🌐 TI-2026-021K · The Architecture of Impunity · Part 11 of 14

The Iron Hammer: Stark Industries, Transnistria, and State-Sponsored Infrastructure

On 10 February 2022, a company called Stark Industries Solutions Ltd was incorporated in the United Kingdom. Fourteen days later, on 24 February 2022, Russia launched its full-scale invasion of Ukraine. Those two dates do not prove causation by themselves. But in threat intelligence, timing is not trivia. Timing is context. And once the later infrastructure record is laid beside those dates, the corporate birth of Stark looks less like ordinary hosting expansion and more like the appearance of a commercial wrapper at precisely the moment Russia's wartime information and disruption apparatus needed one.

The public record compiled by KrebsOnSecurity in May 2024 is already severe. AS44477, branded as Stark Industries Solutions, was tied to a UK mail-drop office, to Ivan Vladimirovich Neculiti as CEO and secretary, to the Moldovan parent PQ Hosting Plus S.R.L., and operationally to Tiraspol, Transnistria—a pro-Russian breakaway region with weak accountability and long-standing Russian military presence. The same report stated that Stark operated 1,000+ physical servers in 38 countries, served 100,000+ clients, routed traffic for at least 74 VPN services and 40 proxy services, and formed the primary infrastructure home for the pro-Russian DDoS crew NoName057(16). Ukrainian CERT tied Stark servers to the January 2023 Sandworm attack on Ukrinform. The network also hosted RRN, a Russian propaganda outlet later sanctioned by the European Union.

That is already enough to end the fiction that Stark is merely a neutral VPS seller who got unlucky with a few bad customers. But the problem is deeper. In the investigative material assembled around this series, Stark appears not as an isolated bad actor but as part of a multi-shell routing mesh involving Virtualine Technologies, OMEGATECH LTD, and GhostyNetworks LLC. The same London virtual office address—71-75 Shelton Street, Covent Garden in the broader shell-company record, and a 71-75 Covent Garden office description in the investigation notes—reappears as a wrapper location across Stark-adjacent entities. The result is not simply bad hosting. It is commercial form used as routing camouflage.

This article proceeds carefully because real names and real institutions are involved. Where a claim comes from public reporting, it is attributed. Where a claim comes from the author's routing and telemetry investigation, it is identified as such. Where intelligence judgment goes beyond bare documentary fact, that judgment is stated plainly and proportionately. But proportionality should not become euphemism. When one corporate network repeatedly appears around Russian military disruption, pro-Russian hacktivism, propaganda dissemination, industrial-scale proxy monetization, and shell-company routing opacity, the correct analytic response is not polite agnosticism. It is to describe the architecture as it functions.

1. Fourteen days

Corporate registries are full of coincidences. Threat investigations are full of people hoping analysts will treat every timeline as coincidence. Here the sequence is stark enough to deserve emphasis. 10 February 2022: Stark Industries Solutions is incorporated. 24 February 2022: Russia invades Ukraine. Between those dates lies no proof of planning document, no intercepted board minute, no signature saying “this shell is for wartime utility.” But that is rarely how real infrastructure preparation announces itself. It appears as logistics first, doctrine later.

Why does the incorporation date matter? Because wartime cyber operations do not run on patriotism alone. They require bandwidth, routable addresses, abuse tolerance, replaceable wrappers, and service providers capable of absorbing complaints without collapsing the customer business. A company established exactly before a kinetic escalation, and later documented as useful to pro-Russian DDoS actors, state propaganda, and at least one GRU-linked destructive campaign, cannot be analyzed as though chronology were accidental background noise. It sits too close to the pivot.

The instructive point is not that every company formed near a geopolitical event is suspicious. The instructive point is that this company, formed at that time, later accumulated a profile almost custom-made for deniable Russian campaign support: DDoS hosting, proxy carriage, propaganda placement, aggressive scanning, BGP irregularities, and adjacency to further intelligence-linked infrastructure. Timing does not convict. Timing narrows the space of honest explanation.

In infrastructure analysis, chronology does not replace evidence. It arranges evidence into the shape of intent.

2. Ivan Neculiti: the person behind the wrapper

KrebsOnSecurity's reporting identified Ivan Vladimirovich Neculiti as Stark's CEO and secretary and tied him to older Russian-language cybercrime forum identities: dfyz and DonChicho. According to that reporting, those aliases had been selling bulletproof servers since at least 2008. The historical pattern matters because it deprives Stark of the defense that this is simply an ordinary hosting entrepreneur who later attracted uncontrollable abuse. The person at the center is reported to have a much older commercial relationship to abuse-tolerant infrastructure markets.

