Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
2026-05-28T19:23:29Z•9cab034a81d276433fd8916036516c72f52cfee29f891e03c9ed61b4e2cfcc7f
AWS GovCloudCISACanvasDDoSGitHubIoTKimwolfMicrosoftRussiaSharePoint Server (zero-day referenced as BlueHammer in Windows/arrestsbotnetcongressional-inquirycredential-exposuredata-extortiondata-leakeducation-sectorextortionhosting-providerslaw-enforcementnation-statepatchesstaging-infrastructurevulnerabilitieszero-day
What happened
Multiple high-impact cyber incidents and law-enforcement actions were reported: Dutch authorities seized ~800 servers and arrested two co-owners of hosting firms accused of facilitating Russian cyberattacks, influence and disinformation campaigns (linked to a sanctioned ISP). The U.S. CISA suffered a major secrets exposure after a contractor published AWS GovCloud keys and internal build/deploy materials to a public GitHub repo, prompting congressional inquiries and an ongoing containment effort. A 23-year-old alleged Kimwolf botnet operator was arrested in Canada and charged in Canada and the
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 9cab034a81d276433fd8916036516c72f52cfee29f891e03c9ed61b4e2cfcc7f
- Enrichment time
- 2026-05-28T19:23:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.