Cyber & Technology — 2026-05-22

Netherlands Seizes 800 Servers of Hosting Firm That Enabled Pro-Russian Cyberattacks and Disinformation

BLUFDutch prosecutors' decision to charge sanctions evasion rather than cybercrime offers EU peers a faster legal route to dismantle Russian-aligned hosting proxies before they enable the next election-cycle attack.

On May 18, FIOD arrested Youssef Z., 57, of Amsterdam, and Andrey N., 39, of Den Haag, on suspicion of violating EU sanctions by indirectly supplying economic resources to sanctioned Russian and Belarusian entities 12. FIOD describes Youssef Z.'s firm WorkTitans B.V., also branded as THE.Hosting, as a front established to absorb Stark Industries' infrastructure following the EU's May 20, 2025 sanctions designation of Stark Industries, with Andrey N.'s MIRhosting supplying the internet connectivity layer that kept WorkTitans servers online 13. Raids on data centers in Dronten and Schiphol-Rijk and premises in Enschede and Almere yielded over 800 servers, laptops, phones, and administrative records 14. De Volkskrant, citing confidential information, reported that WorkTitans and MIRhosting topped the list of networks used in pro-Russian attacks, including operations by hacktivist group NoName057(16), against Danish government organizations during November 2025 municipal elections 2. Both men were released after questioning and remain suspects in the ongoing investigation 2.

Analysis
The WorkTitans seizure documents a post-sanctioning infrastructure-laundering playbook: sanctioned entities transfer servers to shell companies before enforcement catches up, sustaining cyber capacity under legal cover. Stark Industries completed that transfer within weeks of its May 2025 EU listing, and WorkTitans infrastructure appeared atop Danish authorities' list of networks used in November 2025 election-day attacks; bureaucratic lag in tracing successor entities carries electoral-interference costs. Physical seizure of 800 servers forces reconstitution through new proxies. MIRhosting's claim as a neutral provider could complicate the connectivity count against Andrey N. Charging sanctions evasion rather than awaiting cybercrime attribution creates a lower evidentiary threshold other EU states could adopt. Sourcing rests on the FIOD press release; secondary outlets amplify but add no independent reporting.

4 sources

FIOD houdt twee verdachten aan wegens overtreding sanctiewetgeving - FIOD (Dutch Fiscal Information and Investigation Service)
Two arrested for facilitating pro-Russia cyberattacks, violating EU sanctions - NL Times
Netherlands seizes 800 servers of hosting firm enabling cyberattacks - BleepingComputer
Twee mannen opgepakt op verdenking van faciliteren Russische cyberaanvallen - NOS