Dutch authorities have apprehended two individuals connected to Internet hosting companies accused of facilitating Russian cyber operations within the European Union. **Arrests and Charges** The **FIOD**, the Dutch financial crime agency, arrested a 57-year-old from Amsterdam and a 39-year-old from The Hague on May 18. According to *de Volkskrant*, they are charged with violating sanctions law by providing resources to EU-sanctioned entities.  **Stark Industries Connection** The investigation centers on **Stark Industries**, a hosting provider that emerged shortly before Russia's invasion of Ukraine. A May 2024 report highlighted Stark's role in massive DDoS attacks against European targets and its provision of proxy and anonymity services used in attacks linked to Russian-backed groups. The report identified Moldovan brothers **Ivan** and **Yuri Neculiti**, and their company **PQHosting**, as key providers of Stark's Internet connectivity. In May 2025, the EU sanctioned PQHosting and the Neculiti brothers. However, **MIRhosting**, an ISP based in the Netherlands, continued to provide Stark's remaining Internet connection. **MIRhosting and WorkTitans BV** **MIRhosting** is operated by **Andrey Nesterenko**, a Russian native based in the Netherlands. Before the EU sanctions against PQHosting, Stark's network assets were transferred to **the[.]hosting**, controlled by the Dutch entity **WorkTitans BV**. **Andrey Nesterenko** and **Youssef Zinad** control WorkTitans, which relies solely on MIRhosting for Internet connectivity. **Raids and Seizures** On May 18, investigators arrested **Nesterenko** and **Zinad**, searching three businesses and two data centers. They seized laptops, telephones, and over 800 servers, according to a statement from Dutch authorities.  **Allegations and Denials** *De Volkskrant* reported that **WorkTitans** and **MIRhosting** were heavily used in pro-Russian attacks on Danish government bodies during Denmark's municipal elections in November 2025. Prior to his arrest, **Nesterenko** denied knowing his servers were misused and claimed to have ended services with the Neculiti brothers after the EU sanctions. **MIRhosting** has initiated an internal investigation and temporarily paused services to WorkTitans. **Background and Response** **Nesterenko**, a former piano prodigy, founded **Innovation IT Solutions Corp.**, the parent company of MIRhosting. This company hosted stopgeorgia[.]ru, a website used to organize cyberattacks against Georgia during the 2008 conflict. Nesterenko denies supporting cybercrime or sanctions evasion, stating that the allegations and arrest have been damaging. He claims the transition to the[.]hosting was not intended to evade sanctions and that shutting down a legitimate Dutch company will not stop cybercrime. **Youssef Zinad's Role** Little is publicly known about **Youssef Zinad**. He reportedly kept a low profile following previous reports. While **Nesterenko** claims Zinad was never an employee of MIRhosting, previous communications and listings suggest he was involved with the company.