Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
2026-05-29T13:23:35Z•ae47f50581e16238c596cf9e3c4fbef36df932d4607a21dfd45a5a46731c29c8
AWS GovCloudCISACanvas-breachDDoSGitHub-exposureIoT-botnetKimwolfMicrosoft-Office-token-theftRussia-APTanti-DDoS-abusecongressional-inquirycredential-leakdata-extortioneducation-sectorhosting-abuselaw-enforcementpatch-tuesdayrouter-exploitserver-seizurezero-day
What happened
Multiple high-impact cybersecurity incidents and law-enforcement actions were reported: Dutch authorities seized ~800 servers and arrested two co-owners of hosting firms accused of providing infrastructure used by Russian intelligence-linked operations; a CISA contractor publicly exposed highly privileged AWS GovCloud credentials and internal build/deploy artifacts on GitHub, triggering a congressional inquiry and urgent containment efforts; a suspected Kimwolf IoT botnet operator was arrested in Canada and faces charges in Canada and the U.S.; an ongoing data-extortion attack against the ed‑s
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- ae47f50581e16238c596cf9e3c4fbef36df932d4607a21dfd45a5a46731c29c8
- Enrichment time
- 2026-05-29T13:23:35Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.