The Dutch Financial Investigation Service (FIOD) has carried out a large-scale operation targeting infrastructure used to orchestrate cyberattacks against European countries.
During raids conducted on May 18, FIOD officers searched for two data centers (in Dronten and Schiphol-Rijk), as well as company offices in Enschede and Almere. As a result, more than 800 servers, laptops, mobile phones, and extensive administrative documentation were seized.
Two men have been arrested on suspicion of violating European sanctions and aiding cybercrime:
57-year-old Yusef Z. from Amsterdam, owner of WorkTitans B.V. (operating under the brand THE.Hosting);
39-year-old Andrei N. from The Hague, associated with the company MIRhosting.
Both are suspected of providing hosting infrastructure used by pro-Russian hacker groups, primarily NoName057(16) — a group linked to the Kremlin.
According to investigators, the seized servers belonged to a network connected to Stark Industries, a company established shortly after Russia’s full-scale invasion of Ukraine in 2022. The company was formally registered in the Netherlands as a front to circumvent sanctions.
The servers were used for:
Large-scale DDoS attacks on government websites, banks, and critical infrastructure across European countries;
Election interference operations (attacks on Danish municipal elections were specifically mentioned).
This is one of the largest server infrastructure seizures in Europe in recent years. Many experts note that such hosting providers have been operating openly in the EU, offering services without proper customer due diligence (non-KYC).
Bloomberg, Krebs on Security, and other publications emphasize that the operation has delivered a significant blow to the infrastructure of pro-Russian hacker campaigns aimed at destabilizing Europe.
The investigation is ongoing. FIOD officials stated that the operation was carried out in close cooperation with international partners.