The same historical record is ugly in ways that matter analytically. Neculiti was reportedly connected to Rx-Promotion spam activity in 2009, tied to knockoff-pharmaceutical operations, and later accused of scamming forum users badly enough that he was banned from Antichat in 2014. Those details are not moral decoration. They show a durable career pattern: monetizing hostile or deceptive network behavior, moving through criminal-adjacent service markets, and re-emerging under more formal commercial wrappers when conditions favor scale.

The significance of the aliases is partly temporal and partly cultural. Russian-language cybercrime forums are not random social media. They are marketplaces, reputation systems, and apprenticeship environments. A seller who remains active there over years is not merely “familiar” with abuse economies. He is socialized inside them. When that same person's later corporate infrastructure becomes useful to a Russian invasion ecosystem, the older record stops being irrelevant history and becomes continuity evidence.

Analytically, this matters for one simple reason: it makes “we did not know” less credible. If a principal has a long history in bulletproof-hosting circles, then a later company under that principal's control operating as a major abuse and proxy backbone should be read as the continuation of a business model, not as accidental customer contamination.

3. Why Transnistria matters

Transnistria is often described too vaguely in mainstream coverage, as though it were just an odd border dispute. For infrastructure purposes, it is something more useful than that: a jurisdictional fracture zone. It is a pro-Russian breakaway region of Moldova, centered on Tiraspol, with Russian military presence, partial international non-recognition, and a governance environment where accountability mechanisms that might constrain other European infrastructure businesses are substantially weaker or more politically distorted.

That matters because cyber infrastructure seeks three things at once: connectivity, opacity, and enforcement drag. A place like Transnistria does not need to be technically advanced to be useful. It only needs to offer a zone in which beneficial ownership, complaint handling, law-enforcement cooperation, and political consequences are all harder to force. If the operational center of a hosting empire is in such a region while its customer-facing wrapper wears a UK corporate skin, the result is an ideal blend of Western administrative respectability on the outside and post-Soviet enforcement friction on the inside.

One should be careful not to commit the reverse error and treat every Transnistrian business as inherently criminal. That is not the claim. The claim is narrower and harder: when a network with this later operational history is rooted in Transnistria, the geography is not incidental. It is one of the features that makes the network durable.

4. PQ Hosting, Stark, and the war-preparation chronology

The corporate sequence matters because it shows Stark did not emerge from nowhere. The parent identified in reporting, PQ Hosting Plus S.R.L., was formed in 2019 in Moldova. That supplies a pre-war base layer. Stark's UK incorporation in February 2022 then supplies a new wrapper at the edge of war. The pattern is familiar in abuse infrastructure: an older regional business acquires or creates a more marketable jurisdictional face precisely when scale, investor confidence, or legal camouflage become valuable.

A UK company carries symbolic weight that a Transnistrian or Moldovan edge entity often does not. It looks legible to payment processors, customers, registries, and counterparties. A virtual office in London functions as a legitimacy prosthetic. If the operational center remains elsewhere, the wrapper does not need to do much. It only needs to make the first layer of scrutiny feel boring.

This is not merely a story about one owner being opportunistic. It is also about the architecture that rewarded the move. Corporate service providers allowed the wrapper. Upstreams and peers allowed the routes. Proxy resellers consumed the capacity. Customers used the space. And only after the infrastructure had already become deeply embedded in multiple abuse markets did broad public attention arrive.

5. NoName057(16): hacktivism as state-aligned service consumption

The pro-Russian DDoS group NoName057(16) has attacked government, transport, media, and critical-service targets across Europe, especially states aligned with Ukraine. The group publicly performs as hacktivism. But “hacktivism” in this context frequently functions as a layer of deniability rather than as a meaningful boundary from state interest. The key question is not whether every packet was ordered by a Russian officer. The key question is whether the infrastructure facilitating the campaigns is commercially available in ways that make it operationally useful to Russian strategic objectives. With Stark, the answer is yes.

KrebsOnSecurity reported Stark as the primary infrastructure provider for NoName057(16). That matters for two reasons. First, DDoS groups need networks that tolerate abuse reports, rapidly replace endpoints, and supply global egress diversity. Second, once a provider becomes the repeat venue for such operations, the relationship stops looking like random customer overlap. It starts looking like functional specialization.

