Dutch Investigators Seize 800 Servers, Arrest Two Tied to Stark Industries Successor

Amsterdam — Dutch financial crime investigators arrested two men on May 18 and seized more than 800 servers from data centers in Dronten and Schiphol-Rijk, charging the pair with making economic resources available to entities sanctioned by the European Union.

The Tax Intelligence and Investigation Service, known by its Dutch acronym FIOD, detained Andrey Nesterenko, 39, a Russian-born operator of The Hague-based MIRhosting, and Youssef Zinad, 57, of Amsterdam, a co-controller of WorkTitans BV. Both face suspicion of violating EU sanctions law. Investigators also searched three businesses in Enschede and Almere and pulled laptops and phones alongside the server fleet.

The case grew out of Stark Industries Solutions, a hosting provider that came online roughly two weeks before Russia invaded Ukraine in February 2022. Stark was sanctioned by the EU in 2024 as a staging ground for cyberattacks, proxy services and disinformation tied to Russian intelligence. When sanctions later landed on Stark's Moldovan upstream PQHosting and brothers Ivan and Yuri Neculiti in May 2025, the network assets shifted to a new entity, the[.]hosting, run through WorkTitans BV. WorkTitans took its connectivity solely from MIRhosting, where Zinad had previously worked.

Customers found out the hard way. A notice posted to the[.]hosting clients after the raid told them data on the seized machines was lost and could not be recovered.

Danish municipal elections sit at the center of the evidentiary record. Reporters at de Volkskrant said they reviewed data showing WorkTitans and MIRhosting were the most-used networks in pro-Russian attacks on Danish government bodies between Nov. 13 and Nov. 19, 2025, the week Denmark held its municipal vote.

MIRhosting disputes the allegation. The company said it has opened an internal review and temporarily paused services to WorkTitans. "Based on our preliminary findings, there are no indications that the services over which we exercise control were actually used to influence the Danish elections," MIRhosting said in a statement, adding that no traffic anomalies were observed during the period in question. The company did not address why WorkTitans, controlled in part by a person who held a mirhosting.com address, was treated as an arm's-length customer.

Nesterenko, contacted by email, said the migration from PQHosting was not a sanctions dodge. "The hardware and customer portfolio had already been transferred to WorkTitans before the sanctions appeared," he wrote. He said closing the business would harm uninvolved customers.

His history is not blank. In 2004 Nesterenko founded Innovation IT Solutions Corp., the parent of MIRhosting, which hosted stopgeorgia[.]ru, a site used to coordinate cyberattacks against Georgia during Russia's 2008 invasion.

Zinad has gone quiet. He blocked his LinkedIn account and stopped answering messages months before the raid, neighbors and former contacts told reporters. He has not responded to requests for comment.

The two men remain in Dutch custody pending further proceedings by the FIOD and the public prosecutor's office.