In May 2025, European Union imposed financial sanctions on owners Stark Industries Solutions LimitedA bulletproof hosting provider, who was physical two weeks before Russia attacked Ukraine and quickly became a top source of cyber attacks and disintegration campaigns associated with Kremlin. But the new findings suggest that those restrictions have greatly reduced to prevent Stark from rebranding and to prevent their property from transferring other corporate institutions controlled by their original hosting providers.
Picture: Shuttersk.
A few weeks before Russia attacked Ukraine in 2022, Stark Industries Solutions became a frequent source of large-scale DDOS attacks, Russian-language proxy and VPN services, which tied to Russia-supported hacking groups and fake news. ISPs like Stark are called “bulletproof” provider when they cultivate a reputation to ignore any misconduct of activity on their network or ignor police inquiries.
In May 2025, European Union Accepted Stark-based out of two main associations for large internet PQ hosting – Also the owners of the company’s Moldovan Yuri And Ivan NCCThe European Union stated that the NCC brothers and PQ Hosting were linked to Russia’s hybrid war efforts.
But A new report From Recorded future It is revealed that Stark was re -designed before the announcement of sanctions (.) HostingIn control of dutch unit Worktitons B.V. (As209847) on 24 June 2025. The NCC brothers found a head about 12 days before the alleged announcement of sanctions, when Moldovan and the European Union media reported on the upcoming inclusion of the nakulity brothers in the package of sanctions.
In response, the NCC Brothers transferred a lot of Stark’s considerable address space and other resources for a new company in Moldova. Pq hosting plus srlA unit is allegedly associated with the NCC brothers Reusing a phone number From the original PQ hosting.
“Although most of the affiliated infrastructure is responsible for Stark industries, the possibility of these changes shows an attempt to reduce ownership and maintain hosting services under new legal and network institutions,” the future has been said.
Neither recorded future reports from the European Union nor the May 2025 sanctions mentioned another important column of Stark’s network that Krebsanascurity identified the infamous bulletproof hoster: Netherlands-based hosting provider in May 2024 profiles. Mirhosting,
Mirhosting is operated by 38 years old Andre NesterncoWhose personal website It is said that he is a skilled concert pianoist who started performing publicly at an early age. Domantols Mirhosting (.) Com says, Sri Nerter is registered in Nestronco and Two Innovation IT Solution CorpWhich lists addresses in London and Nesteronko’s hometown Nizni Novgorod, Russia.
Image Credit: Reaventiv.org.
In the book Inside cyber warfare By Jeffrey Carr, Innovation was responsible for IT Solutions Corp Hosting Stopgeorgia (.) RuA hecticist website for organizing a cyber attack against Georgia that appeared at the same time, Russian forces invaded the former Soviet nation in 2008. The struggle was considered the first war in which there was a notable cyber attack and a real military engagement.
Sri Nesternco did not respond to the recommendations of the comment. In May 2024, Sri Nesternco said he could not verify if Stopgoria was ever a customer because he did not record. But he said that Stark Industries Solutions Inc. was only one of the many customers, and claimed that Mirhosting did not receive any action to take any action about the misconduct on Stark.
However, it appears that Mirhosting is once again the new home of Stark Industries, and that Mirhosting Employees are both (.) Hosting and Worktitons – Primary beneficiaries of Stark’s property are managing both.
The Dutch Chamber of Commerce shows a copy of incorporation documents for Worktitons Biwi Mifits Media and and WT hosting (Given the historical relationship of Stark for Russian disintegration websites, “Missfits” is a bit on the nose).
A incorporation document from the Netherlands Chamber of Commerce to Worktitons Biwi.
Correction document says the company was formed in 2019 y.zinad@worktitans.nlHe matches email address A linkeded account For one Youssef zinadThose who say that their individual websites are Worktitan (.) NL and Custom-Solutions (.) NL. The profile also links to a website (etripleasims dot nl) that currently blocks as a maliciousin as malicious. All these websites have been hosted in Mirhosting.
Although no employment has been mentioned in Mirhosting in Mr. Zind’s LinkedIn Profile, all his LinkedIn Posts have been resurrected in the last one year for the services of Mirhosting.
Mr. Zind’s LinkedIn Profile is filled with posts for Mirhosting’s services.
A Google Search for Yassef Zinad reveals several startup-tracking websites that listed it as the founder of (.) Hosting, Sensys.io Has hosted by Finds Pq hosting plus srl,
The Dutch Chamber of Commerce Document says that Almere, the only shareholder of Worktitons, is a company in the Netherlands Fazi B.V. Who runs Fezzy? Phone number listed in Google Search for Fezzy BV – 31651079755 – It was also used to register a registered Facebook According to the Breach Tracking Service, Profile for a Yassef Zinad from the same city Constale Intelligence,
In a series of email exchanges leading to Krebsnsurity’s May 2024 deep dive on Stark, Sri Nesternco included him as part of the company’s legal team, including Sandesh Thread (YOSEF@MirHOSTING.COM). The Dutch website Stagmarkt (.) NL has listed Yasef Zinad as an official contact for the offices of Mirhosting in Almere. Mr. Zinde did not respond to the remarks requests.
Given the above, it is difficult to argue with the future report recorded on Stark’s Rebranding, which concluded that “the European Union’s approval was largely ineffective, as the affiliated infrastructure was in operation and services were re -established under the new branding, which had no significant or permanent deprivation.”
