Authorities in the Netherlands arrested two men who co-owned Internet hosting companies implicated in providing IT infrastructure used by Russia to conduct cyberattacks and disinformation campaigns within the EU. These companies controlled technical infrastructure formerly operated by Stark Industries Solutions, an ISP sanctioned by the EU for facilitating cyber operations linked to Russian intelligence. The investigation uncovered that the hosting providers enabled large-scale distributed denial-of-service attacks and proxy services used by Russia-backed hacking groups, including attacks targeting Danish government bodies during elections. Dutch financial crime investigators seized over 800 servers and charged the suspects with violating sanctions laws by making economic resources available to EU-sanctioned entities. One hosting company, MIRhosting, has paused services to related entities and is conducting an internal investigation. The suspects deny intentional involvement in cybercrime or sanctions evasion. This enforcement action disrupts infrastructure supporting hybrid warfare cyber activities.

The arrests and server seizures disrupt infrastructure used to facilitate cyberattacks, influence operations, and disinformation campaigns attributed to Russian state-backed actors targeting the European Union. The hosting companies provided critical services such as proxy and anonymity networks and were involved in large-scale distributed denial-of-service attacks against European government targets. The enforcement action impairs the operational capabilities of these cyber operations by removing key hosting resources and holding operators accountable for sanctions violations. There is no indication that the hosting companies themselves were compromised; rather, they are accused of knowingly or unknowingly enabling sanctioned entities. The impact includes loss of data stored on seized servers and potential interruption of services for customers of the affected hosting providers.

This threat is addressed through law enforcement actions including arrests and seizure of physical infrastructure. There is no software patch applicable. Organizations should monitor for any residual activity related to these hosting providers and assess exposure if they used these services. The hosting company MIRhosting has paused services to implicated entities and is conducting an internal investigation. No further mitigation actions are specified or required from end users based on the available information. The vendor (hosting providers) do not provide a patch; remediation is through legal enforcement and infrastructure seizure.