An internet server based in a village outside Amsterdam was used as a base by Russia to launch cyber attacks against Ukraine last week, NRC reported on Wednesday.

Wormer is a village of around 13,000 people on the river Zaan, just north of the Zaanse Schans windmills, but according to cybersecurity experts it played a pivotal role in the hacking of Ukrainian banks last week.

The co-ordinated attack last Wednesday, February 16 – the date when US president Joe Biden said Russia was ready to invade Ukraine – also targeted the websites of the Ukrainian army and other government websites.

The sites were taken down after being hit by ‘denial of service’ attacks co-ordinated through a so-called ‘Mirai’ botnet, in which a network of infected computers all request access at the same time, paralysing the website’s servers. US, British and Ukrainian security services say the Russian intelligence agency GRU was behind the attacks.

The requests are sent not just from regular computers, but also smart devices such as digital doorbells and cameras.

DDOS attack

Police said one of the hubs was a server based in Wormer, owned by 22-year-old entrepreneur Sijmen Karel Bakker.

Bakker told NRC he had taken down the account that hosted the attack as soon as he was informed. ‘I heard from them that the server was involved in a sort of DDOS [distributed denial of service] attack and that it was about Ukraine.’

He did not reveal the identity of his customer, but said he would co-operate with requests for information from the police. ‘I rent out the servers and what my customers do with them is their responsibility. But if they breach our terms and conditions and Dutch law, we take them offline without hesitation.’

Fraud inquiry

Bakker’s company has previously leased space to far-right website Vizier op Links, which posts names and addresses of journalists and academics online and has stuck flyers outside their houses.

The data centre belongs to two businessmen from The Hague, named as Bartholomeus E. and Reinier van E., who are currently facing criminal charges. Other companies – unrelated to Bakker’s – are alleged to have hosted sites that sell illegal drugs, share copyrighted material and distribute indecent images of children.

The tax office’s criminal investigation branch FIOD raided the centre last year as part of an inquiry into alleged tax fraud.