Stark Industries Solutions was billed as an internet provider operating out of central London. In reality, it was being used by the Kremlin to conduct a cyber warfare campaign and entrap Putin’s enemies
Vladimir Putin’s intelligence services have used a UK company based in one of London’s premier tourist spots to pursue a cyber warfare campaign that includes ensnaring Russians willing to fight for Ukraine, it can be revealed.
The disclosure will be highly embarrassing for the UK not only because of criticism that exposes “lax” corporate regulation, but also because it has taken sanctions imposed by the European Union – rather than Britain – to bring the Kremlin’s clandestine operation to a halt.
Just days before Russia’s invasion of Ukraine in February 2022, a technology company called Stark Industries Solutions Ltd was incorporated at Companies House with a registered address in Covent Garden.
The company offered web-hosting services allowing its clients to place websites online from anywhere in the world for less than £6 a month. Locating Stark Industries in London allowed third parties linked to the Kremlin to use the firm’s services to help disguise their origin and provide them with a veneer of credibility, according to experts.
This May, the European Union imposed sanctions on Stark Industries and its owners, stating that its clients for the last three years have included “various Russian state-sponsored and state-affiliated actors” whose “destabilising activities” including cyber attacks and “co-ordinated information manipulation”, have been conducted via the British company.
Stark Industries was set up and run by two tech tycoon brothers, Ivan and Iurie Neculiti, who originate from Transnistria, a breakaway corner of Moldova which is run by pro-Russian separatists and relies heavily on support from Moscow.
Their company, which appears to have been named as a tongue-in-cheek reference to the fictional “Stark Industries” conglomerate featured in Marvel’s Iron Man comics, attracted significant business from shadowy corners of the Russian government intent on causing digital havoc.
Although it has no UK employees and assets of less than £25,000, the company has been able to use a mail-drop address to appear as a British business, promising to get its clients’ websites online in as little as 30 minutes.
“Inadequate scrutiny”
Cyber security experts told The i Paper that Stark Industries had in effect been used as an offshore hub by Russia for its “hybrid warfare” strategy during the Ukraine war, enabling the Kremlin’s intelligence services and their sub-contractors to conceal the origin of their hostile acts. These activities range from large-scale attacks designed to disable computer systems, to running fake news sites disseminating propaganda,
Last week, when The i Paper visited the address used by Stark Industries, it was found to be an office services company sat just yards from the busy shopping streets and attractions of Covent Garden. The services company offers a registered office or “mailbox” service allowing users to meet the legal requirement for UK-registered firms to have an address on British soil.
Backed by its “prestigious” location, Stark Industries offered a range of web hosting capabilities which according to the EU sanctions included so-called “proxy” services which allow clients to conceal their location and web use from external scrutiny. Prices for access to the company’s servers, some of which are based in the Netherlands, started at €5.99 (£5.20) a month.
Phishing for Putin opponents
Separate sources have told The i Paper that the activities allegedly enabled by Stark’s servers include a “phishing” campaign to expose potential opponents of the Putin regime, by setting up hoax copies of websites run by Ukrainian paramilitary groups to recruit Russians wanting to join the war on Kyiv’s side.
Artem Tamoyan, a Russian national who left the country in 2019 and now runs Malfors, a cyber investigation platform, found that at least 10 dummy websites, with addresses closely resembling those of Ukrainian units staffed by Russians, were until recently hosted on Stark Industries’ servers based in the Netherlands.
The targeted units include the Freedom of Russia Legion, a volunteer unit of Russian citizens fighting within Ukraine’s armed services, and the Russian Volunteer Corps, a far-right paramilitary outfit based in Ukraine. Both entities have been classified by Moscow as “terrorist organisations”, meaning that even exchanging messages with their representatives in Ukraine or Russia is punishable by up to 20 years’ imprisonment.
The hoax sites are part of a wider arrest campaign by the Kremlin’s intelligence services, led by the KGB’s successor, the FSB, which has entrapped dozens of Russians, some as young 15.
