The Dutch financial-crimes agency FIOD seized "more than 800 servers" on 18 May 2026 and arrested two suspects — Youssef Zinad, 57, of Amsterdam, and Andrey Nesterenko, 39, of The Hague — charging them under sanctions law with making economic resources available to EU-sanctioned entities. The infrastructure allegedly hosted Russia-backed operations including DDoS staging, anonymisation proxies, and disinformation campaigns; among the cited deployments was targeting of Danish government bodies during the country's 13–19 November 2025 municipal elections. The use of sanctions law rather than computer-crime statutes is the substantive novelty — it makes the hosters, not just the attackers, directly prosecutable in the EU.