Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks

Dutch authorities have arrested two men linked to Internet hosting companies accused of facilitating cyberattacks and disinformation campaigns orchestrated by Russian intelligence within the European Union. The suspects, a 57-year-old from Amsterdam and a 39-year-old Russian native residing in the Netherlands, were detained on charges of violating EU sanctions. Investigators also seized more than 800 servers, laptops, and mobile devices during raids on multiple business locations and data centers. The investigation centers on Stark Industries Solutions, an Internet service provider sanctioned by the EU last year for its role as a staging ground for cyber operations tied to Russia. Stark emerged shortly before Russia’s invasion of Ukraine and became notorious for enabling large-scale distributed denial-of-service (DDoS) attacks and providing proxy services used by Russia-backed hacking groups. Earlier sanctions targeted Moldovan brothers Ivan and Yuri Neculiti and their company PQHosting, which supplied one of Stark’s main Internet conduits. However, the Dutch-based MIRhosting, operated by one of the arrested men, maintained Stark’s remaining Internet connectivity and had not been previously sanctioned. Further scrutiny revealed that Stark’s network assets were transferred to a company called WorkTitans BV, controlled by the Amsterdam-based suspect, who had prior ties to MIRhosting. WorkTitans relied exclusively on MIRhosting for Internet access, effectively linking the two arrested individuals to the infrastructure supporting Russia’s hybrid warfare efforts. The Dutch financial crime agency FIOD conducted coordinated raids on May 18 at locations in Enschede, Almere, Dronten, and Schiphol-Rijk, resulting in the arrests and equipment seizures. This operation highlights ongoing efforts by European authorities to disrupt cyber infrastructure enabling hostile foreign interference and uphold sanctions designed to limit Russia’s cyber capabilities. The arrests and server confiscations mark a significant step in countering cyber threats emanating from sanctioned entities and underscore the challenges in dismantling complex hosting networks that facilitate state-backed cyberattacks.