Loading story…
Two 17-year-olds were arrested in the Netherlands in late September on suspicion of conducting reconnaissance for pro-Russian hackers by capturing Wi-Fi signals near sensitive locations in The Hague. The teenagers, equipped with Wi-Fi sniffing devices, followed a route that took them past high-profile sites including Europol, Eurojust, and the Canadian embassy. Dutch media reported that the arrests were prompted by a tip from the General Intelligence and Security Service (AIVD), which led to one teen being taken into custody and the other placed under home monitoring as the investigation continues. The teenagers were allegedly recruited through Telegram, where they were approached by individuals posing as peers. Security analysts have raised concerns that nation-state actors are increasingly using messaging platforms such as Telegram, Signal, and WhatsApp to recruit teenagers for low-skill reconnaissance tasks. The recruitment process often begins with seemingly innocuous conversations before escalating to requests for device access and credential theft. Sarah Ralston, vice president at Proxyware, noted that bad actors specifically target teens and young adults for phishing and malware attacks, sometimes turning their personal devices into espionage tools without their knowledge. Dutch Prime Minister Dick Schoof commented that the incident aligns with Russia's hybrid warfare tactics and expressed deep concern over the exploitation of minors for espionage activities. The case highlights a growing trend of nation-state cyber operations leveraging social engineering to involve unwitting young people in intelligence gathering. Security experts warn that children from military families may be particularly vulnerable to such recruitment efforts. The use of low-skill operatives for physical reconnaissance around sensitive government and international organization sites represents an evolution in cyberespionage tactics. Law enforcement and intelligence agencies are now on heightened alert for similar recruitment and reconnaissance activities. The incident underscores the need for increased awareness and education among young people about the risks of online interactions with unknown individuals. It also raises questions about the adequacy of current security measures around critical infrastructure and diplomatic sites. The ongoing investigation may reveal further details about the extent of the operation and whether additional individuals were involved. Authorities are also examining the technical methods used for Wi-Fi signal capture and the potential for data exfiltration. The case serves as a warning to organizations and families about the evolving tactics of nation-state cyber actors and the importance of proactive defense and monitoring.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
By October 2025, Dutch Prime Minister Dick Schoof and cybersecurity experts publicly warned that nation-state actors were increasingly recruiting teenagers through platforms such as Telegram, Signal, WhatsApp, Discord, and gaming environments for low-skill espionage tasks. The case heightened concern about minors, including children of military families, being groomed for hybrid cyber operations and credential theft.
In late September 2025, Dutch authorities arrested two 17-year-olds in The Hague for allegedly conducting Wi-Fi reconnaissance near sensitive sites including Europol, Eurojust, and the Canadian embassy. Prosecutors reportedly treated the case as government-sponsored interference and said the teens had been equipped with Wi-Fi sniffers and recruited via Telegram by pro-Russian hackers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch authorities arrested two 17-year-old boys on suspicion of attempting to conduct cyber espionage on behalf of Russian interests. The arrests took place after the Dutch General Intelligence and Security Service (AIVD) provided a tip to the police, leading to the apprehension of the suspects. The teenagers were reportedly recruited via the messaging app Telegram by pro-Russian hackers, who tasked them with carrying out reconnaissance activities. Their assignment involved using a WiFi sniffer device to collect information by walking past sensitive buildings in The Hague, including the headquarters of Europol, Eurojust, and several embassies such as the Canadian embassy. WiFi sniffers are devices capable of intercepting wireless network traffic and are often used in the early stages of cyberattacks to gather intelligence on potential targets. Europol confirmed awareness of the incident and stated that there was no evidence of compromise to their systems, emphasizing the robustness of their security infrastructure. The agency is working closely with Dutch authorities to monitor and address any potential risks arising from the incident. One of the suspects was arrested at home while reportedly finishing his homework, with his parents unaware of his alleged involvement in espionage activities. The severity of the charges means that at least one of the boys will remain in custody for two weeks as the investigation continues, while the other has been released on home bail. The Dutch prosecution service cited laws regarding state-sponsored interference as the basis for the arrests but withheld further details due to the suspects' ages and the ongoing nature of the investigation. This case is seen as an escalation from previous incidents in Europe, where young people were recruited by Russian agents for acts of sabotage and vandalism rather than direct espionage. The Dutch government has recently expanded its laws against cyber-espionage, reflecting growing concerns about state-sponsored cyber activities. The incident highlights the increasing trend of minors being targeted for recruitment by foreign intelligence services through online platforms. The use of simple but effective reconnaissance tools like WiFi sniffers demonstrates the evolving tactics employed in modern espionage operations. The case has raised concerns among parents and the broader community about the risks posed by online recruitment for cyber activities. Authorities continue to investigate the full extent of the teenagers' actions and any potential connections to broader Russian cyber operations. The incident underscores the importance of vigilance and robust security measures around critical infrastructure and international organizations in the Netherlands.
