Adversary Intelligence — 2026-05-24

Dutch Police Seize Two Pro-Kremlin Bulletproof Hosting Providers Under Sanctions Laws

BLUFDutch prosecutors likely file formal charges against at least one suspect within 12 months, testing whether EU sanctions law can durably disrupt Russian-aligned hosting front companies enabling NoName057(16) operations.

FIOD on May 22 arrested Youssef Z., 57, director of WorkTitans B.V., and Andrey N., 39, founder of MIRhosting, seizing roughly 800 servers from data centers in Dronten and Schiphol-Rijk for alleged EU sanctions violations 12. FIOD alleges WorkTitans, which offered hosting under the brand THE.Hosting, operated as a front for Stark Industries after the EU sanctioned that firm on May 20, 2025, while MIRhosting supplied connectivity routed through major Amsterdam and Frankfurt internet exchanges 12. De Volkskrant, citing confidential information, reported both firms topped the list of networks used in pro-Russian DDoS attacks on Danish government organizations during November 2025 municipal elections, with Danish authorities separately linking WorkTitans to NoName057(16) 12. Both suspects were questioned and released pending ongoing forensic analysis of seized servers, devices, and administrative records 12.

Analysis
Formal criminal charges against at least one of the two suspects are likely within 12 months of the May 22 seizure. Moderate confidence reflects 800 seized servers, devices, and administrative records cross-referenced against Danish attribution directly linking WorkTitans to NoName057(16) election-targeting campaigns, though all four reporting outlets converge on the single FIOD press release without independent investigative access. Dutch prosecutors may instead pursue administrative penalties if they determine the infrastructure transfer reflects commercial opportunism rather than the deliberate sanctions evasion Dutch criminal liability requires. Charges that succeed allow EU sanctions coordinators to extend the FIOD enforcement model to other Stark-linked entities. Failed prosecution cements post-sanction corporate restructuring as a durable legal shield.

5 sources

Two arrested for facilitating pro-Russia cyberattacks, violating EU sanctions - NL Times
Netherlands seizes 800 servers of hosting firm enabling cyberattacks - BleepingComputer
Netherlands Cracks Down on Russian-Linked Cybercrime with Major Server Seizure - News4Hackers
How a consultant and a concert pianist from the Netherlands were arrested on suspicion of aiding NoName057(16) - DataBreaches.Net
FIOD houdt twee verdachten aan wegens overtreding sanctiewetgeving - FIOD (Dutch Fiscal Intelligence and Investigation Service)