One of the recurring analytic mistakes in cyber conflict is taking corporate neutrality at face value simply because the provider sells to anyone with money. Neutral pricing does not equal neutral effect. If a provider repeatedly becomes the favored environment for attacks on EU and NATO targets, then neutrality has already failed as a descriptive category. The provider may still advertise generic service. Operationally, it has become part of a campaign ecosystem.

In other words, the argument is not that Stark equals the Russian state in a simple ownership sense. The argument is that state objectives repeatedly pass through Stark, and that this repeated passage is substantial enough to define Stark's place in the wartime ecosystem.

6. Sandworm and the Ukrinform attack

The most serious operational fact in the public record is the link to Sandworm, generally tracked as GRU Unit 74455. According to Ukrainian CERT, servers provided by Stark were used in the January 2023 attack on Ukrinform, Ukraine's national news agency. Sandworm is not a casual label. It is the unit associated with some of the most destructive cyber operations of the last decade, including attacks on Ukrainian infrastructure and the NotPetya campaign.

When a provider's infrastructure appears in a Sandworm operation, the analytic burden changes. One can no longer discuss the company only in the language of abuse reports, spam, proxies, or gray-market customers. The network has crossed into the evidentiary orbit of a military intelligence service. Even if the precise commercial chain to the end operator remains undisclosed, the operational consequence remains the same: Stark became a usable substrate for a GRU-linked attack.

Analysts should resist one lazy defense often offered in such cases: that any big hoster can be abused by a state actor. That is true in the abstract and irrelevant in this case. The issue is not that one Stark IP was once rented by a sophisticated adversary. The issue is that Stark's broader profile already included bulletproof-hosting lineage, Transnistrian operational geography, NoName057(16), proxy monetization, propaganda hosting, and extreme scanning behavior. The Sandworm link does not stand alone; it lands in an already compromised pattern.

7. MIRhosting and Blue Charlie / TAG-53

The Stark story widens further when co-located or adjacent infrastructure is considered. Public reporting noted that MIRhosting, operating from the same general ecosystem, hosted Blue Charlie / TAG-53 credential-harvesting infrastructure linked to the Russian FSB. This matters less as a claim about legal ownership overlap than as a claim about environment. Multiple state-linked Russian operations, serving different mission sets, appear comfortable in the same commercial neighborhood.

That neighborhood effect is important. Intelligence services do not need to own every server they use. They need corridors where procurement is easy, deniability is strong, and complaint pressure is unlikely to produce immediate disruption. If a cluster of providers repeatedly hosts GRU-linked disruptive operations, FSB-linked credential collection, pro-Russian DDoS actors, and propaganda outlets, the cluster has become strategically useful even if each individual corporate paper trail remains formally private.

Put differently: this is not just a hoster serving criminals. It is an ecosystem serving multiple functions of Russian power—disruption, collection, narrative manipulation, and commercial monetization—without requiring the clean, direct institutional fingerprints naive observers keep demanding.

8. RRN and propaganda as infrastructure service

Stark also reportedly hosted Recent Reliable News (RRN), a Russian propaganda project later sanctioned by the European Union. That fact matters because it demonstrates role convergence. The same provider environment that supports DDoS operations and proxy resale also supports information operations. This is what state-aligned infrastructure looks like in the modern internet: not a military-only network, but a commercially dressed substrate on which multiple instruments of pressure coexist.

Propaganda hosting is often underestimated by technically minded analysts because it does not look like exploitation. But from a strategic perspective, the ability to keep a disinformation outlet online, routable, and resilient under scrutiny is part of information warfare. Infrastructure neutrality claims become especially thin when the same provider is simultaneously useful to kinetic-war narratives and disruptive cyber campaigns against the same geopolitical opponents.

There is also a market lesson here. Propaganda benefits from the same traits proxy sellers and DDoS operators want: lenient enforcement, rapid turnover capacity, and a low moral threshold for customer selection. The commercial model that keeps one category of client online often keeps all of them online.

9. The scale: this is not boutique abuse

Stark's scale is essential to understanding its importance. According to the published reporting, the company operated more than 1,000 physical servers across 38 countries and served more than 100,000 clients. Spur.us found Stark tied to 74 VPN services and 40 proxy services. Proxyline alone reportedly routed more than 1.6 million proxies through Stark. These are not fringe numbers. They describe an industrial platform.

