Dutch FIOD Seizes 800 Servers Linked to Stark Industries Pro-Russian Cyber Infrastructure

Scope: Hosting Providers Stark Industries / WorkTitans B.V. / Mirhosting (European Infrastructure)

Severity: High

On May 22, 2026, Dutch financial crime investigators (FIOD) arrested two men and seized approximately 800 servers across data centers in Dronten and Schiphol-Rijk, dismantling a hosting network that analysts had documented for years as the primary bulletproof infrastructure behind pro-Russian DDoS campaigns targeting European governments, including the NoName057(16) group's repeated attacks on Danish government bodies. The seized infrastructure traces back to Stark Industries Solutions, which was EU-sanctioned in May 2025, after which operators transferred assets to Dutch front companies WorkTitans B.V. and Mirhosting to continue operations under new branding. Organizations and government entities that have been targeted by pro-Russian DDoS campaigns or tracked NoName057(16) activity should treat this as a temporary disruption rather than a permanent block, as bulletproof-hosting customers are likely to migrate to alternative providers within days, and should maintain existing DDoS mitigations and perimeter monitoring.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.