Netherlands Seizes 800 Servers, Arrests Two Men Enabling Russia's Cyberwar in Europe
Dutch authorities dismantle a critical node in Russia's digital attack infrastructure, arresting the co-owners of hosting companies that quietly powered influence operations and cyberattacks across the EU.
Written by OutOfToken AI
June 3, 2026 · 4 min read · Synthesized from reporting by Krebs on Security · How this works
Dutch law enforcement has executed one of Europe's most significant takedowns of Russian-linked cyber infrastructure, arresting two men and seizing 800 servers tied to hosting companies that served as a backbone for cyberattacks, disinformation campaigns, and influence operations targeting European Union member states. The arrests center on the co-owners of two interconnected hosting firms whose networks had absorbed control over IT infrastructure previously sanctioned by the EU for its role in facilitating operations by Russian intelligence agencies. It is a rare instance of Western law enforcement moving decisively against the commercial layer that makes state-sponsored cyber aggression operationally possible.
The Infrastructure Behind the Attacks
Hosting providers occupy a deliberately obscure position in the cybercrime ecosystem — they don't write malware or craft phishing lures, but without their servers, none of it works. The two companies at the center of this Dutch operation had taken over the technical infrastructure of a previously EU-sanctioned internet service provider identified as a frequent staging ground for Russian intelligence-linked cyber activity. By absorbing that sanctioned infrastructure under new corporate identities, the operators effectively laundered the network's utility, giving Russian threat actors continued access to IP ranges and server capacity that had already proven operationally valuable. Investigators found 800 physical servers implicated in the scheme — hardware that had been actively routing attack traffic and hosting disinformation assets inside Europe.
Sanctioned Infrastructure, New Wrapper
The EU's sanctions regime against Russian-linked cyber entities is designed to cut off access to Western digital infrastructure, but this case illustrates a persistent workaround: proxy operators who reconstitute sanctioned networks under fresh corporate branding. The two arrested co-owners had been identified earlier in 2025 by KrebsOnSecurity, which documented how their firms had systematically assumed control over the technical assets of the sanctioned provider — IP allocations, routing arrangements, and physical hosting agreements included. That investigative exposure appears to have accelerated the Dutch law enforcement timeline, with authorities moving to arrest and seize before the infrastructure could be restructured or migrated again. The operation underscores how open-source investigative journalism and law enforcement increasingly operate on parallel tracks in attribution-heavy cyber cases.
"800 servers seized in a single operation — one of the largest physical infrastructure takedowns targeting Russian cyber activity on European soil."
Europe's Harder Line on Bulletproof Hosting
The Netherlands has emerged as an unlikely but formidable front in the fight against cybercriminal and state-adjacent hosting infrastructure. Home to the Amsterdam Internet Exchange — one of the world's largest internet traffic hubs — the country carries outsized influence over European data flows, making Dutch law enforcement cooperation essential to any serious continental cyber enforcement effort. This latest operation fits a pattern of increasingly aggressive Dutch and broader EU action against so-called bulletproof hosting providers: companies that market themselves on their willingness to ignore abuse complaints and shield clients from legal exposure. When those clients include Russian intelligence services conducting hybrid warfare operations, the stakes move well beyond conventional cybercrime into matters of national and collective security. The arrests signal that EU member states are no longer content to merely sanction entities — they are pursuing the human operators who keep sanctioned infrastructure alive.
The seizure of 800 servers and the arrest of two hosting operators marks a meaningful tactical victory, but Russian cyber operations have consistently demonstrated the ability to reconstitute after infrastructure losses — finding new providers, new jurisdictions, new proxies. The more durable impact of this action may be deterrent: demonstrating to commercial hosting operators across Europe that providing cover for sanctioned Russian infrastructure carries real criminal exposure, not just regulatory risk. With EU member states sharpening both their sanctions tooling and their law enforcement coordination, the operational cost of running Russian cyber infrastructure inside Europe is rising — and this case just set a new benchmark for what enforcement actually looks like.
Editorial Note
Krebs on Security is a highly reputable cybersecurity news source with strong track record on law enforcement and infrastructure stories. The narrative aligns with known patterns of EU/Netherlands enforcement against Russian-linked hosting infrastructure. However, the reference to 'Stark Industries Solutions' raises concerns as this appears to be a fictional company name (from Marvel universe), suggesting either a placeholder, anonymization error, or potential fabrication in the summary provided.
Claim Tracker
AI-assessed
Specific numbers are stated but source document appears incomplete; cannot independently verify exact server count or arrest details from provided text
Named entity and infrastructure takeover claim presented as fact but no supporting documentation provided in excerpt
EU sanctions claim is specific and verifiable but not corroborated within the provided text
Superlative claim lacks comparative context or metrics to substantiate 'most significant' designation
Broad characterization presented without specific incident examples or evidence in provided excerpt
Ask AI about this story
// discussion
sign in to join the discussion