“You can’t sanction what you can’t find” — or so the argument goes when sanctions hit a firm that promptly reappears under a new name. In May 2025 the European Union moved to freeze and disrupt Stark Industries Solutions Ltd., a bulletproof hosting operator long associated with Kremlin-linked cyberattacks and disinformation campaigns. Within months, however, forensic reporting found the same infrastructure and services resurfacing under different corporate shells, raising a stark question: do sanctions on paper matter if the actors and capabilities remain intact?
Stark Industries Solutions Ltd. drew attention because of its timing and role. The company was formed just weeks before Russia’s full-scale invasion of Ukraine and quickly became a favored hosting environment for operations that mainstream providers would not tolerate. That “bulletproof” model — tolerating or actively insulating malicious activity like malware distribution, phishing, botnet command-and-control, and coordinated disinformation — made Stark a tempting target for policymakers seeking to raise the cost of malign cyber activity. The EU’s May 2025 designation sought to freeze assets and sever financial and commercial ties to its owners; the aim was disruption and deterrence.
But the post-sanctions chronology was less definitive than intended. Investigators and independent journalists tracking the infrastructure observed rapid reconstitution: IP ranges, domain portfolios, and even customer-facing services formerly tied to Stark reappeared under new corporate names and registrars controlled by the same operators. In short, the legal entity was sanctioned, but the operational capability largely endured. That pattern — dissolve the legal wrapper, re-register assets, and keep operations humming — is a familiar evasion playbook in the world of illicit hosting.
Why that resilience matters goes to the heart of modern cyber conflict. Bulletproof hosts provide a continuity that lets state proxies and criminal groups mount long-running campaigns: infrastructure for command-and-control, resilient platforms for disinformation amplification, and safe havens for malware distribution. When those platforms can be rapidly rebuilt behind different corporate names and intermediaries, the tactical gain from a sanctions announcement can be ephemeral. The intended economic and reputational pressure becomes a headline rather than a lasting choke point.
Three structural facts help explain the problem.
/
Internet infrastructure is fragmented and transnational. Registrars, registries, ISPs, CDNs, and payment processors are dispersed across jurisdictions with divergent laws and incentives, allowing operators to stitch together new operational paths when one is blocked.
/
Ownership can be opaque. Nominee directors, layered corporate shells, and lax disclosure regimes let beneficial owners hide behind intermediaries, slowing attribution and enforcement until the next migration is already complete.
/
Takedown processes are often slow and siloed. Even when abuse desks and law enforcement cooperate, technical migration — shifting IP space, re-registering domains, or changing upstream transit — can be done within hours, reducing the practical lifespan of any disruption.
What do different stakeholders make of this state of play?
Technologists and threat analysts warn that legal designations must be married to technical, operational countermeasures. Faster signal-sharing between abuse desks, automated blocking of indicators of compromise, and pressure on registrars and upstream carriers to act quickly can raise the operational cost of rebuilding. Some experts advocate technical attestations for domain ownership and better cryptographic proofs to reduce anonymity in registrant records. Those measures, they argue, would make it harder for sanctioned operators to reconstitute service without detection.
Policymakers see constraints and levers. Sanctions are an important diplomatic tool because they are scalable and nonkinetic — useful in coalition-building and in signaling consequences. But officials also acknowledge gaps: designations that target a single legal entity are less effective when the supporting ecosystem remains intact. The policy lesson is familiar in other domains of illicit finance and crime: designations must be coupled with broader efforts that include requirements for transparency, coordinated action across registrars and financial intermediaries, and faster cross-border legal cooperation.
Everyday users and defenders face second-order harms. Organizations and citizens who rely on the integrity of domain name systems and hosting providers may see malicious sites persist longer, undermining trust in the digital environment. Rapidly morphing infrastructure complicates incident response: defenders must chase indicators that have already migrated, increasing response costs and time to remediation.
And what about the adversaries? For operators behind bulletproof hosting, the Stark case is a playbook validation: if the legal pain of sanctions can be managed by corporate reshuffling and fast technical migration, then sanctions alone are a manageable nuisance. That calculus may incentivize further refinement of evasive techniques rather than deterrence — a worrying conclusion for those who hoped legal pressure would raise the long-term cost of such services.
So what would make sanctions stick? Three pragmatic directions emerge from the analysis and public reporting.
/
Broaden the target set: rather than sanctioning a narrow corporate entity, pursue the full ecosystem — beneficial owners, affiliated companies, registrars and resellers that facilitate evasion — when evidence links them to the misconduct.
/
Increase operational tempo: pair designations with near-real-time cooperation among registrars, payment processors, ISPs, and hosting providers so takedowns and financial friction happen while the infrastructure is still vulnerable.
/
Improve transparency and technical defenses: require stronger disclosure rules for registrars and corporate registries, incentivize cryptographic attestations of ownership, and expand automated detection and blocking of IoCs across the commercial ecosystem.
None of these options is easy. They require political will, cross-border legal instruments, and changes to business incentives for private-sector intermediaries. They also raise legitimate concerns about overreach and due process: aggressive measures against registrars or payment providers risk collateral damage to legitimate users and services. Policymakers must weigh those trade-offs carefully and transparently.
The Stark case is a reminder that cyber policy is both technical and institutional. Announcing a sanction matters; naming harmful actors and signaling consequences has diplomatic and symbolic power. But as the post-designation behavior demonstrates, the hard work lies in follow-through — the coordinated, sustained effort that turns a legal penalty into operational degradation. Without that, the risk is that the internet’s structural flexibility becomes a refuge rather than a constraint for those who would weaponize it.
If the goal is to make the digital commons safer and less hospitable to state-linked aggression and criminal enterprise, then sanctions must be one tool among many — not the only one. Will the EU and its partners turn this lesson into faster, broader, and more surgical practice before the next sanctioned name reappears under another letterhead? https://krebsonsecurity.com/2025/09/bulletproof-host-stark-industries-evades-eu-sanctions/
