800 servers seized and a pianist arrested: the Netherlands has dismantled a Russian hacker network
This is according to Bloomberg.
What was seized and where
Last week, law enforcement officers carried out raids at two Dutch data centres. Around 800 servers belonging to the companies WorkTitans and MIRhosting were seized – they had been leasing the equipment to entities linked to Russian hackers.
According to the investigation, the actual beneficiaries were two Moldovan brothers – Yuri and Ivan Nekuliti – who were added to the EU sanctions list in 2025 for assisting Russian state-sponsored hackers.
Who has been arrested
Two people were detained as part of the operation:
- Yousef Zinad – owner of WorkTitans;
- Andrei Nesterenko – founder of MIRhosting, a 39-year-old Russian citizen residing in the Netherlands. He is also known as a concert pianist and winner of music competitions.
On LinkedIn, Nesterenko admitted that he had previously collaborated with one of the Nekulita brothers, but claims he ceased contact after sanctions were imposed. His company denies any wrongdoing – allegedly, it did not notice anything suspicious on its own network. WorkTitans declined to comment.
Who is behind the attacks
The seized servers are linked to the Russian hacking group NoName057(16), which Europol accuses of mass attacks on government websites and banking services. The group specialises in DDoS attacks – overwhelming websites with traffic until they crash completely.
Notable incidents include attacks on Danish government organisations last November and a Christmas attack on the French postal service, which caused widespread parcel delays.
How the group operates
According to the US Department of Justice, NoName057(16) is a covert project involving staff from the Kremlin-backed Centre for Monitoring the Youth Environment. The group maintained a daily ranking of DDoS attacks and rewarded the most active volunteers with cryptocurrency.
Experts note that the group relies heavily on servers in Western countries, making it vulnerable to police operations. Last year, European investigators seized around 100 NoName057(16) servers – yet the group continued its activities.
The operation in the Netherlands is part of a wider trend: the activity of hackers acting on behalf of aggressive states has increased significantly in recent times. DDoS attacks are not only targeting government websites – in May, ‘Nova Poshta’ also fell victim, with its services coming under a massive attack.
Russia is changing its tactics in the process: as revealed in Sweden, Russian cyberattacks are now targeting not only the digital but also the physical infrastructure of European countries. In Germany, hackers breached the Signal accounts of hundreds of top officials – including ministers and the leadership of the Bundestag – through a sophisticated phishing attack.
As a reminder, it was previously reported that China is hacking home routers and webcams around the world for espionage.
Follow us on Telegram
