Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks

Recorded: May 25, 2026, 1:57 p.m.

Original

Summarized

Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks – Krebs on Security

HomeAbout the Author
Advertising/Speaking

Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks

May 25, 2026

0 Comments

Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecurity story about how their hosting companies had assumed control over the technical infrastructure of Stark Industries Solutions, an Internet service provider sanctioned last year by the EU as a frequent staging ground for cyber mischief from Russia’s intelligence agencies.
An investigator with the Tax Intelligence and Investigation Service (FIOD), the Dutch financial crimes agency, during the raid. Image: FIOD.
The Dutch daily news outlet de Volkskrant reports that the Dutch financial crime agency FIOD on May 18 arrested a 57-year-old from Amsterdam and a 39-year-old from The Hague, charging them with violating sanctions law by directly or indirectly making economic resources available to EU-sanctioned entities.
The Dutch investigation focuses on Stark Industries, a sprawling hosting provider that materialized just two weeks before Russia invaded Ukraine. As detailed in this May 2024 deep-dive, Stark quickly became the source of massive distributed denial-of-service (DDoS) attacks against European targets, and emerged as a top supplier of proxy and anonymity services that showed up time and again in cyberattacks linked to Russia-backed hacking groups.
That report identified two Moldovan brothers — Ivan and Yuri Neculiti and their company PQHosting — who were providing one of Stark’s two main conduits to the larger Internet. In May 2025, the EU sanctioned PQHosting and the Neculiti brothers for aiding Russia’s hybrid warfare efforts. But as KrebsOnSecurity observed in September 2025, those sanctions failed to target Stark’s remaining connection to the Internet — an Internet service provider based in the Netherlands called MIRhosting.
MIRhosting is operated by Andrey Nesterenko, a 39-year-old Russian native who runs the business out of the Netherlands. News that PQHosting and the Neculiti brothers were about to be sanctioned by the EU leaked in the media nearly two weeks before the sanctions were announced last year. During that time, the Stark network assets were transferred from PQHosting to a new entity called the[.]hosting, under the control of the Dutch entity WorkTitans BV.
And as our September 2025 report showed, WorkTitans was controlled by Nesterenko and a 57-year-old from Amsterdam named Youssef Zinad. On top of that, WorkTitans was getting connectivity to the larger Internet solely through MIRhosting, where Zinad had worked previously.
On May 18, Dutch financial crime investigators arrested Nesterenko and Zinad, and searched three businesses in Enschede and Almere and two data centers in Dronten and Schiphol-Rijk. A statement from the Dutch authorities said they also seized laptops, telephones and more than 800 servers.
A message to the-hosting customers immediately after 800 of its servers were seized by Dutch authorities. The message says that unfortunately data stored on the server has been lost and cannot be recovered.
De Volkskrant said it reviewed data showing WorkTitans and MIRhosting were the most-used networks in pro-Russian attacks on Danish government bodies between November 13 and 19, 2025, the week of Denmark’s municipal elections.
The publication wrote that prior to Nesterenko’s arrest, the MIRhosting founder denied that he knew his servers had been misused by pro-Russian cybercriminals. “He said he had ended all services with the Neculiti brothers when the EU sanctions came into force in May 2025,” and the he “reserved all rights to take action against ‘harmful and incorrect publications,” de Volkskrant wrote.
MIRhosting released a statement saying it has initiated an internal investigation into the alleged facts concerning the elections in Denmark, and that it has temporarily paused services to WorkTitans as a precautionary measure while the matter is being reviewed further.
“Based on our preliminary findings, there are no indications that the services over which we exercise control were actually used to influence the Danish elections,” the statement reads. “No anomalies or spikes were observed in our network traffic during the period mentioned in the publication; had large-scale DDoS attacks occurred, such activity would have been evident. Furthermore, prior to the media publication, we had not received any complaints, abuse reports, or official requests regarding suspicious activities or misuse of our network. Meanwhile, our regular operational activities continue, and our service to our other clients remains fully intact.”
Born in Nizhny Novgorod, Russia, Mr. Nesterenko grew up as a piano prodigy who performed publicly at a young age. In 2004, Nesterenko founded MIRhosting’s parent Innovation IT Solutions Corp., which has the notable distinction of being the company responsible for hosting stopgeorgia[.]ru, a hacktivist website for organizing cyberattacks against Georgia that appeared at the same time Russian forces invaded the former Soviet nation in 2008. That conflict was thought to be the first war ever fought in which a notable cyberattack and an actual military engagement happened simultaneously.
Responding to questions shared via email, Nesterenko said MIRhosting does not support cybercrime, sanctions evasion, or illegal activity, and that the allegations and arrest by Dutch authorities have been extremely harmful to him and his company.
“The transition to the.hosting was not intended to evade sanctions,” Nesterenko wrote. “The hardware and customer portfolio had already been transferred to WorkTitans before the sanctions appeared. Closing or damaging a legitimate Dutch infrastructure company will not stop cybercrime, but it will harm many people who have done nothing wrong.”
Far less is public about the 57-year-old Zinad, who reportedly has been keeping a low profile since our story last year. De Volkskrant reported that Zinad blocked access to his LinkedIn account, had gone months without responding to emails, WhatsApp messages and phone calls, and told a colleague that illness was forcing him to lead a somewhat more reclusive life.
Mr. Zinad’s now-defunct LinkedIn profile. It was full of posts for MIRhosting’s services.
Mr. Nesterenko claims Zinad was never an employee of MIRhosting.
“He helped me and MIRhosting with certain business tasks under a normal business-to-business arrangement between companies,” Nesterenko explained.
However, in previous emails to KrebsOnSecurity, Nesterenko carbon copied Mr. Zinad (who had a @mirhosting.com email), explaining that he was part of the company’s legal team. Also, the Dutch website stagemarkt[.]nl lists Youssef Zinad as an official contact for MIRhosting’s offices in Almere.
Mr. Zinad has never responded to requests for comment. Nor did de Volkskrant have any luck tracking him down. The publication said it repeatedly asked Mr. Zinad (referred to here as simply “Z”), but he reportedly avoided every form of contact.
“‘I am unavailable but will respond to your message as soon as possible,’ reads an automated reply on WhatsApp on 2 October 2025,” de Volkskrant reported. “It is the only response de Volkskrant would receive in months. He did not pick up his phone and did not call back. When an acquaintance asked him via LinkedIn to contact the reporter, he blocked access to his LinkedIn page. At an address in Almere where Z.’s personal limited company is registered, no one was present in April. The corner house’s blinds were drawn, and a pile of rubbish bags lay outside next to a container, as if someone had recently left. A neighbour said he knew the man but did not know where he was staying. Z. was later arrested at a residence in Amsterdam.”

