Netherlands seizes – Dutch financial crime investigators arrested the director of Stark Industries and a second man linked to internet connectivity, seizing 800 servers after accusing the web-hosting operation of enabling cyberattacks, interference activity, and disinformation. Th
For the second time, the message landed the way investigators prefer: with doors opened and machines taken.
Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers tied to a web-hosting company they say helped enable cyberattacks, interference operations, and disinformation campaigns.
The arrests targeted a 57-year-old suspect, described as the company director, and a 39-year-old man who headed a separate firm providing internet connectivity.
FIOD says the suspects indirectly provided economic resources to Russian and Belarusian entities that the European Union (EU) has sanctioned.
The investigation focuses on Stark Industries, a web hosting firm founded on February 10, 2022, shortly before Russia’s invasion of Ukraine. FIOD says the Dutch company—through its hosting and related support—provided backing to actions by the Russian Federation that undermine democracy and security. including through information manipulation and disruption of public and economic systems.
That line matters because it connects the technical role of a hosting provider to political and societal harm. Web services are often invisible to ordinary users until something breaks. Here, investigators argue that “invisible” infrastructure became part of how attacks were staged.
The EU added Stark Industries to its list of sanctioned entities on May 20 last year. After that restriction, investigators say the web hosting infrastructure was transferred to a newly created Dutch company they believe acted as a front for the sanctioned entities.
The most recent action came with the kind of scope that signals a long investigation and a desire to remove operational capacity quickly. FIOD carried out multiple raids in data centers in Dronten and Schiphol-Rijk, and also conducted searches in Enschede and Almere. Investigators seized 800 servers, along with laptops, phones, and administrative records.
A separate report tied the alleged front to a specific name. The De Volkskrant publication reported that the Dutch entity is WorkTitans B.V., which provides hosting services under the brand THE.Hosting.
De Volkskrant also alleged that Danish authorities and infrastructure providers linked WorkTitans to attacks by the pro-Russian hacktivist group NoName057(16). That group has previously targeted key organizations with distributed denial-of-service (DDoS) attacks.
Behind the hosting layer, the case also describes a transport and connectivity chain. Mirhosting. based in Almere. operated physical servers. provided colocation. and supplied high-capacity connectivity to major internet exchanges in Amsterdam and Frankfurt. Investigators say that made it a transport layer through which Stark’s traffic entered Europe and reached the WorkTitans infrastructure.
WorkTitans did not respond to De Volkskrant’s requests for a statement. Mirhosting denied knowingly supporting illegal operations, saying it quickly intervened after receiving abuse complaints.
Taken together. the raids and the server seizures point to a simple operational reality: when hosting infrastructure is dismantled. the ability to serve attack traffic—whether for disruption. interference. or disinformation—gets harder overnight. FIOD’s case is built around that bridge between corporate services and state-linked influence. from Stark Industries’ founding on February 10. 2022. to the EU sanction added on May 20 and the alleged shift to WorkTitans B.V. as a new staging point.
Netherlands FIOD Stark Industries web hosting cyberattacks disinformation sanctions Russian entities Belarusian entities WorkTitans B.V. THE.Hosting NoName057(16) DDoS Mirhosting Dronten Schiphol-Rijk Enschede Almere