Dutch Authorities Arrest Hosting Providers Linked to Russian Cyber Operations Dutch authorities have arrested two co-owners of internet hosting companies accused of providing infrastructure used by Russia for cyberattacks, disinformation campaigns, and influence operations within the European Union. The 57-year-old Amsterdam resident Youssef Zinad and 39-year-old Andrey Nesterenko of The Hague were detained on May 18 by the Dutch financial crime agency FIOD, charged with violating EU sanctions by enabling sanctioned entities. The investigation centers on Stark Industries Solutions, a hosting provider established just before Russia’s 2022 invasion of Ukraine. Stark became a key platform for distributed denial-of-service (DDoS) attacks and proxy services linked to Russian-backed hacking groups. While the EU sanctioned Stark’s Moldovan partner, PQHosting, in May 2025, its remaining internet connectivity was traced to MIRhosting, a Dutch-based provider operated by Nesterenko. Following the sanctions, Stark’s assets were transferred to the[.]hosting, controlled by WorkTitans BV, a Dutch entity co-managed by Nesterenko and Zinad. Dutch authorities seized over 800 servers, laptops, and phones during raids on three businesses in Enschede and Almere, as well as data centers in Dronten and Schiphol-Rijk. Investigations revealed that WorkTitans and MIRhosting were among the most active networks in pro-Russian cyberattacks targeting Danish government bodies during the November 2025 municipal elections. Nesterenko denied knowledge of misuse, claiming he severed ties with the Neculiti brothers after EU sanctions took effect. MIRhosting stated it found no evidence of network anomalies during the Danish election period and had received no prior abuse reports. Nesterenko, a Russian native, founded MIRhosting’s parent company in 2004, which previously hosted stopgeorgia[.]ru, a hacktivist site coordinating cyberattacks during Russia’s 2008 invasion of Georgia. He maintains that the transition to the[.]hosting was not an attempt to evade sanctions and that the arrests have harmed his business and employees. Zinad, who had a low public profile, was listed as a MIRhosting contact on Dutch business records and used a company email address. Despite claims he was not an employee, Nesterenko previously described him as part of MIRhosting’s legal team. Zinad avoided media contact before his arrest in Amsterdam.