The Stark Industries Shell Game - When Bulletproof Hosting Proves Bulletproof
Summary: GreyNoise reports that Stark Industries Solutions, sanctioned by the EU on May 20, 2025, had roughly twelve days' warning from leaked EU documents that reached Moldovan media, and used that time to move Autonomous System AS44477 to a new RIPE organization, shift Russian infrastructure to Moscow-based UFO Hosting LLC, and prepare a rebrand to "THE.Hosting" under Dutch entity WorkTitans B.V. GreyNoise's Global Observation Grid data shows malicious infrastructure migrating from AS44477 (PQ Hosting Plus S.R.L.) to AS209847 (WorkTitans B.V.) between August and November 2025, with nearly identical tags, 24 shared VPN services, and overlapping JA4T hashes.
Key Takeaway: Sanctions landed on May 20, 2025, and the same operation was scanning from a new ASN within months, using less IP infrastructure to produce a higher daily tag volume than before - so the regulatory action bought disruption measured in weeks, not removal.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026