Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks

The Dutch financial crime agency FIOD has moved against the infrastructure supporting Russian-linked cyber operations. On May 18, authorities arrested two individuals—a 57-year-old from Amsterdam and a 39-year-old from The Hague—charging them with violating sanctions law.

The investigation targets the co-owners of two related Internet hosting companies. These entities operated IT infrastructure used by Russia to conduct cyberattacks, influence operations, and disinformation campaigns within the European Union. The arrests follow a pattern of attempting to bypass EU sanctions by transferring network assets to new entities.

The focus remains on Stark Industries, a hosting provider that emerged two weeks before the invasion of Ukraine. This provider became a primary source of massive distributed denial-of-service (DDoS) attacks against European targets and a supplier of proxy and anonymity services linked to Russia-backed hacking groups. While the EU sanctioned PQHosting and the Neculiti brothers in May 2025, the network's connection to the Internet persisted through MIRhosting, a Netherlands-based provider operated by Andrey Nesterenko.

This case demonstrates the difficulty of enforcing sanctions in a decentralized digital economy. When sanctions against PQHosting were leaked in the media, Stark network assets were transferred to a new entity called the[.]hosting, under the control of WorkTitans BV. This new entity was controlled by Nesterenko and the 57-year-old Amsterdam resident.

The seizure of 800 servers represents a direct strike against the technical staging grounds used for hybrid warfare. For those managing digital infrastructure, the lesson is clear: the movement of assets to new corporate shells does not erase the underlying legal and regulatory liabilities of the original infrastructure.

How can regulators effectively track the rapid migration of network assets across newly formed corporate entities?