According to cybersecurity researchers at Halcyon, an obscure cloud service company called Cloudzy has been providing internet services to state-sponsored hackers, allowing them to spy on and extort their victims. Cloudzy has been leasing server space and reselling it to at least 17 different government hacking groups from countries including China, Russia, Iran, North Korea, India, Pakistan, and Vietnam.
The CEO of Cloudzy, Hannan Nozari, disputed Halcyon’s assessment, claiming that his company cannot be held responsible for its clients’ actions. He argued that only about two percent of their clients are malicious, and compared their situation to that of a knife factory not being responsible for someone misusing a knife.
Halcyon estimated that approximately half of Cloudzy’s business was related to malicious activities, including providing services to two ransomware groups. They arrived at this conclusion by mapping out Cloudzy’s digital footprint, renting servers directly from the company, and tying it to known hacking operations.
While cybersecurity firm CrowdStrike had not seen state-sponsored hackers using Cloudzy, they have observed other cybercriminal activities connected to the company.
Halcyon researchers discovered that Cloudzy is likely a front for another internet hosting company called abrNOC, which is run by Nozari from Tehran. Cloudzy is registered under its previous name, RouterHosting, in Cyprus and the US state of Wyoming, with Nozari explaining that the US domicile was needed to register internet protocol addresses in America.
The business model of Cloudzy is similar to other small virtual private server providers that rent internet hosting services in exchange for cryptocurrency, allowing them to operate with minimal scrutiny.
