By Sagoh 
In a sweeping operation that marks a significant escalation in the European Union’s battle against foreign-backed digital aggression, Dutch authorities have arrested two high-profile figures behind a sophisticated web of internet hosting companies. The arrests target individuals accused of facilitating IT infrastructure used by Russian intelligence agencies to orchestrate cyberattacks, spread disinformation, and conduct hybrid warfare operations across the European bloc.
The operation, led by the Dutch financial crime agency FIOD (Fiscale Inlichtingen- en Opsporingsdienst), resulted in the detention of a 57-year-old Amsterdam resident and a 39-year-old resident of The Hague. Officials confirmed that the raid involved the execution of warrants across three businesses in Enschede and Almere, alongside the physical seizure of over 800 servers housed in data centers in Dronten and Schiphol-Rijk.
The Architect of the Infrastructure
The investigation centers on a tangled corporate structure designed to provide anonymity for malicious actors. At the heart of the controversy is Stark Industries Solutions, a hosting provider that emerged with suspicious timing—just two weeks before the full-scale Russian invasion of Ukraine in 2022.
The two men now in custody are linked to MIRhosting and WorkTitans BV, two entities that effectively served as the backbone for Stark Industries’ operations. According to investigators and prior reporting by KrebsOnSecurity, the hosting companies functioned as "bulletproof" conduits, shielding Russian-backed hackers from detection as they launched massive distributed denial-of-service (DDoS) attacks against European government institutions, critical infrastructure, and private entities.
The arrests represent the culmination of a multi-year effort to untangle a digital shell game. While the EU had previously placed sanctions on other providers—notably the Moldova-based PQHosting and its founders, Ivan and Yuri Neculiti—the Stark network proved remarkably resilient, shifting its remaining connectivity through the Dutch-based MIRhosting to evade oversight.
Chronology of a Digital Evasion
The trajectory of this investigation reveals a pattern of rapid corporate restructuring designed to outpace regulatory action:
- February 2022: Stark Industries Solutions is established, quickly becoming a preferred staging ground for Russian state-affiliated cyber-operations.
- May 2024: Investigative deep-dives begin to expose Stark’s role as a primary supplier of proxy and anonymity services for Russian hacking collectives.
- May 2025: The European Union formally sanctions PQHosting and the Neculiti brothers for their role in Russia’s hybrid warfare.
- Pre-Sanction Leak (May 2025): Media reports suggest the impending sanctions. In a move described by investigators as a tactical retreat, Stark network assets are rapidly transferred from PQHosting to a new entity, the[.]hosting, which operates under the control of the Dutch firm WorkTitans BV.
- September 2025: Independent reporting identifies that despite the sanctions against PQHosting, the Stark network remains fully functional, operating via MIRhosting, a firm controlled by Andrey Nesterenko and his associate, Youssef Zinad.
- November 2025: Data analyzed by de Volkskrant links the WorkTitans and MIRhosting networks to a significant spike in cyber-aggression targeting Danish government bodies during the country’s municipal elections.
- May 18, 2026: FIOD conducts coordinated raids, resulting in the arrests of Nesterenko and Zinad and the permanent shutdown of the server infrastructure involved.
Supporting Data: The Anatomy of the Network
The evidence gathered by Dutch authorities suggests a high degree of technical sophistication. The seized hardware—specifically the 800-plus servers taken from the Dutch data centers—is currently undergoing forensic analysis to determine the full extent of the data compromised and the identity of the state-sponsored groups that utilized the infrastructure.
A critical piece of evidence is the connection between these hosting providers and historical Russian cyber-warfare. Andrey Nesterenko, the 39-year-old founder of MIRhosting, has a documented history in the industry. His parent company, Innovation IT Solutions Corp., was identified as the host for stopgeorgia[.]ru in 2008. This website was used to coordinate cyberattacks against Georgia simultaneously with the Russian military’s physical invasion, a moment widely considered the birth of modern hybrid warfare, where cyber-kinetic integration became a core doctrine.
The recent targeting of Danish elections adds a layer of democratic subversion to the charges. Analysis showed that during the week of the Danish municipal elections (November 13–19, 2025), these specific networks were the most utilized conduits for attacks against Danish institutional websites. The nature of these attacks—often designed to create confusion or suppress information flow—suggests a clear alignment with Kremlin geopolitical objectives.
Official Responses and the "Legitimate Business" Defense
Following the raids, MIRhosting issued a public statement vehemently denying that its infrastructure was knowingly used to undermine European democratic processes.
"Based on our preliminary findings, there are no indications that the services over which we exercise control were actually used to influence the Danish elections," the company stated via LinkedIn. They further argued that they had received no formal abuse reports or requests from authorities prior to the media exposure, claiming that had a major DDoS attack occurred, it would have been instantly visible on their network traffic monitors.
Andrey Nesterenko, speaking through his legal representatives, maintained that the transition to the[.]hosting was a standard business consolidation, not an attempt to circumvent sanctions. "Closing or damaging a legitimate Dutch infrastructure company will not stop cybercrime, but it will harm many people who have done nothing wrong," Nesterenko remarked in an email correspondence.
Youssef Zinad, the second suspect, has maintained a much more reclusive profile. Since the initial exposure of his role in the company, he has systematically erased his digital footprint, blocking social media accounts and becoming unresponsive to journalists. Neighbors at his registered address in Almere reported him absent for months, with investigators eventually locating him at a residence in Amsterdam.
Implications for EU Cyber Sovereignty
The arrest of Nesterenko and Zinad signals a shift in how the European Union addresses "bulletproof" hosting. Historically, these companies operated in a legal gray area, exploiting jurisdictional boundaries to provide "deniable" infrastructure to intelligence agencies. By arresting the owners under sanctions legislation, the Dutch government has moved beyond merely blocking IP addresses or taking down websites; they are now targeting the corporate owners who facilitate the existence of these "rogue" networks.
This strategy serves as a warning to other service providers operating within the EU. The legal argument—that providing infrastructure to sanctioned entities constitutes a breach of economic sanctions—provides a powerful tool for law enforcement to dismantle the digital apparatus supporting Russian hybrid operations.
However, the case also highlights the fragility of the modern web. The abrupt seizure of 800 servers has resulted in the total loss of data for countless customers, many of whom may be legitimate businesses caught in the crossfire of the provider’s alleged illicit activities. As the digital front of the conflict with Russia continues to intensify, the collateral damage to the private sector remains a significant concern.
For now, the silence from the seized data centers in Dronten and Schiphol-Rijk serves as a testament to the effectiveness of the FIOD’s intervention. As forensic teams continue to sift through the terabytes of data, the full extent of the partnership between these Dutch-based entities and the architects of Russian cyber-aggression will likely become a centerpiece of future criminal proceedings, setting a precedent for how nations defend their digital sovereignty against the invisible tools of modern warfare.
Asro 
Jia Lissa 
rifanmuazin 