Adversary Intelligence — 2026-06-10

Check Point Links Dutch Seizure of 800 Servers to Iranian MuddyWater Agrius and Nimbus Manticore Cyber Espionage Operations

BLUFIranian MOIS-affiliated groups are likely to reconstitute on new infrastructure by late August, as the Stark-to-WorkTitans rebasing pattern shows sanctions drive rebranding rather than capability loss.

On May 22, Dutch financial crime investigators seized roughly 800 servers from data centers in Dronten and Schiphol-Rijk, targeting hosting provider WorkTitans B.V. 1. Check Point Research linked the seized infrastructure to three Iranian threat groups, MuddyWater, Agrius, and Nimbus Manticore, which used it for command-and-control operations, malware delivery, and network reconnaissance 2. According to InfotechLead's account of the Check Point findings, WorkTitans allegedly operated as the successor to Stark Industries, which the EU sanctioned in May 2025 for links to Russian information operations, with the renamed company maintaining access to the same network resources 1. MuddyWater ran BugSleep C2 infrastructure from the platform, Agrius hosted recruitment-themed portals delivering the MURKYTOUR backdoor, and Nimbus Manticore rotated through its servers to target aerospace and defense organizations 1.

Analysis
Check Point's attribution revises the prior Russian framing, placing MuddyWater, Agrius, and Nimbus Manticore on the same 800-server footprint and identifying WorkTitans as the successor to EU-sanctioned Stark Industries. That rebasing pattern, same network resources under a new corporate identity after sanctions, establishes that MOIS-affiliated operators reconstitute rather than stand down. All three groups are likely to be publicly attributed to reconstituted infrastructure or resumed operations by August 20, 2026. Low confidence applies: attribution rests on Check Point alone, with no independent SIGINT or government corroboration. WorkTitans may have been a bulletproof hoster serving Iranian operators opportunistically rather than a deliberate MOIS successor, constraining what the seizure actually disrupted. If attribution resolves, network defenders face immediate blocking and disclosure obligations.

3 sources

Dutch Raid on WorkTitans Exposes Infrastructure Behind Iranian Cyber Espionage Operations - InfotechLead
8th June – Threat Intelligence Report - Check Point Research
The Server Seizure That Affects Also Iran's Cyber Operations - Check Point Research