Loading story…
Dutch financial crime investigators arrested two IT entrepreneurs and seized more than 800 servers, laptops, phones, and business records in raids targeting hosting infrastructure allegedly used for cyberattacks, interference operations, and disinformation campaigns linked to Russia. The suspects, identified in reporting as Andrey Nesterenko and Youssef Zinad, are accused of violating EU sanctions by providing economic resources to sanctioned entities. Authorities said the operation began on 18 May and included searches in Enschede and Almere and data centers in Dronten and Schiphol-Rijk.
The investigation focuses on Stark Industries, a hosting provider sanctioned by the EU in 2025, and on Dutch-linked firms including WorkTitans B.V., THE.Hosting, and MIRhosting, which investigators believe helped keep sanctioned infrastructure online after restrictions took effect. Multiple reports tied the network to infrastructure used by the pro-Russian group NoName057(16) and the Doppelgänger disinformation operation, while Dutch and European reporting also linked related services to attacks on Danish government bodies during municipal elections. MIRhosting denied knowingly supporting illegal activity and said it cooperated with authorities, but customers of related brands reported widespread outages and loss of access after the seizures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
After the operation, customers of THE.Hosting, UFO.Hosting, and GEO.Hosting reported major outages, loss of control panel and billing access, data loss, weak support responses, and refund problems. These disruptions were linked in reporting to the seizure of infrastructure in the Dutch investigation.
Following the Dutch action, MIRhosting said it had suspended services to WorkTitans while asserting that its other operations were unaffected. The company also denied knowingly supporting illegal operations and said it was cooperating with authorities.
Reporting cited in the references says WorkTitans and MIRhosting were heavily used in pro-Russian attacks on Danish government bodies during the week of Denmark's municipal elections in November 2025. MIRhosting denied that its services were knowingly used to influence the elections.
Multiple references state that EU sanctions were imposed on PQHosting and Ivan and Iurie/Yuri Neculiti in May 2025. Reporting says this action later prompted Stark-related infrastructure to be shifted to a Dutch company.
On 2026-05-18, Dutch investigators arrested Andrey Nesterenko and Youssef Zinad, searched multiple business locations and data centers, and seized more than 800 servers along with laptops, phones, and records. Authorities said the suspects indirectly provided economic resources to EU-sanctioned entities and enabled infrastructure used in cyberattacks, interference operations, and disinformation campaigns.
FIOD's operation began on 2026-05-18, according to reporting citing the agency. The action targeted hosting infrastructure allegedly tied to cyberattacks, disinformation operations, and sanctions violations.
The Record reports that the European Union sanctioned Stark Industries on 2025-05-20. Authorities allege that after the sanctions, part of Stark's infrastructure was moved to a new Dutch firm to evade restrictions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcemalware.news
Open sourcesecurityaffairs.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourcekrebsonsecurity.com
Open sourcefiod.nl
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch police have seized approximately 250 physical servers and thousands of virtual servers belonging to an unnamed bulletproof hosting provider operating out of The Hague and Zoetermeer. This hosting service, active since 2022, was used exclusively by cybercriminals and has been linked to over 80 cybercrime investigations both in the Netherlands and internationally. The provider advertised complete anonymity, did not enforce Know Your Customer (KYC) policies, and refused to cooperate with law enforcement, making it a popular choice for threat actors. The infrastructure supported a range of illicit activities, including ransomware operations, malware distribution, phishing campaigns, botnet control, and the hosting of child abuse content. The takedown blocks further criminal use of the service and enables forensic analysis of the seized servers to identify operators and clients. No arrests have been announced yet, but the operation is expected to provide valuable intelligence for ongoing and future investigations into cybercrime facilitated by bulletproof hosting services.
Jun 29, 2026
Pro-Russian hacktivist group **NoName057(16)** intensified distributed denial-of-service attacks against government and private-sector targets across Europe, including Dutch public services disrupted around the NATO Summit in The Hague. Reported incidents in the Netherlands included attacks on municipal and provincial websites and an earlier strike on **Logius** that temporarily affected **DigiD** and access to services used by the **Belastingdienst**, **UWV**, **DUO**, and hospital portals. The group has also targeted organizations in Ukraine, Israel, and other European countries, often timing attacks to politically significant events and focusing on sectors such as government, transportation, banking, defense, media, and energy. The group’s operations relied on **Telegram** for propaganda, recruitment, and coordination, while the **DDoSia** platform distributed encrypted attack parameters to volunteers who could be rewarded with cryptocurrency. Reporting also linked the ecosystem to malware including **Bobik** and **RedLine Stealer**, which were used to support involuntary participation in attacks. An international law-enforcement action, **Operation Eastwood**, led by Europol and Eurojust, disrupted more than 100 servers tied to the network and resulted in arrests, warrants, and notifications to participants, dealing a significant blow to the group’s infrastructure even as its public claims were described as overstating real-world impact.
Jul 7, 2026
Dutch police and the Netherlands’ National Cyber Security Center disrupted a botnet spanning roughly **17 million infected devices** by taking offline about **200 servers** hosted in the Netherlands. Authorities said the network included compromised computers, mobile phones, IoT devices, and routers, and that the investigation began after a security researcher alerted NCSC-NL. While officials did not publicly name the botnet, reporting tied the infrastructure to **Asocks**, a commercial residential and mobile proxy service, and to prior research on covert proxy enrollment through the **PROXYLIB** library and **LumiApps SDK** ecosystem. The takedown highlights growing abuse of **residential proxy networks**, which can mask malicious traffic behind trusted consumer IP addresses and support operations including **DDoS attacks, spam, credential stuffing, brute-force attacks, click fraud, SMS pumping, phishing, online fraud, and malware delivery**. The action follows broader Dutch enforcement against malicious infrastructure, including the seizure of more than **800 servers** tied to **THE.Hosting**, a Russian-linked bulletproof hosting network associated with scanning, botnet recruitment, cryptomining, credential theft, and exploitation of exposed services; researchers said that operation had limited effect because much of the network’s routed infrastructure remained active across multiple countries.
Jun 29, 2026