Dutch authorities say they seized 800 servers and arrested two men linked to a hosting operation that allegedly helped cyberattacks, disruption campaigns, and online disinformation. Investigators said the action targeted infrastructure connected to Stark Industries, an EU-sanctioned hosting provider, and two Dutch companies allegedly used to keep its services running after sanctions; reporting links the network to pro-Russian DDoS, or distributed denial-of-service, activity by NoName057(16).
Why it matters: This matters because the seizure hits infrastructure allegedly used to support both cyberattacks and influence operations in Europe. Defenders, hosting providers, and abuse teams should watch for fallout such as service migration, replacement infrastructure, and renewed DDoS activity from the same actors.
Ionut Arghire
2026.05.26
98% relevant
This article is a direct update on the Stark Industries case, adding that Dutch authorities arrested two administrators of Dutch companies allegedly acting as fronts and infrastructure providers for the sanctioned hosting network, and confirming seizures at data centers and searches tied to Mirhosting and WorkTitans.
2026.05.25
98% relevant
This article is a direct update on the same Dutch/Stark Industries enforcement action, adding that two Dutch IT entrepreneurs were arrested, naming the suspected related firms via reporting, and detailing allegations that the infrastructure was used by the Doppelgänger-linked Reliable Recent News network and in NoName057(16) DDoS attacks while evading EU sanctions.
BrianKrebs
2026.05.25
99% relevant
This article appears to cover the same underlying event: Dutch authorities arrested two operators linked to MIRhosting and WorkTitans, searched multiple sites, and seized more than 800 servers tied to the Stark Industries network allegedly used in Russia-linked cyberattacks and disinformation. It adds names of the suspects, the sanctions-evasion allegations, and reporting tying the infrastructure to attacks on Danish government bodies during the 2025 municipal election period.
Bill Toulas
2026.05.22
100% relevant
This article establishes a distinct new story: a Dutch law-enforcement action against Stark Industries-linked hosting infrastructure allegedly enabling cyberattacks and disinformation, not the previously tracked seizure of the separate First VPN service.
← Back to all stories