Allied Intelligence — 2026-05-27

Dutch Authorities Arrest Two and Seize 800 Servers Used for Russian Cyber Operations

BLUFDisrupting the MIRhosting-WorkTitans relay degrades Russian DDoS and Doppelgänger operations in Western Europe, though courtroom accountability for Nesterenko and Zinad is unlikely before year-end 2027.

Dutch financial crime investigators (FIOD) on May 18 arrested Andrey Nesterenko of hosting provider MIRhosting and Youssef Zinad of WorkTitans BV, charging both with making economic resources available to EU-sanctioned entities 12. Searches of three business premises and two data centers yielded more than 800 servers, laptops, phones, and administration records 12. Prosecutors allege the pair continued servicing Stark Industries after the EU sanctioned the hosting firm in May 2025 for enabling Russian state-sponsored cyberattacks and disinformation, and that Stark's network assets were subsequently transferred to WorkTitans to evade those restrictions 12. De Volkskrant reported that MIRhosting and WorkTitans were the most-used networks in pro-Russian attacks on Danish government bodies during the week of Denmark's November 2025 municipal elections 2.

Analysis
The seizure dismantles the Western European relay layer sustaining Russian DDoS and Doppelgänger disinformation infrastructure, but conviction of Nesterenko and Zinad is unlikely by December 31, 2027. Dutch financial crime prosecutions of comparable complexity routinely exceed 24 months, and both defendants are contesting intent. The Stark asset transfer predating the sanctions announcement by roughly two weeks gives the defense limited but genuine traction; prosecutors may be unable to establish willful evasion rather than a preexisting commercial handover. Moderate confidence rests on a documented seizure record and corroborating corporate filings, tempered by absent precedent in Dutch sanctions-evasion prosecution and by sourcing confined entirely to a single journalistic cluster. Acquittal shifts the enforcement burden toward network interdiction or secondary sanctions on upstream connectivity providers.

2 sources

Dutch authorities arrest men suspected of providing infrastructure for Russian cyber operations - The Record
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks - Krebs on Security