Loading story…
Dutch media reported on several separate national-security and information-integrity issues, not a single incident. One report said Dutch police are seeing more so-called "disposable spies": ordinary citizens allegedly recruited online by states such as Russia and Iran to conduct espionage or sabotage, including a case involving Dutch teenagers suspected of mapping Wi-Fi networks near sensitive institutions in The Hague. Another report examined renewed attention around Havana syndrome, noting persistent claims of anomalous health incidents among diplomats and intelligence personnel but emphasizing that experts still see little conclusive evidence for a practical directed-energy weapon causing lasting neurological damage.
A separate NRC investigation found that former media executive Peter Vandermeersch published fabricated or untraceable quotations in multiple blog posts written in his fellowship role at Mediahuis, with dozens of quotes reportedly unsupported by the cited sources and several attributed speakers denying they made the statements. Another Dutch political report covered a parliamentary motion calling for a ban on the Muslim Brotherhood and affiliated organizations in the Netherlands, citing concerns about infiltration and foreign influence, while also noting that the group is not highlighted in the latest Dutch terrorism threat assessment. Because the references cover distinct topics spanning journalism, espionage, disputed weapons claims, and domestic politics, they should not be treated as one coherent cybersecurity event.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Following recent attacks on a synagogue in Rotterdam and a Jewish school in Amsterdam, Dutch authorities said Iran is being examined as a possible instigator. Justice Minister Van Weel said the young suspects in the Rotterdam attack were likely recruited.
Dutch authorities said they have established a dedicated team, including a cyber component, to investigate and counter espionage and sabotage by so-called disposable spies. The move reflects concern over recruitment by states such as Russia and Iran.
The Netherlands changed its law so covert actions carried out for foreign governments can be punished even when the information involved is not formally classified. Authorities said penalties can reach eight years in prison, or twelve years if the activity results in deaths.
Dutch authorities identified a case in which three 17-year-old boys were allegedly recruited by a Russian hacking group to map Wi-Fi networks near Europol, Eurojust, and the Canadian embassy in The Hague. The case was cited as an example of foreign services using unwitting or low-level local recruits.
In 2024, an NIH investigation reported no clear evidence of lasting brain injury among people reporting Havana syndrome symptoms. The study added to the lack of confirmed proof that an external weapon caused the reported illnesses.
After Russia's invasion of Ukraine, many Russian diplomats and intelligence operatives were expelled from European countries. Dutch police say this shift helped drive greater use of ordinary citizens as 'disposable spies' for espionage and sabotage.
In 2022, a major CIA investigation concluded that most reported Havana syndrome cases could not be linked to a foreign adversary or a directed-energy weapon. The finding undercut earlier claims that a covert attack campaign had been established.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch authorities arrested two 17-year-old boys on suspicion of attempting to conduct cyber espionage on behalf of Russian interests. The arrests took place after the Dutch General Intelligence and Security Service (AIVD) provided a tip to the police, leading to the apprehension of the suspects. The teenagers were reportedly recruited via the messaging app Telegram by pro-Russian hackers, who tasked them with carrying out reconnaissance activities. Their assignment involved using a WiFi sniffer device to collect information by walking past sensitive buildings in The Hague, including the headquarters of Europol, Eurojust, and several embassies such as the Canadian embassy. WiFi sniffers are devices capable of intercepting wireless network traffic and are often used in the early stages of cyberattacks to gather intelligence on potential targets. Europol confirmed awareness of the incident and stated that there was no evidence of compromise to their systems, emphasizing the robustness of their security infrastructure. The agency is working closely with Dutch authorities to monitor and address any potential risks arising from the incident. One of the suspects was arrested at home while reportedly finishing his homework, with his parents unaware of his alleged involvement in espionage activities. The severity of the charges means that at least one of the boys will remain in custody for two weeks as the investigation continues, while the other has been released on home bail. The Dutch prosecution service cited laws regarding state-sponsored interference as the basis for the arrests but withheld further details due to the suspects' ages and the ongoing nature of the investigation. This case is seen as an escalation from previous incidents in Europe, where young people were recruited by Russian agents for acts of sabotage and vandalism rather than direct espionage. The Dutch government has recently expanded its laws against cyber-espionage, reflecting growing concerns about state-sponsored cyber activities. The incident highlights the increasing trend of minors being targeted for recruitment by foreign intelligence services through online platforms. The use of simple but effective reconnaissance tools like WiFi sniffers demonstrates the evolving tactics employed in modern espionage operations. The case has raised concerns among parents and the broader community about the risks posed by online recruitment for cyber activities. Authorities continue to investigate the full extent of the teenagers' actions and any potential connections to broader Russian cyber operations. The incident underscores the importance of vigilance and robust security measures around critical infrastructure and international organizations in the Netherlands.
