Netherlands Seizes 800 Servers, Arrests Two Hosting Co-Owners for Aiding Russian Cyberattacks
Dutch authorities arrested two co-owners of hosting firms MIRhosting and WorkTitans, seizing over 800 servers for allegedly providing infrastructure to EU-sanctioned Stark Industries Solutions, used by Russian intelligence for cyberattacks and disinformation.
Dutch financial crime investigators have arrested two men and seized more than 800 servers in a major crackdown on hosting infrastructure allegedly used to facilitate Russian cyberattacks and disinformation campaigns targeting European Union member states. The arrests, carried out on May 18 by the Tax Intelligence and Investigation Service (FIOD), target Andrey Nesterenko, a 39-year-old Russian native who operates MIRhosting from the Netherlands, and Youssef Zinad, a 57-year-old from Amsterdam. The two are charged with violating EU sanctions law by making economic resources available to sanctioned entities, specifically Stark Industries Solutions, a hosting provider that emerged just before Russia's invasion of Ukraine and quickly became a key platform for Russian intelligence-linked cyber operations.
The investigation centers on Stark Industries, a sprawling hosting provider that materialized two weeks before Russia invaded Ukraine in February 2022. As detailed in previous reporting, Stark rapidly became a source of massive distributed denial-of-service (DDoS) attacks against European targets and a top supplier of proxy and anonymity services used by Russia-backed hacking groups. The EU sanctioned Stark Industries in 2025, along with Moldovan brothers Ivan and Yuri Neculiti and their company PQHosting, which provided one of Stark's two main internet conduits. However, as KrebsOnSecurity reported in September 2025, those sanctions failed to target Stark's remaining connection to the internet: MIRhosting, a Dutch provider operated by Nesterenko.
When news of the impending sanctions on PQHosting leaked, Stark's network assets were transferred to a new entity called the.hosting, controlled by WorkTitans BV. WorkTitans was in turn controlled by Nesterenko and Zinad, and relied solely on MIRhosting for internet connectivity. Dutch financial crime investigators arrested Nesterenko and Zinad on May 18, searching three businesses in Enschede and Almere and two data centers in Dronten and Schiphol-Rijk. They seized laptops, telephones, and more than 800 servers, effectively taking down the.hosting's infrastructure. A message to the.hosting customers immediately after the raid stated that data stored on the seized servers had been lost and could not be recovered.
The Dutch daily de Volkskrant reported that data showed WorkTitans and MIRhosting were the most-used networks in pro-Russian attacks on Danish government bodies between November 13 and 19, 2025, the week of Denmark's municipal elections. Prior to his arrest, Nesterenko denied knowing his servers had been misused by pro-Russian cybercriminals, claiming he had ended all services with the Neculiti brothers when EU sanctions came into force in May 2025. MIRhosting released a statement saying it has initiated an internal investigation into the alleged facts concerning the Danish elections and has temporarily paused services to WorkTitans as a precautionary measure. The statement claimed there were no indications that services under MIRhosting's control were used to influence the Danish elections, noting no anomalies or spikes in network traffic during the period in question.
Nesterenko, born in Nizhny Novgorod, Russia, grew up as a piano prodigy and founded MIRhosting's parent company Innovation IT Solutions Corp. in 2004. That company notably hosted stopgeorgia.ru, a hacktivist website used to organize cyberattacks against Georgia during the 2008 Russian invasion, which is considered the first war where a major cyberattack coincided with military action. In response to questions, Nesterenko said MIRhosting does not support cybercrime, sanctions evasion, or illegal activity, and that the allegations and arrest have been extremely harmful to him and his company. He claimed the transfer of assets to WorkTitans was not intended to evade sanctions, as the hardware and customer portfolio had already been transferred before sanctions appeared.
This operation marks a significant escalation in European law enforcement's efforts to disrupt the infrastructure enabling Russian hybrid warfare. By targeting the hosting providers that serve as the backbone for cyberattacks and disinformation, Dutch authorities have sent a clear message that facilitating such activities carries serious legal consequences. The seizure of over 800 servers and the arrest of two key figures represent a tangible blow to the operational capacity of Stark Industries and its associated networks, though the broader challenge of dismantling the ecosystem of hosting providers that enable state-sponsored cybercrime remains formidable.