Dutch financial crime authorities have arrested two men and seized hundreds of servers as part of an investigation into a web hosting network accused of supporting cyberattacks, disinformation campaigns, and sanctioned Russian entities.
The Netherlands’ Fiscal Information and Investigation Service (FIOD) said the operation targeted infrastructure linked to Stark Industries, a hosting company founded just weeks before Russia’s 2022 invasion of Ukraine. Authorities allege the company enabled operations that undermined democratic institutions and public security through online disruption and information manipulation.
Authorities arrested a 57-year-old man identified as the company’s director, and a 39-year-old suspect who allegedly operated a separate connectivity provider. Officials claim the pair indirectly supplied economic resources to Russian and Belarusian entities under European Union sanctions.
The EU sanctioned Stark Industries on May 20 last year. According to authorities, the company’s infrastructure was later transferred to a newly established Dutch entity believed to be acting as a front organization in an attempt to evade restrictions.
FIOD officers carried out raids at data centers in Dronten and Schiphol-Rijk and conducted searches in Enschede and Almere. Authorities seized approximately 800 servers along with laptops, mobile phones, and administrative records.
Dutch newspaper De Volkskrant identified the suspected front company as WorkTitans B.V., which operates hosting services under the brand THE.Hosting. The publication reported that Danish authorities and internet infrastructure providers linked WorkTitans to cyberattacks carried out by the pro-Russian hacktivist group NoName057(16), known for launching distributed denial-of-service (DDoS) attacks against critical organizations.
Authorities are also reportedly investigating Mirhosting, an Almere-based infrastructure provider accused of supplying physical servers, colocation services, and high-capacity internet connectivity through major exchanges in Amsterdam and Frankfurt. Authorities believe the company acted as a key transport layer routing Stark-related traffic into Europe.
WorkTitans did not respond to requests for comment from De Volkskrant. Mirhosting said it did not knowingly support illegal activity and claimed it acted quickly when it received abuse complaints.