After the start of a full -scale invasion of Russia, misinformation campaigns and hacker attacks coordinated by Russian pro -government groups were significantly intensified. As it is established, two brothers from Moldova - Ivan and Yuri Neculiti, who founded PQ.hosting in 2019 - participated in the implementation of such operations.
About it reports Nenka.info https://nenka.info/moldovski-braty-neculiti-pq-hosting-yak-vony-dopomagayut-rosijskym-hakeram/
PQ.hosting specializes in providing hosting services on the Internet and has server equipment in more than 30 countries. Despite the sanctions, hosting continues to function in Russia, working through the Stark Industries Solutions Limited network, registered by Ivan Neculiti in the UK.
In one of the promotional interview, Ivan Neculiti explained that Stark Industries Solutions acts as a cover for pq.hosting, avoiding sanctions and regulatory control. According to him, the company does not participate in payment transactions, but only "facilitates business". This allows you to hide a true service provider.
Masking its corporate network, PQ.hosting became a shelter for pro -Russian cyberactivists who carry out illegal activities against Ukrainian and Western citizens. According to investigations, their servers were used for:
- Phishening attacks on Russians who wanted to join the Legion Freedom of Russia or the Russian Volunteer Corps. As a result, the collected data were transmitted by the FSB.
- DDOS-attack on government agencies and municipalities of European countries.
- Management of the Remcosrat virus that has infected Ukrainian users through the SBU fake messages.
- Use of the pro -Russian group Noname057 (16), which attacks European objects.
- Supporting the BlueCharlie Spy BlueCharlie activity in Ukraine and NATO countries.
The activities of PQ.hosting and Stark Industries Solutions are regularly mentioned in the reports of international cybersecurity companies. For example, the HYAS report dated May 6, 2024.
Earlier, AS44477 was mentioned in reports on attacks using programs, exfixing data and compromising of Western companies.
In addition to the promotion of cybercriminals, pq.hosting places:
- Drugs (RR-Seedshop081.xyz);
- Online casino (casinochanslots.com, tonybetsourcing.com, beet-amo.bg);
- Fraudulent cryptocurrency services (ymmaga.org, deenair.org);
Such resources are especially active on PQ.hosting servers in the Netherlands.
The Constella Intelligence Data Tracking Service has found that Ivan Neculiti has used e -mail [Email Protected] , which has been featured in cybercrime forums since 2008.
The user under the nicknames "DFYZ" and "Donchicho" sold "Abus -resistant" servers who did not respond to complaints about illegal activity. He also appeared in fraudulent schemes and spam campaigns, including illegal selling prescription drugs through RX-Promotion.
Despite numerous accusations, PQ.hosting continues to work. EU sanctions do not apply to Stark Industries Solutions and PQ.hosting, which allows them to do business with Russian clients without legal consequences.
Investigators emphasize the need to expand the sanction list, including sub -laws against Neculiti structures to stop their cooperation with Russian hacker groups.
