Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
2026-05-27T01:23:26Z•ed2d3f5b228850fe3d562cd060fb308352ad065cce0bdd5157f8549af1363542
AWS GovCloudCISACanvas breachDDoSGitHubKimwolfMicrosoft Office tokensNetherlandsPatch TuesdayRussia-linked operationsScattered SpiderStark Industries Solutionsbotnetcongressional inquirycredentials leakdata extortiondata leakdisinformationeducation sectorhosting seizurelaw enforcementrouter exploitationzero-day
What happened
A series of high-impact incidents and law‑enforcement actions were reported: Dutch authorities seized ~800 servers and arrested co‑owners of hosting firms alleged to have supported Russian cyberattacks, influence and disinformation operations tied to a sanctioned ISP. The U.S. CISA is responding to a major breach after a contractor publicly posted AWS GovCloud credentials and internal build/deploy secrets on GitHub, prompting Congressional inquiries. A 23‑year‑old alleged Kimwolf botnet operator was arrested and charged in Canada and the U.S., while a separate data‑extortion attack on Canvas (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- ed2d3f5b228850fe3d562cd060fb308352ad065cce0bdd5157f8549af1363542
- Enrichment time
- 2026-05-27T01:23:26Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.