Jun 29, 2026
Dutch authorities have arrested two teenagers in the Netherlands who were reportedly recruited by pro-Russian hackers via Telegram to assist with cyber espionage operations. The teenagers were allegedly tasked with collecting Wi-Fi data along a route in The Hague that passed by sensitive locations, including Europol, Eurojust, and the Canadian embassy. This marks a new tactic by Russian intelligence agencies, which have previously relied on remote cyber operations or dispatched their own operatives for on-site activities. The recruitment of local proxies for cyber espionage is a recent development, although Russian intelligence has a history of using locals for other activities such as sabotage, surveillance, and even graffiti. The use of domestic proxies is seen as a cost-effective and lower-risk method for certain tasks, though it may not match the technical proficiency of trained Russian operatives. In 2018, Dutch authorities arrested four members of Russia’s GRU Unit 26165 for attempting to hack the Wi-Fi of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague, highlighting a precedent for on-site operations when remote compromise fails. The OPCW was at the time investigating the chemical weapons attack on Sergei Skripal and his daughter, making it a high-value target for Russian intelligence. Russian operatives have also conducted similar on-site operations targeting US and international anti-doping and sporting organizations in locations such as Rio de Janeiro and Lausanne. The typical goal of these operations is to gain initial access to target networks by subverting Wi-Fi infrastructure, after which long-term data collection is managed by teams in Russia. The recent case involving Dutch teenagers suggests an evolution in Russian tactics, leveraging local assets for reconnaissance and initial access. Authorities believe that mapping Wi-Fi networks in areas of interest could provide Russian intelligence with a strategic advantage for more sophisticated attacks. The recruitment of teenagers for such tasks raises concerns about the exploitation of vulnerable individuals and the potential for increased operational security risks. Law enforcement agencies across Europe are now on alert for similar recruitment efforts by foreign intelligence services. The incident underscores the persistent threat posed by Russian cyber espionage and the adaptability of its tactics. Security professionals are advised to monitor for unusual activity near sensitive facilities and to strengthen Wi-Fi security protocols. The use of local proxies may complicate attribution and detection efforts, making international cooperation among law enforcement and intelligence agencies even more critical. This case also highlights the importance of public awareness and education to prevent the recruitment of unwitting individuals into foreign espionage activities. The evolving nature of cyber espionage operations demands continuous vigilance and adaptation by both government and private sector security teams.
Jun 29, 2026
Dutch police said a recent breach exposing personal data of officers was likely carried out by a **state actor**, reviving concerns first raised in an earlier case in which authorities suspected a foreign government was behind the theft of Dutch police personnel data. Reporting indicates the compromised information involved police employee details, and officials treated the intrusion as a serious national-security matter because of the potential risks to officers and ongoing investigations. Separately, Dutch police announced they had dismantled a major cybercriminal forum in an international operation, underscoring a broader push against both espionage-linked intrusions and financially motivated cybercrime. The takedown was presented as a coordinated global law-enforcement action against a prominent criminal platform, while the data-breach investigation highlighted the parallel threat posed by hostile states targeting sensitive law-enforcement information.
Jul 12, 2026