Two arrested for facilitating pro-Russia cyberattacks, violating EU sanctions

FIOD arrested two men in the Netherlands on Monday for aiding and facilitating pro-Russian cyberattacks and violating European sanctions. The FIOD suspects these men of providing infrastructure for cyberattacks on European targets, including attacks by pro-Russian cybercriminals on the Danish municipal elections.

During raids on business premises in Almere and Drente, and data centers in Dronten and Schiphol Rijk, the FIOD, the Tax Authority’s investigative service, seized a massive 800 servers, as well as administration, laptops, and phones.

According to the Volkskrant, the men involved are 57-year-old Youssef Z., owner of Enschede-based hosting company WorkTitans, and 39-year-old Andrey N., founder of MIRhosting in Almere.

The investigation that led to these arrests started with a web hosting company founded two weeks before the Russian invasion of Ukraine in February 2022 - Stark Industries, according to the newspaper. The European Union sanctioned the company and its owners in May 2025, finding that they facilitate pro-Russian cyberattacks against European countries. After that, the company’s activities continued under different names.

According to the FIOD, Youssef Z.’s company functioned “in reality as a cover for the sanctioned entities.” While Andrey N.’s company ensured that Z.’s servers were connected to the internet.

Confidential information in the Volkskrant’s possession shows that these men’s companies, WorkTitans and MIRhosting, topped the list of most used networks in pro-Russian attacks on several Danish government organizations during the country’s municipal elections in November last year.

The FIOD questioned N. and Z. and then released them from custody. They remain suspects in the ongoing investigation.