Adversary Intelligence — 2026-06-02

Dutch Server Seizure of Stark Industries Successor Disrupts Three Iranian APT Groups

BLUFSeizing a single sanctioned-evasion host collapsed three concurrent Iranian campaigns, but the speed of the Stark-to-WorkTitans migration signals reconstitution through new fronts within weeks.

Dutch FIOD seized approximately 800 servers at data centers in Dronten and Schiphol-Rijk on May 22 and arrested two individuals tied to WorkTitans B.V. and its internet-connectivity provider MIRhosting, which Dutch authorities allege together functioned as Stark Industries' operational successor after the EU sanctioned Stark in May 2025 1. De Volkskrant, citing a confidential technical overview, identified specific WorkTitans IP addresses used by NoName057(16) in DDoS attacks against Danish government sites, with transfer records tracing those addresses directly from Stark to WorkTitans 1. Check Point Research assessed that MuddyWater deployed BugSleep malware through WorkTitans C2 nodes, Agrius (UNC2428) ran fake Israeli defense-contractor job portals delivering the MURKYTOUR backdoor via the same infrastructure, and Nimbus Manticore rotated through WorkTitans servers to evade tracking in campaigns targeting aerospace and aviation personnel 2.

Analysis
The seizure exposed a hosting-tier dependency targetable without group-level attribution. MuddyWater and Agrius deployed distinct techniques against separate target sets yet depended on the same sanctioned-evasion intermediary, indicating Iranian operations routinely outsource infrastructure rather than self-provision. The Stark-to-WorkTitans migration, completed within days of EU sanctions, treats corporate rebranding as a continuity instrument. Low analytic confidence attaches to the C2 attribution specifics: Check Point is the sole analytical source with no independent signals or HUMINT corroboration. Nimbus Manticore's documented multi-provider rotation indicates it maintains backup hosting and reconstitutes faster than the other two groups. The concurrent WorkTitans use may instead reflect independent selection of a low-cost bulletproof host rather than centrally coordinated Iranian infrastructure allocation.

2 sources

Dutch authorities dismantle hosting network allegedly used for cyberattacks and disinformation - Security Affairs
The Server Seizure That Affects Also Irans Cyber Operations - Check Point