The article from de Volkskrant details how two Dutch men, Youssef Z., a 57-year-old organizational consultant and entrepreneur, and Andrey N., a 39-year-old concert pianist and hosting provider owner, aided pro-Russian hackers by providing digital infrastructure. They are suspected by the Dutch fiscal investigation service (FIOD) of violating sanctions laws by supporting Russian cyber interference, cyberattacks, and disinformation campaigns in the European Union via their hosting companies Mirhosting (Almere) and WorkTitans (Enschede). Pro-Russian hacker group NoName057(16), linked to the Russian state body CISM and Kremlin-directed efforts, used servers rented through these companies to mask attack origins on European targets like Danish government bodies and elections, causing disruptions including attacks on Danish online services MitID and political websites. The Moldovan company Stark Industries, founded by the Russia-aligned Neculiti brothers from Transnistria, acted as a proxy network leasing servers through Mirhosting and later WorkTitans to conceal cyberattack origins. After EU sanctions against Stark in May 2025, the attackers moved operations to WorkTitans, owned by Youssef Z., allowing continued malicious activity under a new front company THE.Hosting. Both men deny intentional wrongdoing, but investigations and EU sanctions highlight their roles in sustaining Russian cyber operations. The article includes details of arrests, business ties, technical infrastructure, and impact on European cybersecurity, showing a sophisticated hybrid warfare attack mechanism.

The article from de Volkskrant details how two Dutch men, Youssef Z., a 57-year-old organizational consultant and entrepreneur, and Andrey N., a 39-year-old concert pianist and hosting provider owner, aided pro-Russian hackers by providing digital infrastructure. They are suspected by the Dutch fiscal investigation service (FIOD) of violating sanctions laws by supporting Russian cyber interference, cyberattacks, and disinformation campaigns in the European Union via their hosting companies Mirhosting (Almere) and WorkTitans (Enschede). Pro-Russian hacker group NoName057(16), linked to the Russian state body CISM and Kremlin-directed efforts, used servers rented through these companies to mask attack origins on European targets like Danish government bodies and elections, causing disruptions including attacks on Danish online services MitID and political websites. The Moldovan company Stark Industries, founded by the Russia-aligned Neculiti brothers from Transnistria, acted as a proxy network leasing servers through Mirhosting and later WorkTitans to conceal cyberattack origins. After EU sanctions against Stark in May 2025, the attackers moved operations to WorkTitans, owned by Youssef Z., allowing continued malicious activity under a new front company THE.Hosting. Both men deny intentional wrongdoing, but investigations and EU sanctions highlight their roles in sustaining Russian cyber operations. The article includes details of arrests, business ties, technical infrastructure, and impact on European cybersecurity, showing a sophisticated hybrid warfare attack mechanism.