Dutch Authorities Arrest Two Hosting Executives Over Alleged Russian Hacker Links
Summary
Dutch authorities arrested two hosting-company owners accused of helping maintain infrastructure for a sanctioned provider linked to Russian cyber activity. Investigators searched five locations and seized more than 800 servers.
Key points
- The Dutch FIOD said the arrests took place on May 18 and involved suspects aged 57 and 39.
- Investigators searched three locations and two data centers, seizing laptops, phones, and more than 800 servers.
- FIOD alleges one suspect’s company acted as a front for a sanctioned hosting provider and the other’s company kept its servers online.
- A de Volkskrant investigation identified the suspects as Youssef Z. and Andrey N. and linked their services to Stark Industries.
- The EU sanctioned Stark Industries in May 2025 for allegedly enabling destabilizing activities, including cyberattacks against EU members.
- The article says servers rented to Stark Industries helped Russian hackers, including NoName057(16), conduct DDoS and other attacks; these claims are reported allegations.
Article Details
- Event Type
- Arrests and infrastructure seizure in an investigation into alleged bulletproof hosting and EU sanctions evasion.
- Impact
- Two suspects were arrested, and authorities seized laptops, phones, and more than 800 servers. Investigators allege that Dutch companies provided hosting services to a sanctioned provider and helped keep its infrastructure operational; reporting links rented servers to DDoS and other attacks against EU targets.
MITRE ATT&CK
People
Iurie NeculitiIdentified as a Moldovan founder of Stark Industries; the article reports that the brothers restructured the company and moved part of its activities after EU sanctions.Ivan NeculitiIdentified as a Moldovan founder of Stark Industries; the article reports that the brothers restructured the company and moved part of its activities after EU sanctions.
Threat Actors
Andrey N.The article reports that he was arrested and alleges that he provided services to Stark Industries through Mirhosting; rented servers were reportedly used to support attacks against EU targets.NoName057(16)Identified as a Russian hacker group whose attacks against EU targets reportedly included DDoS activity supported by servers rented to Stark Industries.Youssef Z.The article reports that he was arrested and alleges that his firm, WorkTitans, provided server space and helped obscure customers for activities connected to Stark Industries.
Vendors
MIRhostingowns Mirhosting, which had physical servers deployed at various data centers.Stark Industriesand Andrey N., provided services to Stark Industries, a web hosting provider founded by Moldovan nationals Iurie and Ivan Neculiti.WorkTitans B.V.Called WorkTitans and based in Enschede, the company rents server space and resells it, essentially obscuring the real customer and making abuse detection difficult.