Dutch Authorities Arrest Hosting Company Co‑Owners Linked to Russia‑Backed Cyberattacks
Patch your hosting infrastructure to remove any connections to sanctioned entities and verify compliance with EU sanctions.
Check your server inventory for any connections to WorkTitans or MIRhosting and ensure they are not used for sanctioned activities.
Summary
On May 18, 2026, Dutch financial crime investigators arrested Andrey Nesterenko, 39, and Youssef Zinad, 57, co‑owners of hosting companies that had provided the technical backbone for Russia‑linked cyberattacks. The arrests followed a 2025 KrebsOnSecurity exposé that revealed Stark Industries Solutions, an EU‑sanctioned ISP, had been using infrastructure from PQHosting, MIRhosting, and the newly formed WorkTitans BV to stage DDoS attacks and proxy services. Dutch authorities seized more than 800 servers, laptops, and phones during raids on three businesses in Enschede and Almere and two data centers in Dronten and Schiphol‑Rijk, and declared that data stored on the seized servers could not be recovered. MIRhosting, owned by Nesterenko, immediately paused services to WorkTitans and launched an internal investigation, stating that no traffic anomalies were detected during the Danish election period and that it had no evidence of misuse.
Prior to the sanctions, PQHosting and the Neculiti brothers had been removed from the EU sanctions list in May 2025, but the transfer of Stark’s assets to WorkTitans allowed the network to remain operational. WorkTitans, controlled by Nesterenko and Zinad, maintained connectivity to the wider Internet solely through MIRhosting, a link that was severed after the arrests. The incident underscores the risk of hosting providers becoming conduits for sanctioned actors and the importance of monitoring server inventories for compliance. Stakeholders are advised to review their hosting arrangements and ensure that no servers are linked to entities involved in sanctions violations.
Key changes
- Dutch authorities arrested Nesterenko and Zinad for violating EU sanctions by providing infrastructure to Stark Industries Solutions
- Over 800 servers, laptops, and phones were seized during raids on Enschede, Almere, Dronten, and Schiphol‑Rijk
- MIRhosting paused services to WorkTitans and launched an internal investigation after the arrests
- WorkTitans, controlled by Nesterenko and Zinad, had been the main conduit for Stark’s operations via MIRhosting
- PQHosting and the Neculiti brothers were previously sanctioned in May 2025, but the transfer to WorkTitans allowed continued activity
- No traffic anomalies were detected during the Danish election period, according to MIRhosting
- Data stored on the seized servers is reported to be lost and unrecoverable