Law Enforcement Seizes 800 Servers From Cyberattack Hosting Company

Key Takeaways

• Dutch law enforcement seized over 800 servers linked to a web hosting company suspected of facilitating cyberattacks, disinformation, and sanctions evasion.
• Two individuals were arrested on May 18, 2026, for allegedly violating EU Sanctions Act by providing services to sanctioned entities.
• The investigation centers on a company established shortly before Russia’s invasion of Ukraine, which allegedly transferred its infrastructure to a new front company to bypass sanctions.

Dutch Authorities Dismantle Cyberattack Hosting Infrastructure, Arrest Two

In a significant operation, Dutch authorities have seized more than 800 servers and apprehended two suspects in connection with a web hosting infrastructure believed to be instrumental in supporting cyberattacks, disinformation campaigns, and efforts to circumvent sanctions tied to Russia.

The Fiscal Information and Investigation Service (FIOD) confirmed the arrests took place on May 18, 2026. The individuals detained are a 57-year-old man from Amsterdam and a 39-year-old man from The Hague. Both face charges of violating the EU Sanctions Act by allegedly supplying economic resources and services to organizations targeted by European Union sanctions.

Investigation Uncovers Sanctions Evasion Scheme

The core of the investigation revolves around a web hosting firm founded on February 10, 2022, merely weeks prior to Russia’s full-scale invasion of Ukraine. Investigators allege that this company’s infrastructure was subsequently leveraged to enable various destabilizing activities aimed at the European Union. These activities reportedly included launching cyberattacks against European systems, conducting interference operations, spreading disinformation, and supporting broader information manipulation efforts.

Authorities contend that this infrastructure played a role in undermining democratic processes and disrupting public and economic systems across EU member states. The hosting provider was officially added to the EU sanctions list on May 20, 2025. However, investigators discovered that a substantial portion of its infrastructure was transferred to a newly formed Dutch company around the same time, in what appears to be a deliberate attempt to evade these restrictions.

FIOD findings indicate that this new entity operated as a front organization to bypass the sanctions. The 57-year-old suspect has been identified as the director and indirect sole shareholder of this alleged front company. A second Dutch company, managed by the 39-year-old suspect, is believed to have provided crucial internet connectivity to the infrastructure, thereby enabling its continued operation despite the sanctions in place.

Extensive Raids and Seizures

Coordinated searches were executed across multiple locations, including three business premises in Enschede and Almere, as well as two data centers situated in Dronten and Schiphol-Rijk. During these operations, law enforcement confiscated a substantial amount of equipment and documentation, including:

• Over 800 servers
• Administrative records
• Laptops and mobile devices

The sheer volume of seized servers highlights the extensive infrastructure involved in the operation, suggesting a significant capacity for various cyber-enabled activities.

Ongoing Legal Proceedings

The Functional Prosecution Service, operating under the Dutch Public Prosecution Service, is spearheading this case. Violations of EU sanctions are prosecutable under both the Sanctions Act and the Economic Offenses Act, making such activities criminal offenses. Since the onset of the Russia-Ukraine conflict, the EU has broadened its sanctions against Russia and Belarus, encompassing restrictions on financial transactions and the provision of technical services.

Authorities have emphasized that any attempts to circumvent these measures, whether through proxy companies or infrastructure transfers, are actively investigated. The FIOD continues to monitor individuals and organizations endeavoring to evade sanctions while facilitating cyber operations. The investigation is ongoing, and further arrests or asset seizures may occur as authorities analyze the confiscated infrastructure and data.

What You Should Do

• Organizations should review their supply chains and third-party service providers to ensure compliance with all applicable sanctions.
• Implement robust due diligence processes for new vendors, especially those operating in high-risk jurisdictions or offering infrastructure services.
• Maintain vigilance for indicators of compromise (IOCs) related to state-sponsored cyber activity and disinformation campaigns.
• Report any suspicious activity or potential sanctions evasion attempts to relevant law enforcement agencies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.