Mr Tamoyan said: “In total we have traced around 70 websites that were phishing via various hosting platforms including Stark Industries. They all have the same purpose – to lure people into giving up their personal information so they can be arrested.
“The Russian security services are not looking for actual spies – they don’t really care if they lure a random teacher or a teenage boy. If they can put them in jail for engaging with a fake website then that’s perfectly fine for them.”
Company rules make UK ‘haven for impunity and abuse’
The presence in central London of a company now deemed by the EU to be helping Russia’s campaign of subversion and digital sabotage has fuelled complaints that the UK’s Companies House system for registering companies is open to flagrant abuse.
Amnesty International UK told The i Paper that “lax regulations” and “inadequate scrutiny” of individuals registering UK companies is allowing “serious abuses” to take place, including violations of sanctions laws.
Peter Frankental, Amnesty’s economic affairs director, said: “Until these loopholes are closed, the UK risks continuing to be a haven for those using corporate structures to profit from impunity and abuse.”
Companies House declined to say whether it has investigated Stark Industries or taken any action against it, adding that it did not comment on individual companies. While Stark Industries features on the sanctions registers of the EU and Ukraine, it is not listed on any UK sanction lists.
Companies House said it worked with government and law enforcement agencies to “identify and disrupt economic crime” and it would take steps to strike off companies whose incorporation was based on false or deceptive information. A source said: “Where criminality is suspected, information and intelligence are shared with relevant partners.”
Yet, rather than facing enforcement action from the UK authorities, Stark Industries is now voluntarily winding itself up. Iurie Neculiti, who is currently listed as the company’s owner, filed an application last month to strike it off the UK register, meaning it will cease to exist at the end of this month.
Disinformation and disruption
The EU sanctions, which impose an asset freeze and a travel ban on the Neculiti brothers, make it clear that by offering services used by the Russian state, Stark Industries and its owners have in effect been “supporting” the Kremlin’s efforts to sow disinformation and disruption across Europe.
The EU ban states: “Stark enables… destabilising activities, including co-ordinated information manipulation and interference and cyber attacks… by providing services intended to hide these activities from European law enforcement and security agencies.”
It further describes the Neculitis as “supporting actions by the government of the Russian Federation which threaten democracy… stability or security” within the bloc and beyond, by dint of their leadership of the company.
Neither Ivan nor Iurie Neculiti replied to repeated requests from The i Paper to comment on Stark Industries, or the allegations that it had been used to enable Russia’s hybrid warfare in connection with the Ukraine war.
Ivan Neculiti, 33, is based in the Moldovan capital Chisnau and also owns PQ Hosting – a separate web hosting company operating in nearly 40 countries. He has previously denied any wrongdoing. Last year he told Correctiv, a German investigative website, that the use of Stark Industries for cyber attacks or other illegal activities was “absolutely not allowed”.
Evidence points, however, to the Russian state or its proxies using the company’s services for increasingly elaborate and draconian purposes.
“Success doesn’t come to you promptly”
Tamoyan said there was a simple reason for Russia’s secret police and intelligence services to find the services of a UK-registered company useful.
“They don’t want what they are doing to be easily traced back to Russia,” he said. “So they need infrastructure in Europe to conduct their operations all around the world. It’s much easier to do something like this with a European or UK legal entity than with a Russian legal entity.”
The UK authorities are beginning to tighten rules when it comes to registering companies either from within the UK or abroad. From November onwards, new or existing company directors and owners will have to verify their identities with Companies House.
However, campaigners argue more needs to be done to reduce abuse of the system.
Amnesty’s Frankental said: “We remain deeply concerned by the lax regulations and inadequate scrutiny over those who register companies in the UK. Time and again, we’ve seen UK-registered companies used to facilitate serious abuses including violations… of sanctions laws with little accountability.”
It is unclear whether Stark Industries or the Neculitis have been investigated by the UK authorities following their designation under EU sanctions in May this year. A Foreign Commonwealth and Development Office source said it was unable to comment on “potential future designations”.
Comments are closed.