Dutch Authorities Take Down Cyberattack Infrastructure: 800 Servers Seized from Hosting Firm

Netherlands Authorities Seize 800 Servers of Hosting Firm Involved in Cyberattacks

Financial crime investigators in the Netherlands, known as FIOD, have made significant strides in combating cybercrime by arresting two individuals and confiscating 800 servers associated with a web hosting company that facilitated cyberattacks, interference operations, and disinformation campaigns.

The 57-year-old company director and a 39-year-old individual overseeing internet connectivity services were apprehended by FIOD in connection with the illicit activities facilitated by the web hosting firm known as Stark Industries.

Authorities have revealed that the suspects indirectly funded Russian and Belarusian entities that have been sanctioned by the European Union for their involvement in undermining democracy and security.

The investigation primarily centers on the activities of Stark Industries, which was established shortly before Russia’s invasion of Ukraine in February 2022.

According to FIOD, the Dutch web hosting company played a crucial role in supporting actions by the Russian Federation that aimed to disrupt democracy and security through information manipulation and the disruption of public and economic systems.

Stark Industries was added to the EU’s list of sanctioned entities on May 20 last year. Following this development, the web hosting infrastructure was transferred to a newly established Dutch company, believed to be a front for the sanctioned entities.

During a recent operation, FIOD conducted raids at data centers in Dronten and Schiphol-Rijk, as well as searches in Enschede and Almere, resulting in the seizure of 800 servers, laptops, phones, and administrative records.

Reports from the De Volkskrant publication suggest that the Dutch entity involved in these operations is WorkTitans B.V., offering hosting services under the brand THE.Hosting.

Furthermore, Danish authorities and infrastructure providers have linked WorkTitans to cyberattacks carried out by the pro-Russian hacktivist group NoName057(16), which has a history of targeting key organizations with distributed denial-of-service (DDoS) attacks.

Mirhosting, based in Almere, was responsible for operating physical servers, providing colocation services, and offering high-capacity connectivity to major internet exchanges in Amsterdam and Frankfurt. This facilitated the flow of Stark’s traffic into Europe through the WorkTitans infrastructure.

It is important to note that WorkTitans did not respond to requests for comment from de Volkskrant, while Mirhosting denied any knowledge of supporting illegal operations and claimed to take swift action upon receiving abuse complaints.