The Dutch financial crime agency has arrested two individuals accused of violating the country’s sanctions regime against Russia, raiding two data centers in the process.

On May 18, the Fiscal Information and Investigation Service (FIOD) arrested Youssef Zinad, a 57-year old man from Amsterdam, and Andrey Nesterenko, a 39-year old man from the Hague, on suspicion of violating the Sanctions Act by “making economic resources available to entities sanctioned by the European Union.”

The pair are allegedly responsible for providing digital infrastructure to Russian cybercriminals, who conducted cyberattacks on Danish governments between November 13 and 19, 2025, according to Dutch publication de Volkskrant.

This is part of a larger investigation into Stark Industries Solutions, a hosting provider established two weeks before the Russian invasion of Ukraine. Stark Industries was placed on an EU sanctions list on May 20, 2025, but transferred its technical infrastructure to another service provider called The.hosting, operated by a Dutch company called WorkTitans, according to reporting by Krebs on Security.

WorkTitans, which was run by Zinad, then used an Internet service provider called MIRhosting, which was operated by Nesterenko.

According to the FIOD, two data centers in the town of Dronten and Schiphol-Rijk, and three business premises in Enschede and Almere were searched. More than 800 servers were seized.