This entry was posted on Monday 25th of May 2026 09:21 AM

Ne'er-Do-Well News Russia's War on Ukraine
Andrey Nesterenko de Volkskrant FIOD Innovation IT Solutions Corp Ivan Neculiti MIRhosting PQHosting Stark Industries Solutions WorkTitans BV Youssef Zinad Yuri Neculiti

Post navigation
← Lawmakers Demand Answers as CISA Tries to Contain Data Leak

Leave a Reply Cancel replyYour email address will not be published. Required fields are marked *Comment * Name *
Email *
Website

Advertisement
Mailing ListSubscribe hereSearch KrebsOnSecurity

Search for:

Recent Posts

Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks

Lawmakers Demand Answers as CISA Tries to Contain Data Leak

Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada

CISA Admin Leaked AWS GovCloud Keys on Github

Patch Tuesday, May 2026 Edition

Story Categories

A Little Sunshine

All About Skimmers

Ashley Madison breach

Breadcrumbs

Data Breaches

DDoS-for-Hire

DOGE

Employment Fraud

How to Break Into Security

Internet of Things (IoT)

Latest Warnings

Ne'er-Do-Well News

Other

Pharma Wars

Ransomware

Russia's War on Ukraine

Security Tools

SIM Swapping

Spam Nation

Target: Small Businesses

Tax Refund Fraud

The Coming Storm

Time to Patch

Web Fraud 2.0

Why So Many Top Hackers Hail from Russia

Authorities in the Netherlands initiated arrests of Andrey Nesterenko and Youssef Zinad, the co-owners of several Internet hosting companies, following an investigation into their operation of IT infrastructure utilized by Russia for cyberattacks and disinformation campaigns targeting the European Union. The Dutch financial crimes agency, FIOD, led the investigation, resulting in the arrest of the two men on May 18, 2026, on charges related to violating sanctions law by indirectly providing economic resources to EU-sanctioned entities. The seizure operations involved raiding three businesses and two data centers in locations such as Enschede, Almere, Dronten, and Schiphol-Rijk, where more than eight hundred servers, along with related equipment, were confiscated. Unfortunately, the data stored on these seized servers was lost and could not be recovered.

The investigation focused on the network chain linking the infrastructure to Russian activities. This infrastructure originated with Stark Industries Solutions, an Internet service provider that had been sanctioned by the EU as a frequent staging ground for cyber mischief from Russian intelligence agencies. As detailed in a May 2024 report, Stark became a source for massive distributed denial-of-service attacks and served as a supplier of proxy and anonymity services frequently linked to Russia-backed hacking groups. The investigation traced this network to PQHosting, operated by the Moldovan brothers Ivan and Yuri Neculiti, who were sanctioned by the EU in May 2025 for aiding Russia’s hybrid warfare efforts.

The subsequent investigation examined how these assets were leveraged post-sanctions. KrebsOnSecurity reported in September 2025 that the sanctions failed to cut off Stark’s remaining internet connection, which was maintained through MIRhosting, a Dutch Internet service provider operated by Andrey Nesterenko, a Russian national. The assets were subsequently transferred from PQHosting to a new entity named [.]hosting, which was controlled by the Dutch entity WorkTitans BV. This WorkTitans BV was managed by Nesterenko and Youssef Zinad, who had prior connections to MIRhosting.

The Dutch publication de Volkskrant reviewed data indicating that WorkTitans and MIRhosting were among the networks most frequently used in pro-Russian attacks on Danish government bodies during the week of the municipal elections in November 2025. Despite these findings, the founder of MIRhosting initially denied knowledge of the misuse, claiming he had terminated services with the Neculiti brothers upon the imposition of the EU sanctions. MIRhosting subsequently initiated an internal review and temporarily paused services to WorkTitans. The service provider maintained that preliminary findings showed no anomalies in network traffic during the specified period, asserting that no evidence existed that their services were used to influence the Danish elections, as no external complaints or suspicious activity reports were received prior to the media publication.

Andrey Nesterenko, born in Nizhny Novgorod, Russia, founded Innovation IT Solutions Corp. in 2004, which was noted for hosting the hacktivist website stopgeorgia[.]ru. Nesterenko contended that the transfer of hardware to the.hosting was not intended for sanctions evasion, arguing that the physical assets had already been moved before sanctions were enacted. He further argued that dismantling legitimate Dutch infrastructure would not halt cybercrime but would harm innocent parties. Youssef Zinad, the other arrested individual, remained less publicly visible, blocking contact and avoiding inquiries despite being listed as an official contact for MIRhosting’s offices. Nesterenko also claimed that Zinad was not an employee of MIRhosting, though documentation indicated a business-to-business arrangement existed between the entities, with Nesterenko communicating with Zinad regarding legal matters.