On Monday in the Netherlands, two men — residents of Amsterdam and The Hague — were detained on suspicion of "destabilizing activities directed against the EU." This was reported by the Dutch Fiscal Information and Investigation Service (FIOD).
What they are suspected of. Investigators believe that the 57-year-old resident of Amsterdam and the 39-year-old resident of The Hague may have been involved in interference operations, cyberattacks, and the spread of disinformation.
That same Monday, FIOD officers conducted searches at three commercial premises in Enschede and Almere, as well as at two data centers in Dronten and Schiphol-Rijk. During the investigative actions, documents, laptops, phones, and more than 800 servers were seized.
What is known about the case. The special service is conducting an investigation into a hosting provider established on February 10, 2022 — two weeks before the start of Russia's full-scale invasion of Ukraine. According to FIOD, this company's infrastructure was used for operations against EU countries, including cyberattacks and interference.
In May 2025, the company was added to the European Union sanctions list. Around the same time, a significant part of its technical infrastructure was transferred to a newly created front company registered to a resident of the Netherlands.
According to investigators, another Dutch company, whose director and sole shareholder is the 39-year-old resident of The Hague, provided internet connectivity for the servers of this infrastructure.
What is known about the detainees. FIOD is not disclosing the names of the detainees. However, as the Dutch publication De Volkskrant writes, the 57-year-old resident of Amsterdam is Yusef Z., an entrepreneur and organizational development consultant. The publication claims that shortly before the detention, it repeatedly tried to contact him, but he refused interviews.
The second detainee turned out to be Russian citizen Andrei N. He owned a hosting provider in Almere, but was better known as a concert pianist. According to the publication, in his youth he received music awards in Russia, and later honors in the Netherlands. He also graduated from the conservatory in Enschede.
Together with his wife, also a Russian citizen, he regularly performed at concert venues in the east of the Netherlands. In 2021, they performed works by Tchaikovsky at Oude Markt square in Enschede.
What attacks they may have been involved in. De Volkskrant claims that Andrei and Yusef provided infrastructure for attacks by the pro-Russian hacker group NoName057(16).
It was this group that claimed responsibility for the cyberattacks recorded in Denmark in the fall of 2025. At that time, the websites of political parties, the Danish parliament, and the English-language publication The Copenhagen Post stopped working. In addition, the website and system MitID, through which residents of Denmark access government and financial services, were unavailable.