Iranian cloud company accused of hosting cybercriminals | August 1st, 2023
Channel: Hacking Space Frontier
Date: 2023-08-01

An Iranian technology company called Cloudzy is allegedly providing infrastructure services to ransomware gangs and nation-state hackers, according to a report by cybersecurity firm Halcyon. Cloudzy operates as an internet service provider (ISP) and accepts cryptocurrency payments in exchange for anonymous technological services used in cyberattacks.

The company allegedly offers a range of services to prolific ransomware gangs such as BlackBasta and Royal. Additionally, it serves as the backbone of attacks for government hackers from countries like North Korea, Russia, China, India, Pakistan, and Vietnam. The infrastructure is also reportedly used by the Israeli spyware vendor Candiru.

Cloudzy operates as a legitimate business with Twitter and LinkedIn profiles, but researchers have found that it is actually based in Tehran, Iran, not the U.S., as claimed. The company allegedly provides Remote Desktop Protocol (RDP) and Virtual Private Server (VPS) services without inquiring about the customers' intended use.

The researchers began their investigation by examining the actions of two ransomware affiliates named "Ghost Clown" and "Space Kook," who used Cloudzy's infrastructure. Further investigation revealed that Cloudzy's services were being used by several ransomware affiliates, government-sponsored APT groups, criminal syndicates, and the commercial spyware vendor Candiru.

Halcyon estimated that potentially between 40% to 60% of Cloudzy's servers were directly supporting potentially malicious activity. The researchers found that Cloudzy markets itself to both privacy enthusiasts and threat actors, making it easy for cybercriminals to access their services anonymously.

When researchers reported the ransomware activity to Cloudzy, the company provided confusing responses and directed them to contact the ISPs that registered the IP addresses on their behalf. Further investigation led the researchers to find that Cloudzy's registration was connected to an office building in Wyoming, which was also associated with over 2,000 other companies through the law firm Cloud Peak Law. Another address connected to Cloudzy was linked to a man involved with hosting Neo-Nazi websites.

Cloudzy's founder, Hannan Nozari, claimed that only an estimated 2% of their clients were involved in malicious activity and compared their services to a knife factory not being responsible for someone misusing a knife.

Halcyon urged defenders to watch out for the IP addresses listed in the report and warned that doing business with Cloud Peak Law in the U.S. could violate U.S. sanctions on Iran.

Overall, the report highlights how Cloudzy allegedly operates as a crucial player in the global attack ecosystem, providing services to threat actors without taking action to prevent illicit activities.