Dutch Authorities Arrest Hosting Providers Linked to Russian Cyber Operations
Dutch authorities have arrested two co-owners of internet hosting companies accused of providing infrastructure used by Russia for cyberattacks, disinformation campaigns, and influence operations within the European Union. The 57-year-old Amsterdam resident Youssef Zinad and 39-year-old Andrey Nesterenko of The Hague were detained on May 18 by the Dutch financial crime agency FIOD, charged with violating EU sanctions by enabling sanctioned entities.
The investigation centers on Stark Industries Solutions, a hosting provider established just before Russia’s 2022 invasion of Ukraine. Stark became a key platform for distributed denial-of-service (DDoS) attacks and proxy services linked to Russian-backed hacking groups. While the EU sanctioned Stark’s Moldovan partner, PQHosting, in May 2025, its remaining internet connectivity was traced to MIRhosting, a Dutch-based provider operated by Nesterenko.
Following the sanctions, Stark’s assets were transferred to the[.]hosting, controlled by WorkTitans BV, a Dutch entity co-managed by Nesterenko and Zinad. Dutch authorities seized over 800 servers, laptops, and phones during raids on three businesses in Enschede and Almere, as well as data centers in Dronten and Schiphol-Rijk.
Investigations revealed that WorkTitans and MIRhosting were among the most active networks in pro-Russian cyberattacks targeting Danish government bodies during the November 2025 municipal elections. Nesterenko denied knowledge of misuse, claiming he severed ties with the Neculiti brothers after EU sanctions took effect. MIRhosting stated it found no evidence of network anomalies during the Danish election period and had received no prior abuse reports.
Nesterenko, a Russian native, founded MIRhosting’s parent company in 2004, which previously hosted stopgeorgia[.]ru, a hacktivist site coordinating cyberattacks during Russia’s 2008 invasion of Georgia. He maintains that the transition to the[.]hosting was not an attempt to evade sanctions and that the arrests have harmed his business and employees.
Zinad, who had a low public profile, was listed as a MIRhosting contact on Dutch business records and used a company email address. Despite claims he was not an employee, Nesterenko previously described him as part of MIRhosting’s legal team. Zinad avoided media contact before his arrest in Amsterdam.
MIRhosting cybersecurity rating report: https://www.rankiteo.com/company/mirhosting
Starks Industries cybersecurity rating report: https://www.rankiteo.com/company/starks-industries
"id": "MIRSTA1779798899",
"linkid": "mirhosting, starks-industries",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Internet Infrastructure',
'location': 'Moldova/Netherlands',
'name': 'Stark Industries Solutions',
'type': 'Hosting Provider'},
{'industry': 'Internet Infrastructure',
'location': 'Moldova',
'name': 'PQHosting',
'type': 'Hosting Provider'},
{'industry': 'Internet Infrastructure',
'location': 'Netherlands',
'name': 'MIRhosting',
'type': 'Hosting Provider'},
{'industry': 'Internet Infrastructure',
'location': 'Netherlands',
'name': 'WorkTitans BV',
'type': 'Hosting Provider'},
{'industry': 'Public Sector',
'location': 'Denmark',
'name': 'Danish Government Bodies',
'type': 'Government'}],
'attack_vector': ['DDoS Attacks', 'Proxy Services'],
'date_publicly_disclosed': '2025-05-18',
'description': 'Dutch authorities have arrested two co-owners of internet '
'hosting companies accused of providing infrastructure used by '
'Russia for cyberattacks, disinformation campaigns, and '
'influence operations within the European Union. The arrests '
'followed an investigation into Stark Industries Solutions, a '
'hosting provider linked to DDoS attacks and proxy services by '
'Russian-backed hacking groups.',
'impact': {'brand_reputation_impact': ['Negative impact on MIRhosting and '
'WorkTitans BV'],
'legal_liabilities': ['Violation of EU sanctions'],
'operational_impact': ['Disruption of Danish municipal elections',
'Enabling cyberattacks'],
'systems_affected': ['Hosting infrastructure',
'Danish government bodies']},
'investigation_status': 'Ongoing',
'motivation': ['Geopolitical Influence',
'Disinformation Campaigns',
'Cyber Warfare'],
'post_incident_analysis': {'root_causes': ['Provision of infrastructure to '
'sanctioned entities',
'Lack of oversight on network '
'misuse']},
'references': [{'source': 'Dutch Authorities'}],
'regulatory_compliance': {'legal_actions': ['Arrests of co-owners'],
'regulations_violated': ['EU Sanctions']},
'response': {'containment_measures': ['Seizure of 800 servers, laptops, and '
'phones',
'Raids on businesses and data centers'],
'law_enforcement_notified': 'Dutch financial crime agency FIOD'},
'threat_actor': ['Russian-backed hacking groups',
'Stark Industries Solutions',
'PQHosting',
'MIRhosting',
'WorkTitans BV'],
'title': 'Dutch Authorities Arrest Hosting Providers Linked to Russian Cyber '
'Operations',
'type': ['Cyberattack Infrastructure Provision', 'Sanctions Violation']}