cyfluence highlight use for campaigns against military, energy, logistics, and democratic institutions, though the full technical annex is not public.

Dutch FIOD enforcement action (May 2026): 800+ servers used by Russian-aligned cyberattack and disinformation operations seized from five locations. FIOD and De Volkskrant explicitly linked the seized infrastructure to Stark / WorkTitans / MIRhosting and to NoName057(16) DDoS operations against Danish infrastructure.

State Nexus Assessment

Assessed Tier: Probable Cooperation (Tier 3 of 4)

Evidence supports more than tolerated safe harbor. The EU sanctions designation explicitly states that Stark "enabled Russian state-sponsored cyber operations" including information manipulation, cyberattacks, and destabilizing hybrid activities. CTI reporting shows systematic and repeated hosting of infrastructure for Russia-aligned APT and influence clusters, not merely generic cybercrime. The emergence of the provider two weeks before Russia's February 2022 invasion, the consistent alignment of hosted operations with Russian state objectives (targeting NATO democracies, Ukrainian entities, EU critical infrastructure), and the use by TAG-53 / Callisto / COLDRIVER-like clusters (assessed FSB-linked by multiple vendors) collectively support probable cooperation.

Tier 4 (Direct Control) is not justified: no public leaks, court documents, or technical evidence show direct FSB/GRU tasking, payment flows to Stark operators from Russian state actors, or shared infrastructure administration accounts between Stark and Russian state agencies.

Evidence Supporting Probable Cooperation

• EU Council RUSDA designation language: "enabling Russian state-sponsored cyber operations and information manipulation" — this exceeds the language typically used for tolerated-safe-harbor assessments.
• Systematic co-location of state-aligned espionage clusters (TAG-53 / COLDRIVER) and hacktivist infrastructure (NoName057(16)) on the same ASNs, suggesting deliberate client selection or at minimum willful blindness.
• Emergence timing: provider formed February 10, 2022, two weeks before Russia's full-scale invasion, suggesting anticipatory infrastructure preparation aligned with Russian operational planning.
• Rapid, orderly sanctions preemption (April-May 2025) requiring advance intelligence about EU regulatory actions, suggesting access to information channels beyond public media.

Negative Evidence

• No public court documents or leaked communications showing direct FSB/GRU tasking of Stark operators.
• No technical evidence of shared administrative accounts between Stark infrastructure and Russian state agencies.
• No confirmed payments from Russian state entities to Neculiti brothers or associated companies in open sources.
• Both arrested operators (Zinad, Nesterenko) are Netherlands-based, not Russian nationals; their charging is under sanctions law, not espionage or state-directed cyber statutes.

Jurisdictional Separation

Law Enforcement and Regulatory Response

Sanctions and Policy Actions

Indictments, Arrests, and Charges

Netherlands (FIOD), 18 May 2026: Dutch fiscal intelligence and investigation service (FIOD) arrested Youssef Zinad (57, Amsterdam) and Andrey Nesterenko (39, The Hague) following a multi-location enforcement operation. FIOD conducted raids at three business addresses in Enschede and Almere and two data centers in Dronten and Schiphol-Rijk. Seized: 800+ servers, laptops, phones, and administrative records.

Charges proceed under Dutch sanctions law (not pure cybercrime statutes): the suspects are alleged to have indirectly provided economic resources to Russian and Belarusian entities sanctioned by the EU, with the infrastructure assessed to have supported Russian Federation activity undermining democracy and security through cyberattacks, foreign interference, and disinformation. Cases are ongoing; both individuals are presumed innocent pending trial.

The Neculiti brothers have not been indicted, arrested, or charged in any jurisdiction as of June 2026.

Infrastructure Seizures and Takedowns

2024 (preliminary action): Dutch authorities confiscated several hundred servers during earlier enforcement actions against WorkTitans-linked infrastructure prior to the May 2026 raids. Specifics not fully documented in open sources.

May 18-22, 2026 (main FIOD action): 800+ servers seized from Dronten and Schiphol-Rijk data centers and three business addresses. This represents the largest single enforcement action against Stark-linked infrastructure to date.

Post-Disruption Client Migration

After EU sanctions (May 2025): Recorded Future and GreyNoise confirm near-immediate migration of malicious activity from AS44477 (PQ Hosting Plus) to AS209847 (WorkTitans / THE.Hosting) with minimal downtime, strong IOC continuity, and near-identical behavioral profiles. Clients experienced no apparent operational disruption.

After FIOD 2026 raids: Full migration patterns are still emerging as of June 2026. AS209847 remains active with 200+ prefixes three weeks after the arrests (confirmed RIPE data). Some operations likely shifted to alternative Russia-aligned BPHs; others may remain on surviving WorkTitans infrastructure. Complete post-2026 picture is an intelligence gap.

Impact Assessment

Short-term impact: Noticeable but temporary reduction in malicious traffic from seized IP ranges; some campaigns paused or retooled infrastructure. The 2026 physical server seizure removes hardware, which has a higher reconstitution cost than a legal entity rebrand.

Medium-term impact: Limited. Prior behavior demonstrates high substitution capacity. The operator's documented ability to pre-position infrastructure before enforcement suggests additional shell entities or alternative upstreams may already exist. AS209847 remaining active three weeks post-arrest indicates the infrastructure layer is not fully dependent on Zinad and Nesterenko's continued freedom.

Structural impact: The arrests of two Netherlands-based operators and the seizure of server hardware represent a meaningful escalation above the purely sanctions-based pressure applied in 2025. However, the primary operators (Neculiti brothers) remain at large and sanctioned in jurisdictions (Moldova, possibly Russia) that have not extradited or arrested them.

Connected Groups and Ecosystem Relationships

Trajectory Assessment

Infrastructure Churn and Market Position

Stark / WorkTitans / THE.Hosting is best characterized as a major backbone provider in the Russia-aligned hybrid threat ecosystem, not a niche host. Its recurring appearance across high-profile CTI, the RUSDA sanctions package, and the FIOD enforcement action places it among the most extensively documented BPH operators in Europe. The breadth of hosted activity (state-aligned APT, hacktivist DDoS, ransomware, financial crime) indicates a provider serving the full spectrum of Russian-aligned threat actors rather than a speciality niche.

Disruption History

Trajectory Direction

Status: Degraded but Resilient. The FIOD 2026 server seizure represents the most impactful enforcement action against this ecosystem to date, removing physical hardware rather than merely imposing legal sanctions. However, the continued activity of AS209847 three weeks post-arrest indicates the infrastructure layer is not fully dependent on the arrested Dutch operators. The Neculiti brothers remain the assessed principals of the broader Neculiti-controlled network and have not faced arrest, prosecution, or extradition.

The pattern to date (2022-2026) demonstrates a provider with high reconstitution capacity: each disruption (sanctions, preliminary server seizures) has been followed within weeks by a functional rebrand. The 2026 FIOD action is more severe due to physical seizure, but the Neculiti-controlled corporate structure provides multiple reconstitution pathways.

Intelligence Gaps (Mandatory)

Developments (2022-June 2026)

Sources and Evidence Base