Russian hackers and the disinformation network Doppelganger are operating in Europe using servers in the Netherlands. They are utilizing the services of the Moldovan company PQ Hosting, allowing cybercriminals connected to the Russian authorities to circumvent sanctions and conduct their activities from within the EU. This information comes from Correctiv.
The owners of PQ Hosting are brothers Ivan and Yuri Nekoliti from the unrecognized region of Transnistria. Despite sanctions, the company is focused on Russian clients. Ivan Nekoliti has even admitted that their servers in the EU can be used to bypass blocks.
In 2022, Ivan Nekoliti established Stark Industries Solutions Limited in London, with his brother Yuri as the director. This company does not accept direct payments, which helps obscure the clients' connections to PQ Hosting.
Through Stark Industries Solutions Limited, hackers and disinformation agents gain access to servers in the Netherlands.
These servers are used by pro-Russian hacker groups:
• NoName057(16), responsible for DDoS attacks on Swiss government websites, airports, and railways.
• Sandworm, involved in an attack on the Ukrainian news agency Ukrinform.
• BlueCharlie, engaged in espionage and data theft in Ukraine and NATO countries.
• RRN (Recent Reliable News), part of a network spreading Russian disinformation, mimicking well-known media sites.
Ivan Nekoliti denies that their servers are used for illegal purposes, claiming that the company responds to all complaints related to illegal activities.
Previously, the Swiss Federal Office for Cyber Security discovered that hackers NoName057(16) also used servers from the Dutch company MIRhosting. Its manager, Andrey Nesterenko, was previously linked to a cyberattack on Georgia in 2008.
