Netherlands seizes 800 servers of hosting firm enabling cyberattacks
Home<br>News<br>Security<br>Netherlands seizes 800 servers of hosting firm enabling cyberattacks
Netherlands seizes 800 servers of hosting firm enabling cyberattacks
By Bill Toulas
May 22, 2026
01:24 PM
Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation campaigns.
FIOD arrested a 57-year-old suspect, who was the company director, and a 39-year-old who headed a separate firm that provided internet connectivity.
According to the authorities, the suspects indirectly provided economic resources to Russian and Belarusian entities sanctioned by the European Union (EU).
The investigation focuses on the activities of web hosting firm Stark Industries, founded on February 10, 2022, shortly before Russia’s invasion of Ukraine.
“The [Dutch] web hosting company, according to the research team, provided support to actions by the Russian Federation that undermine democracy and security, including through information manipulation and disruption of public and economic systems,” FIOD says.
The EU added Stark Industries to the list of sanctioned entities last year on May 20. Following this restriction, the web hosting infrastructure was transferred to a newly created Dutch company that investigators believe acted as a front for the sanctioned entities.
In the recent action, FIOD conducted multiple raids in data centers in Dronten and Schiphol-Rijk, as well as searches in Enschede and Almere, where they seized 800 servers, laptops, phones, and administrative records.
From the FIOD raids<br>Source: FIOD
According to a report from the De Volkskrant publication, the name of this Dutch entity is WorkTitans B.V. and provides hosting services under the brand THE.Hosting.
The same outlet alleges that Danish authorities and infrastructure providers linked WorkTitans to attacks by the pro-Russian hacktivist group NoName057(16), which has previously targeted key organizations with distributed denial-of-service (DDoS) attacks.
Mirhosting, based in Almere, operated physical servers, provided colocation, and supplied high-capacity connectivity to major internet exchanges in Amsterdam and Frankfurt, acting as the transport layer through which Stark’s traffic entered Europe to reach the WorkTitans infrastructure.
It’s worth noting that WorkTitans did not respond to de Volkskrant’s requests for a statement, while Mirhosting denied knowingly supporting illegal operations, claiming they quickly intervened upon receipt of abuse complaints.
The Validation Gap: Automated Pentesting Answers One Question. You Need Six.
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.<br>This guide covers the 6 surfaces you actually need to validate.
Download Now
Related Articles:
Police seize “First VPN” service used in ransomware, data theft attacks<br>INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers<br>UK fines water supplier $1.3M for exposing data of 664k customers<br>GM agrees to $12.75M California settlement over sale of drivers’ data<br>Student hacked Taiwan high-speed rail to trigger emergency brakes
Hosting
Legal
Netherlands
Sanctions
Stark Industries
Web Hosting
Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.
Previous Article
Comments
deltasierra - 2 hours ago
Stark Industries?? Like Tony Stark?
What a tool.
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now
You may also like:
Upcoming Webinar
Popular Stories
GitHub confirms breach of 3,800 repos via malicious VSCode extension
Microsoft warns of new Defender zero-days exploited in attacks
Exploit released for new PinTheft Arch Linux root escalation flaw
Sponsor Posts
33% Rise in Healthcare Credential Theft in 2025: What you need to know
Overdue a password health-check? Audit your Active Directory for free
Patch management isn't enough. See why privilege is defining security risk today.
Protect Your Business from Ecommerce Fraud
Managing Shadow AI: 5 Steps to Secure Employee AI Use Without Killing Productivity
Upcoming Webinar
Login
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
Not a member yet? Register Now
Reporter
Help us understand the problem. What is going on with this comment?
Spam
Abusive or Harmful
Inappropriate content
Strong language
Other
Read our posting guidelinese to learn what content is...