Dutch police seized 800 servers and arrested men behind hosting for Kremlin-linked hacking group NoName057(16), disrupting Russian cyberattack infrastructure targeting Europe.

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

Aggressor

Summary

Dutch financial crimes investigators seized 800 servers and arrested men who allegedly provided hosting infrastructure to the Kremlin-linked hacking group NoName057(16). The arrests included Youssef Zinel, 57, owner of WorkTitan, and Andrey Nastenarenko, 39, founder of MHHosting, both companies providing server space linked to Russian state-sponsored cyberattacks across Europe. The case ties to Iurie and Ivan Neculii, Moldovan brothers running Stark Industries Solutions, sanctioned for supporting Russian cyber operations related to the invasion of Ukraine. The infrastructure was moved to a new corporate shell in the Netherlands after sanctions. NoName057(16) is a pro-Russian hacktivist group using distributed denial-of-service (DDoS) attacks on government websites, critical infrastructure, and businesses since 2022. The US identified it as a Kremlin-backed operation linked to the Center for Study and Network Monitoring of the Youth Environment. WorkTitan and MHHosting were key networks used in DDoS attacks against Danish government entities. This case highlights the Netherlands as an important hosting location enabling Russian cyber operations in Europe. The arrests show law enforcement efforts to disrupt cybercrime infrastructure supporting Russian hybrid warfare, though broader challenges remain due to rapid adaptation and multiple corporate shells. Seizing these 800 servers poses a setback to Russian cyberattack capabilities impacting European cyberspace.

Classification

Confidence: Medium

The signal involves Kremlin-linked cyberattack infrastructure used in hostile cyber operations targeting European critical infrastructure and government entities, with concrete arrests and server seizures confirming aggression.

Source URL

https://thenextweb.com/news/dutch-police-800-servers-russian-hackers-noname057

Open source

Provenance

Publisher: extension
Submitted: May 28, 2026, 10:54 UTC
Last updated: Nov 8, 2026, 18:57 UTC
Event time: May 17, 2023, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "20e85754-e128-4a86-bd23-e69c751beebe",
  "url": "https://thenextweb.com/news/dutch-police-800-servers-russian-hackers-noname057",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Netherlands",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "NoName057",
    "Russian hackers",
    "cyberattacks",
    "DDoS",
    "WorkTitan",
    "MHHosting",
    "sanctions",
    "Netherlands",
    "Russian hybrid warfare",
    "cybercrime infrastructure"
  ],
  "nodes": [],
  "countries": [
    "Netherlands"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "Dutch financial crimes investigators seized 800 servers and arrested men who allegedly provided hosting infrastructure to the Kremlin-linked hacking group NoName057(16). The arrests included Youssef Zinel, 57, owner of WorkTitan, and Andrey Nastenarenko, 39, founder of MHHosting, both companies providing server space linked to Russian state-sponsored cyberattacks across Europe. The case ties to Iurie and Ivan Neculii, Moldovan brothers running Stark Industries Solutions, sanctioned for supporting Russian cyber operations related to the invasion of Ukraine. The infrastructure was moved to a new corporate shell in the Netherlands after sanctions. NoName057(16) is a pro-Russian hacktivist group using distributed denial-of-service (DDoS) attacks on government websites, critical infrastructure, and businesses since 2022. The US identified it as a Kremlin-backed operation linked to the Center for Study and Network Monitoring of the Youth Environment. WorkTitan and MHHosting were key networks used in DDoS attacks against Danish government entities. This case highlights the Netherlands as an important hosting location enabling Russian cyber operations in Europe. The arrests show law enforcement efforts to disrupt cybercrime infrastructure supporting Russian hybrid warfare, though broader challenges remain due to rapid adaptation and multiple corporate shells. Seizing these 800 servers poses a setback to Russian cyberattack capabilities impacting European cyberspace.",
  "summary_short": "Dutch police seized 800 servers and arrested men behind hosting for Kremlin-linked hacking group NoName057(16), disrupting Russian cyberattack infrastructure targeting Europe.",
  "summary_extended": null,
  "actor_primary": "NoName057(16)",
  "target_primary": null,
  "location_text": "Netherlands",
  "location_region": null,
  "location_coordinates_lat": 52.1326,
  "location_coordinates_lon": 5.2913,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "Medium",
  "classification_rationale": "The signal involves Kremlin-linked cyberattack infrastructure used in hostile cyber operations targeting European critical infrastructure and government entities, with concrete arrests and server seizures confirming aggression.",
  "event_time_utc": "2023-05-17T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-05-28T10:54:01.020Z",
  "updated_at": "2026-11-08T18:57:41.956Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

May 17, 2023, 00:00 UTC

Event time confidence

unknown

Location

Netherlands

Primary actor

NoName057(16)

Country

Netherlands

Countries

Netherlands

Tags

NoName057, Russian hackers, cyberattacks, DDoS, WorkTitan, MHHosting, sanctions, Netherlands, Russian hybrid warfare, cybercrime infrastructure

Loading signal...

{ "id": "20e85754-e128-4a86-bd23-e69c751beebe", "url": "https://thenextweb.com/news/dutch-police-800-servers-russian-hackers-noname057", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "Netherlands", "source_reliability": "C", "info_credibility": "3", "tags": [ "NoName057", "Russian hackers", "cyberattacks", "DDoS", "WorkTitan", "MHHosting", "sanctions", "Netherlands", "Russian hybrid warfare", "cybercrime infrastructure" ], "nodes": [], "countries": [ "Netherlands" ], "where_text": "Land", "headline": null, "description": "Dutch financial crimes investigators seized 800 servers and arrested men who allegedly provided hosting infrastructure to the Kremlin-linked hacking group NoName057(16). The arrests included Youssef Zinel, 57, owner of WorkTitan, and Andrey Nastenarenko, 39, founder of MHHosting, both companies providing server space linked to Russian state-sponsored cyberattacks across Europe. The case ties to Iurie and Ivan Neculii, Moldovan brothers running Stark Industries Solutions, sanctioned for supporting Russian cyber operations related to the invasion of Ukraine. The infrastructure was moved to a new corporate shell in the Netherlands after sanctions. NoName057(16) is a pro-Russian hacktivist group using distributed denial-of-service (DDoS) attacks on government websites, critical infrastructure, and businesses since 2022. The US identified it as a Kremlin-backed operation linked to the Center for Study and Network Monitoring of the Youth Environment. WorkTitan and MHHosting were key networks used in DDoS attacks against Danish government entities. This case highlights the Netherlands as an important hosting location enabling Russian cyber operations in Europe. The arrests show law enforcement efforts to disrupt cybercrime infrastructure supporting Russian hybrid warfare, though broader challenges remain due to rapid adaptation and multiple corporate shells. Seizing these 800 servers poses a setback to Russian cyberattack capabilities impacting European cyberspace.", "summary_short": "Dutch police seized 800 servers and arrested men behind hosting for Kremlin-linked hacking group NoName057(16), disrupting Russian cyberattack infrastructure targeting Europe.", "summary_extended": null, "actor_primary": "NoName057(16)", "target_primary": null, "location_text": "Netherlands", "location_region": null, "location_coordinates_lat": 52.1326, "location_coordinates_lon": 5.2913, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "Medium", "classification_rationale": "The signal involves Kremlin-linked cyberattack infrastructure used in hostile cyber operations targeting European critical infrastructure and government entities, with concrete arrests and server seizures confirming aggression.", "event_time_utc": "2023-05-17T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-05-28T10:54:01.020Z", "updated_at": "2026-11-08T18:57:41.956Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }