“You can name it, you can sanction it — but you cannot stop what you cannot catch.” That is the dilemma facing European regulators and cybersecurity teams after new forensic reporting shows a bulletproof hosting provider sanctioned by the European Union simply reconstituted itself under new corporate names and continued servicing the same customers.
In May 2025 the EU imposed financial sanctions on the owners of Stark Industries Solutions Ltd., a firm long accused by investigators of providing “bulletproof” hosting to Kremlin-linked cyberattacks and coordinated disinformation operations. The designation was intended to freeze assets, disrupt revenue flows and raise the cost of offering a service that tolerates malware, phishing, botnet command-and-control, and other abuse. But detailed follow-up reporting shows the outcome was, at best, partial: operators behind Stark appear to have migrated domains, IP space and other assets into sister companies and rebranded services in ways that preserved operational continuity for their client base .
To understand why this matters, start with what “bulletproof hosting” is and why it is attractive to hostile actors. Bulletproof providers advertise deliberate resistance to takedowns and limited cooperation with abuse reporting — a business model optimized for availability rather than compliance. For actors who require uninterrupted infrastructure to run campaigns, this stability is a strategic asset. Stark arose in early 2022, just before Russia’s full-scale invasion of Ukraine, and quickly became a significant conduit for activity analysts tied to Kremlin-aligned actors — which is why the EU moved to sanction the company’s owners in 2025 .
What happened next reads like a playbook that seasoned investigators have seen before. According to the reporting, the operators used a mix of tactics to blunt the sanctions’ immediate effects:
/
Rapid rebranding and creation of corporate shells that obscure beneficial ownership and nominate substitute directors;
/
Fast migration of infrastructure — shifting domain registrations, IP allocations and control to alternate registrars or resellers so services come back online with minimal interruption;
/
Use of opaque intermediaries (registrars, payment processors, resellers) that act as buffers between enforcement actions and the underlying operators.
The practical consequence is sobering: an entity named in a sanctions list can be prevented from using some regulated financial channels, yet its ability to provide resilient hosting can survive because the people and technical assets behind it simply move or hide behind other corporate wrappers. KrebsOnSecurity’s analysis and subsequent coverage found familiar IP ranges and services reappearing under different corporate identities effectively controlled by the same operators, and customers who relied on those protections continued to find the support they needed .
Why should policymakers, technologists and ordinary users care? There are several stakes:
/
For policymakers: sanctions are a necessary tool of statecraft but, standing alone, they are blunt. They work best when part of a coordinated suite of measures — rapid takedowns, cross-border legal cooperation, pressure on registrars and payment rails, and transparency requirements that make beneficial ownership harder to hide.
/
For technologists and defenders: the episode highlights the need for faster signal-sharing, automated detection of infrastructure indicators of compromise, and more aggressive blocking at registrars, CDNs and upstream transit providers to raise the friction for malicious operators.
/
For users and platforms: the persistence of bulletproof infrastructure means that disinformation networks and criminal services can reconstitute quickly, prolonging campaigns that harm public discourse, commerce and national security.
Some industry voices argue the solution lies primarily in technical hardening and market incentives: make registrars and payment processors liable or reputationally exposed for facilitating abuse, deploy cryptographic attestations for domain ownership, and invest in automated, cross-provider takedown capabilities. Others say the fix must be legal and diplomatic — harmonized registry rules across jurisdictions and faster mutual legal assistance to pierce nominee director schemes. Both perspectives converge on one point: the internet’s fragmented governance and the transnational nature of infrastructure leave gaps that adaptive abuse networks exploit .
There are trade-offs. Aggressive, automated takedowns risk collateral damage to legitimate services and could be politically fraught when applied across borders. Heavy-handed regulatory rules may push bad actors into darker corners of the internet where detection is harder. Yet doing nothing preserves a low-cost, high-reward environment for actors who depend on continuity to run large-scale campaigns.
Ultimately, the Stark episode is less an indictment of sanctions as a policy tool than a demonstration of their limits when not combined with real-time technical responses and international cooperation. Sanctions signal political resolve and can choke formal finance, but they do not, by themselves, reach every node in a resilient, evolved hosting ecosystem. As one analyst put it in coverage of the case, naming and shaming must be matched by “faster cross-border coordination, tougher pressure on registrars and clear rules on who really owns these services” .
So where does that leave us? The lesson is clear and uncomfortable: good policy must meet the agile, iterative behavior of those who profit from disruption. If enforcement remains one step behind, the same actors will keep changing the game. As regulators refine tools and technologists sharpen defenses, the pressing question becomes not whether sanctions should be used, but how they should be integrated into a broader, faster, and more transparent architecture for policing internet infrastructure. Can Europe and its partners move from declaratory moves to a playbook that actually prevents the next rebrand from becoming the next campaign?
Source: https://krebsonsecurity.com/2025/09/bulletproof-host-stark-industries-evades-eu-sanctions/
