Dutch Authorities Arrest Two IT Entrepreneurs in Investigation of Infrastructure for Russian Cyber Operations
Summary
Dutch authorities arrested two IT entrepreneurs over alleged EU sanctions violations, searching business sites and data centers and seizing more than 800 servers. Investigators allege the infrastructure supported Russian-linked cyberattacks and disinformation; MIRhos
Key points
- Dutch authorities arrested two IT entrepreneurs suspected of violating EU sanctions related to hosting infrastructure.
- FIOD searched three business premises and two data centers, seizing records, devices and more than 800 servers.
- Investigators allege infrastructure was moved to a newly established Dutch company to circumvent sanctions.
- Reporting by Correctiv and de Volkskrant linked the investigation to Stark Industries, MIRhosting and WorkTitans; Dutch authorities did not publicly name the companies.
- The infrastructure was reportedly used by sites linked to the Doppelgänger disinformation campaign and in DDoS attacks attributed to NoName057(16).
- MIRhosting denied knowingly facilitating the operations, said it was cooperating with authorities, and stated that it had suspended services to WorkTitans.
Article Details
- Event Type
- Arrests in a sanctions-related investigation into alleged provision of hosting and connectivity infrastructure for cyberattacks and disinformation campaigns.
- Impact
- FIOD searched three business premises and two data centers and seized records, devices, and more than 800 servers. Authorities allege that the infrastructure supported pro-Russian cyber operations and disinformation; reports say it was used by sites associated with the Doppelgänger campaign and in DDoS attacks attributed to NoName057(16).
MITRE ATT&CK
People
Andrey N.Identified in reporting by Correctiv and de Volkskrant as the operator of MIRhosting and a suspect in the investigation. Investigators reportedly suspect he continued providing services to the Neculiti network after EU sanctions took effect; he denied knowingly facilitating cyber operations.Ivan NeculitiReportedly one of the Moldovan brothers who operated Stark Industries, which Correctiv described as central to the investigation; the article says the EU sanctioned Stark Industries and its owners.Juri NeculitiReportedly one of the Moldovan brothers who operated Stark Industries, which Correctiv described as central to the investigation; the article says the EU sanctioned Stark Industries and its owners.Youssef Z.Identified in reporting by Correctiv and de Volkskrant as the owner of WorkTitans and a suspect in the investigation. He allegedly helped sanctioned entities evade restrictions through a front company.
Threat Actors
Vendors
MIRhostingInvestigators say the network involved Stark Industries, MIRhosting, WorkTitans, the Doppelgänger-linked Reliable Recent News network, and NoName057(16).Stark IndustriesInvestigators say the network involved Stark Industries, MIRhosting, WorkTitans, the Doppelgänger-linked Reliable Recent News network, and NoName057(16).WorkTitans B.V.Investigators say the network involved Stark Industries, MIRhosting, WorkTitans, the Doppelgänger-linked Reliable Recent News network, and NoName057(16).