Authorities within the Netherlands have arrested the co-owners of two associated Web internet hosting corporations for working IT infrastructure utilized by Russia to hold out cyberattacks, affect operations and disinformation campaigns contained in the European Union. The 2 males have been the main focus of a 2025 KrebsOnSecurity story about how their internet hosting corporations had assumed management over the technical infrastructure of Stark Industries Options, an Web service supplier sanctioned final 12 months by the EU as a frequent staging floor for cyber mischief from Russia’s intelligence companies.
An investigator with the Tax Intelligence and Investigation Service (FIOD), the Dutch monetary crimes company, through the raid. Picture: FIOD.
The Dutch each day information outlet de Volkskrant reviews that the Dutch monetary crime company FIOD on Could 18 arrested a 57-year-old from Amsterdam and a 39-year-old from The Hague, charging them with violating sanctions legislation by straight or not directly making financial sources accessible to EU-sanctioned entities.
The Dutch investigation focuses on Stark Industries, a sprawling internet hosting supplier that materialized simply two weeks earlier than Russia invaded Ukraine. As detailed on this Could 2024 deep-dive, Stark rapidly grew to become the supply of large distributed denial-of-service (DDoS) assaults in opposition to European targets, and emerged as a prime provider of proxy and anonymity providers that confirmed up repeatedly in cyberattacks linked to Russia-backed hacking teams.
That report recognized two Moldovan brothers — Ivan and Yuri Neculiti and their firm PQHosting — who have been offering one in all Stark’s two primary conduits to the bigger Web. In Could 2025, the EU sanctioned PQHosting and the Neculiti brothers for aiding Russia’s hybrid warfare efforts. However as KrebsOnSecurity noticed in September 2025, these sanctions failed to focus on Stark’s remaining connection to the Web — an Web service supplier primarily based within the Netherlands known as MIRhosting.
MIRhosting is operated by Andrey Nesterenko, a 39-year-old Russian native who runs the enterprise out of the Netherlands. Information that PQHosting and the Neculiti brothers have been about to be sanctioned by the EU leaked within the media almost two weeks earlier than the sanctions have been introduced final 12 months. Throughout that point, the Stark community property have been transferred from PQHosting to a brand new entity known as the[.]internet hosting, below the management of the Dutch entity WorkTitans BV.
And as our September 2025 report confirmed, WorkTitans was managed by Nesterenko and a 57-year-old from Amsterdam named Youssef Zinad. On prime of that, WorkTitans was getting connectivity to the bigger Web solely by means of MIRhosting, the place Zinad had labored beforehand.
On Could 18, Dutch monetary crime investigators arrested Nesterenko and Zinad, and searched three companies in Enschede and Almere and two information facilities in Dronten and Schiphol-Rijk. A press release from the Dutch authorities stated in addition they seized laptops, telephones and greater than 800 servers.
A message to the-hosting clients instantly after 800 of its servers have been seized by Dutch authorities. The message says that sadly information saved on the server has been misplaced and can’t be recovered.
De Volkskrant stated it reviewed information displaying WorkTitans and MIRhosting have been the most-used networks in pro-Russian assaults on Danish authorities our bodies between November 13 and 19, 2025, the week of Denmark’s municipal elections.
The publication wrote that previous to Nesterenko’s arrest, the MIRhosting founder denied that he knew his servers had been misused by pro-Russian cybercriminals. “He stated he had ended all providers with the Neculiti brothers when the EU sanctions got here into power in Could 2025,” and the he “reserved all rights to take motion in opposition to ‘dangerous and incorrect publications,” de Volkskrant wrote.
MIRhosting launched an announcement saying it has initiated an inner investigation into the alleged details regarding the elections in Denmark, and that it has briefly paused providers to WorkTitans as a precautionary measure whereas the matter is being reviewed additional.
“Based mostly on our preliminary findings, there aren’t any indications that the providers over which we train management have been truly used to affect the Danish elections,” the assertion reads. “No anomalies or spikes have been noticed in our community visitors through the interval talked about within the publication; had large-scale DDoS assaults occurred, such exercise would have been evident. Moreover, previous to the media publication, we had not acquired any complaints, abuse reviews, or official requests concerning suspicious actions or misuse of our community. In the meantime, our common operational actions proceed, and our service to our different purchasers stays totally intact.”
Born in Nizhny Novgorod, Russia, Mr. Nesterenko grew up as a piano prodigy who carried out publicly at a younger age. In 2004, Nesterenko based MIRhosting’s mum or dad Innovation IT Options Corp., which has the notable distinction of being the corporate chargeable for internet hosting stopgeorgia[.]ru, a hacktivist web site for organizing cyberattacks in opposition to Georgia that appeared on the identical time Russian forces invaded the previous Soviet nation in 2008. That battle was considered the primary conflict ever fought wherein a notable cyberattack and an precise navy engagement occurred concurrently.
Responding to questions shared by way of electronic mail, Nesterenko stated MIRhosting doesn’t help cybercrime, sanctions evasion, or criminal activity, and that the allegations and arrest by Dutch authorities have been extraordinarily dangerous to him and his firm.
“The transition to the.internet hosting was not supposed to evade sanctions,” Nesterenko wrote. “The {hardware} and buyer portfolio had already been transferred to WorkTitans earlier than the sanctions appeared. Closing or damaging a professional Dutch infrastructure firm won’t cease cybercrime, however it should hurt many individuals who’ve completed nothing fallacious.”
Far much less is public in regards to the 57-year-old Zinad, who reportedly has been conserving a low profile since our story final 12 months. De Volkskrant reported that Zinad blocked entry to his LinkedIn account, had gone months with out responding to emails, WhatsApp messages and cellphone calls, and advised a colleague that sickness was forcing him to guide a considerably extra reclusive life.
Mr. Zinad’s now-defunct LinkedIn profile. It was filled with posts for MIRhosting’s providers.
Mr. Nesterenko claims Zinad was by no means an worker of MIRhosting.
“He helped me and MIRhosting with sure enterprise duties below a traditional business-to-business association between corporations,” Nesterenko defined.
Nevertheless, in earlier emails to KrebsOnSecurity, Nesterenko carbon copied Mr. Zinad (who had a @mirhosting.com electronic mail), explaining that he was a part of the corporate’s authorized group. Additionally, the Dutch web site stagemarkt[.]nl lists Youssef Zinad as an official contact for MIRhosting’s places of work in Almere.
Mr. Zinad has by no means responded to requests for remark. Nor did de Volkskrant have any luck monitoring him down. The publication stated it repeatedly requested Mr. Zinad (referred to right here as merely “Z”), however he reportedly averted each type of contact.
“‘I’m unavailable however will reply to your message as quickly as potential,’ reads an automatic reply on WhatsApp on 2 October 2025,” de Volkskrant reported. “It’s the solely response de Volkskrant would obtain in months. He didn’t decide up his cellphone and didn’t name again. When an acquaintance requested him by way of LinkedIn to contact the reporter, he blocked entry to his LinkedIn web page. At an tackle in Almere the place Z.’s private restricted firm is registered, nobody was current in April. The nook home’s blinds have been drawn, and a pile of garbage baggage lay outdoors subsequent to a container, as if somebody had just lately left. A neighbour stated he knew the person however didn’t know the place he was staying. Z. was later arrested at a residence in Amsterdam.”