Scale does not automatically imply guilt. But scale changes the meaning of tolerance. A small provider can plausibly claim overload. A large network selling into dozens of proxy and VPN brands while repeatedly surfacing in state-aligned abuse patterns is operating at a level where customer-type ignorance becomes harder to credit. The business knows what market it occupies, because the market is visible in the traffic mix.

10. The Iran channel

One of the strangest and most revealing details in the public reporting is that 35.1% of all outbound Stark traffic went to Iran, largely serving as a proxy path for Facebook access. This is analytically important for two reasons. First, it confirms Stark's deep role in mass proxy carriage rather than incidental proxy resale. Second, it demonstrates the dual-use nature of such infrastructure. The same network that enables Russian-aligned influence operations and military utility can also be part of everyday circumvention by ordinary Iranian users trying to reach blocked platforms.

Dual use does not absolve. It complicates. A provider can route dissident-adjacent traffic and still be central to abusive or state-aligned operations. In fact, dual use may strengthen resilience because it broadens the customer base and muddies the moral optics. Any serious analysis of Stark has to hold both facts at once: some traffic may serve ordinary access needs, and the overall infrastructure record still supports a finding of systematic abuse tolerance with strategic value to Russian interests.

11. BGP hijacking and the Comcast space

Perhaps the most technically brazen allegation in the public record is that Stark announced roughly 4,600 Comcast IP addresses over BGP that Comcast said had never belonged to Stark at all. If accurate, this is not sloppy paperwork. It is route-space opportunism at a scale large enough to trigger serious questions about how peers, upstreams, and monitoring mechanisms allowed the announcements to exist long enough to matter.

BGP incidents can be messy, and caution is warranted before assigning motive to every route anomaly. But here again, context removes innocence. An operator already documented for aggressive scanning, bulletproof-hosting lineage, proxy empire activity, and Russian-aligned utility does not receive the benefit of a purely administrative explanation when route ownership looks wrong. The analytical default shifts toward intentional exploitation unless disproven.

Packets do not care about corporate biography. Investigators must. The meaning of a routing anomaly changes when it belongs to a network already standing inside multiple forms of abuse.

The BGP detail also matters because it shows Stark's profile extends beyond customer misuse into the governance layer of internet reachability itself. This is no longer just content, hosting, or VPS abuse. It is contested control over announcement legitimacy.

12. NETSCOUT, scanning aggression, and local telemetry

NETSCOUT researcher Richard Hummel reportedly ranked Stark “near or at the top” of the worst hosting providers and described Stark-origin scanning as so aggressive it “crashed services” at major ISPs. That is a remarkable statement because it moves beyond reputational hand-waving into operational harm: the network was not just dirty, it was noisy enough to create downstream service impact.

The author's own investigation adds a smaller but consistent local confirmation. Stark-linked scanner infrastructure already appears in the honeypot telemetry associated with this series. That local data does not independently prove every public allegation. What it does prove is recurrence: the same ecosystem is not hypothetical, not historical, and not remote. It touches real sensors in current time, behaving like the kind of infrastructure the broader reporting describes.

These addresses are not presented as standalone smoking guns. They matter because they are embedded in the larger picture: Stark + Omegatech + GhostyNetworks + Virtualine as a routing and shell-company mesh whose parts provide each other geographic, administrative, and reputational cover.

13. The 71-75 Covent Garden connection

Shell-company work is often dismissed as clerical trivia. It is not. Addresses are infrastructure too. In this investigation, Stark-adjacent entities and Virtualine converge on the same London virtual-office corridor, identified in the research notes as 71-75 Covent Garden and reflected in broader UK company-service patterns around that same address family. The exact value of the address is not its geography. It is its function. Virtual offices manufacture administrative normality at very low cost.

When multiple network entities in a suspicious routing mesh share the same mail-drop or serviced-office ecology, the point is not that a single address proves conspiracy. The point is that shell-company clustering reduces the plausibility of independent, unrelated business formation. It suggests a market of wrappers being assembled from the same low-friction provider ecosystem.

That is why the address matters in this series. The internet's architecture of impunity is not made only of routers and ASNs. It is made of company secretaries, mail drops, nominee-ready wrappers, and the bureaucratic scenery that allows dangerous infrastructure to look boring enough for one more quarter.

