Widely attributedUnknown

Stark Industries Solutions

Russian bulletproof hosting provider used extensively by Russian state-sponsored and cybercriminal threat actors for C2 infrastructure, DDoS attacks, and malicious hosting.

Compare attribution across sources →

Attribution signal

?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low

1.6

Low signal strength

Mentions2

Sources1

High conf.2

Last seenJun 2026

First observed

—

Last active

—

Origin

Russia

Aliases

Techniques

Campaigns

Russia

RegionsGlobal

Attribution signals

2 mentions · 1 source

#1sanctioned forhigh

HUMINT

recorded-future

May 2026

"the European Union sanctioned UK-registered hosting provider Stark Industries Solutions and its executives for enabling Russian state-sponsored cyber operations"

#2confirmshigh

InfrastructureTTP match

greynoise

Jun 2026

"Analysis of GreyNoise's Global Observation Grid data confirms a seamless migration of malicious infrastructure from AS44477 (PQ Hosting Plus S.R.L.) AS209847 (WorkTitans B.V.) between August and November 2025. The behavioral signatures, geographic distribution, VPN services, and scanning patterns provide strong evidence this represents the Stark Industries rebranding operation."

Hedge terms observed

confirmssanctioned for