Dutch Authorities Arrest Two Men in Raid Targeting Servers Linked to Russian Cyberattacks

Dutch financial crime investigators swooped on two men on May 18, seizing 800 servers they say were used to keep a pro-Russian cyberattack network running after European Union sanctions failed to shut it down.

One of those arrested was Andrey Nesterenko, 39, a Russian-born concert pianist living in The Hague and founder of MIRhosting, a Netherlands-based internet hosting company. The other was Youssef Zinad, 57, of Amsterdam, who ran a company called WorkTitans. Both men were questioned and released. They remain suspects.

Investigators from the FIOD, the Dutch fiscal intelligence and investigation service, raided business premises and data centers in Enschede, Almere, Dronten, and Schiphol-Rijk. The case centres on Stark Industries Solutions, a Moldovan hosting firm run by brothers Iurie and Ivan Neculiti that the EU sanctioned in May 2025 for enabling Russian state-sponsored hackers to attack European governments.

According to the Dutch newspaper de Volkskrant, which reviewed confidential data, WorkTitans and MIRhosting were the most-used networks in pro-Russian attacks on Danish government bodies during Denmark's municipal elections in November 2025. The FIOD said WorkTitans functioned as a cover for the sanctioned entities, while MIRhosting kept those servers connected to the internet.

News of the impending EU sanctions had leaked in Moldovan media approximately 12 days before they were officially announced. During that window, the Stark network assets were transferred to WorkTitans, effectively placing them outside the scope of the sanctions — until the May 18 raid.

Before his arrest, Nesterenko had pushed back against reporting that linked MIRhosting to the Russian hacker network. In a LinkedIn post, he said he had ended all services with the Neculiti brothers when EU sanctions came into force and reserved the right to take action against what he called harmful and incorrect publications. MIRhosting issued a separate statement saying it had opened an internal investigation and paused services to WorkTitans while the matter was under review.

Nesterenko grew up in Nizhny Novgorod, Russia, and began performing piano publicly at a young age. His personal website describes him as an accomplished concert pianist.

Both suspects are presumed innocent until proven guilty.