FIOD, the Dutch financial crimes agency, on May 18 arrested Youssef Zinad, 57, of Amsterdam, and Andrey Nesterenko, 39, of The Hague, charging both men under the Dutch Sanctions Act with making economic resources available to EU-sanctioned entities. Prosecutors simultaneously searched three businesses and two data centers, seizing approximately 800 servers, laptops, and administrative records.

The pair ran MIRhosting and WorkTitans BV, which together kept Stark Industries Solutions running after the EU sanctioned Stark’s Moldovan operators in May 2025. Stark materialized February 10, 2022, two weeks before Russia invaded Ukraine, and became one of the internet’s most active launch pads for DDoS attacks, disinformation campaigns, and proxy services tied to Russian intelligence-linked groups.

The government’s theory of the crime is timing. When Dutch and EU media leaked word, nearly two weeks before the formal announcement, that PQHosting and the Neculiti brothers were about to face EU sanctions, Stark’s network assets moved from PQHosting to WorkTitans, a Dutch entity Zinad and Nesterenko controlled. The move left Stark’s traffic flowing through MIRhosting, Nesterenko’s company, as if nothing had changed.

What those servers were doing is documented. De Volkskrant’s data found WorkTitans and MIRhosting were the top networks in pro-Russian attacks on Danish government bodies during that country’s municipal elections, November 13-19, 2025.

The Stark playbook: rebrand, transfer, reconnect. It’s outlasted two EU sanctions packages and is now facing criminal prosecution rather than just a designation list. If prosecutors prove the pre-sanction asset transfer was intentional evasion, it won’t just close this case. It’ll create criminal liability for any hosting provider that’s currently routing traffic for sanctioned entities and calling it a neutral business arrangement.

Nesterenko denied the transfer was evasion. Zinad went months without answering calls or emails before Dutch investigators found him at an Amsterdam address.

The FIOD investigation is supervised by the Functional Public Prosecution Service. No hearing date has been announced.

James Okafor