14. Neculiti's defense and the limits of procedural innocence

Neculiti's reported response to criticism was simple: “No one contacted us to report that there was an attack from our addresses.” Taken literally, it is a procedural defense. If nobody filed a complaint, how could the provider know? But that defense collapses under the scale and pattern already documented. A network running thousands of servers, feeding dozens of proxy and VPN brands, hosting notorious DDoS actors, drawing public criticism from researchers, and surfacing in state-linked operations cannot seriously rely on a theory of total innocence through inbox emptiness.

Even if one granted the narrow point that specific incidents were not formally reported to a particular abuse channel, the business model remains visible in aggregate. A provider does not need a notarized complaint to notice that it has become a preferred home for abusive or politically aligned campaigns. When the customer base, traffic composition, and external research all point the same way, “nobody told us” becomes less a defense than a confession of deliberate non-curiosity.

15. Conclusion: commercial cover for state warfare

The accumulated picture is clear. A UK shell formed fourteen days before Russia's invasion of Ukraine. The named executive behind it carried a documented history in bulletproof-hosting and cybercrime-forum markets. The operational center sat in Transnistria, where governance friction and Russian influence materially matter. The network scaled to thousands of servers and one hundred thousand customers. It became primary infrastructure for NoName057(16), hosted EU-sanctioned propaganda, and provided servers used in a Sandworm attack on Ukrinform. Adjacent facilities housed FSB-linked credential-harvesting infrastructure. The same ecosystem fed proxy and VPN markets at industrial scale, routed significant traffic into Iran, and even drew scrutiny for suspicious BGP announcements.

That is not a neutral hoster accidentally serving some bad clients. It is not even best described as bulletproof hosting in the old narrow sense. It is state-usable commercial infrastructure: a market-facing service environment whose technical, geographic, and corporate characteristics make it exceptionally valuable to Russian power projection while preserving plausible deniability.

The phrase “architecture of impunity” is useful precisely because it avoids one childish mistake: believing that modern coercive power always arrives in uniform. Often it arrives as a registered company with a London mail drop, a cheap corporate wrapper, a customer portal, and a transit bill. Often it looks private until one asks what purposes it keeps serving, for whom, and under what pattern of tolerated recurrence.

Stark is the iron hammer because it shows the shape of the mechanism. Shell in London. Operations in Transnistria. Customers everywhere. Utility to proxies, DDoS, propaganda, and military intelligence. Enough public evidence to end surprise. Enough continuing ambiguity to preserve deniability. That combination is not an accident of the modern internet. It is one of the ways states now outsource parts of war.

16. Evidentiary boundaries and confidence

Because this article names a real person and connects a real company to state-aligned operations, the evidentiary boundary matters. Three layers support the conclusion. The first is documentary public reporting: company formation date, parent company, Transnistrian operating geography, Neculiti's historical aliases, server counts, proxy and VPN scale, Iranian traffic distribution, NoName057(16) use, RRN hosting, and the published statements from researchers and investigators. The second is attributed operational reporting from institutions such as Ukrainian CERT and from security research tying Stark infrastructure to specific campaigns. The third is the local investigative layer used in this series: Stark-adjacent routing meshes, repeated shell-company clustering, and telemetry overlap with scanner infrastructure already observed against the author's own sensors.

No single layer alone would justify the strongest conclusion here. Together they do. If the evidence were merely that Neculiti once sold bulletproof servers, that would be suggestive but incomplete. If it were only that a UK shell was formed before the invasion, that would be interesting but insufficient. If it were only that one propaganda outlet or one DDoS actor used the network, the case would still permit softer interpretations. What makes the conclusion harden is convergence: the same infrastructure ecology serves hacktivist pressure, propaganda dissemination, proxy monetization, aggressive scanning, suspicious routing behavior, and military-intelligence-linked operations.

Confidence should therefore be stated plainly. Confidence: high that Stark Industries Solutions / AS44477 functioned as abuse-tolerant strategic infrastructure useful to Russian state interests. Confidence: high that the commercial wrapper was not incidental to that role but part of what made the role durable. Confidence: moderate to high on the broader proposition that Stark belongs inside a multi-entity routing and shell-company mesh with Virtualine, OMEGATECH, GhostyNetworks, and adjacent operators, because that element rests more heavily on composite investigative analysis than on one public corporate filing. None of those confidence judgments require pretending to know every contractual relationship behind the scenes. They only require recognizing that the observed pattern is too coherent to explain away as customer bad luck.