Dutch authorities arrested two hosting company co-owners and seized over 800 servers in a coordinated operation targeting Russian cyber infrastructure. The May 18 raids targeted MIRhosting and WorkTitans BV, companies accused of providing network resources for cyberattacks against European targets.

The investigation traces back to Stark Industries Solutions, an ISP sanctioned by the EU for facilitating Russian intelligence operations. After EU sanctions hit the original Moldovan operators, network assets transferred to Dutch entities just before the restrictions took effect, raising questions about deliberate sanctions evasion.

The infrastructure allegedly supported distributed denial-of-service attacks and proxy services used in pro-Russian hacking campaigns, including operations targeting Danish government systems during 2025 municipal elections. Dutch investigators found the hosting networks were primary conduits for these attacks.

The case reveals how cybercriminals exploit legitimate hosting services to mask malicious activities. Dutch authorities seized laptops and telecommunications equipment alongside the servers, effectively dismantling a key node in Russia's hybrid warfare infrastructure. The arrests demonstrate the growing sophistication of cross-border cybercrime investigations.