Jun 29, 2026
Dutch authorities have arrested two teenagers in the Netherlands who were reportedly recruited by pro-Russian hackers via Telegram to assist with cyber espionage operations. The teenagers were allegedly tasked with collecting Wi-Fi data along a route in The Hague that passed by sensitive locations, including Europol, Eurojust, and the Canadian embassy. This marks a new tactic by Russian intelligence agencies, which have previously relied on remote cyber operations or dispatched their own operatives for on-site activities. The recruitment of local proxies for cyber espionage is a recent development, although Russian intelligence has a history of using locals for other activities such as sabotage, surveillance, and even graffiti. The use of domestic proxies is seen as a cost-effective and lower-risk method for certain tasks, though it may not match the technical proficiency of trained Russian operatives. In 2018, Dutch authorities arrested four members of Russia’s GRU Unit 26165 for attempting to hack the Wi-Fi of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague, highlighting a precedent for on-site operations when remote compromise fails. The OPCW was at the time investigating the chemical weapons attack on Sergei Skripal and his daughter, making it a high-value target for Russian intelligence. Russian operatives have also conducted similar on-site operations targeting US and international anti-doping and sporting organizations in locations such as Rio de Janeiro and Lausanne. The typical goal of these operations is to gain initial access to target networks by subverting Wi-Fi infrastructure, after which long-term data collection is managed by teams in Russia. The recent case involving Dutch teenagers suggests an evolution in Russian tactics, leveraging local assets for reconnaissance and initial access. Authorities believe that mapping Wi-Fi networks in areas of interest could provide Russian intelligence with a strategic advantage for more sophisticated attacks. The recruitment of teenagers for such tasks raises concerns about the exploitation of vulnerable individuals and the potential for increased operational security risks. Law enforcement agencies across Europe are now on alert for similar recruitment efforts by foreign intelligence services. The incident underscores the persistent threat posed by Russian cyber espionage and the adaptability of its tactics. Security professionals are advised to monitor for unusual activity near sensitive facilities and to strengthen Wi-Fi security protocols. The use of local proxies may complicate attribution and detection efforts, making international cooperation among law enforcement and intelligence agencies even more critical. This case also highlights the importance of public awareness and education to prevent the recruitment of unwitting individuals into foreign espionage activities. The evolving nature of cyber espionage operations demands continuous vigilance and adaptation by both government and private sector security teams.
Jun 29, 2026
The Dutch intelligence and military security services (**AIVD** and **MIVD**) warned of a **large-scale Russian cyber campaign** targeting individual **Signal** and **WhatsApp** accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose **security verification codes** and **PINs**. The activity does **not** involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a *Signal Support* chatbot to solicit verification information, enabling account takeover and access to messages and group chats. The agencies also reported abuse of the apps’ **“linked devices”** functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake *Red Alert* Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.
Aug 27, 2026