According to cyber security researchers at Halcyon, a little-known cloud service company named Cloudzy has been providing internet services to state-sponsored hackers, enabling them to spy on and extort their targets. Cloudzy has been leasing server space and reselling it to at least 17 different hacking groups from countries including China, Russia, Iran, North Korea, India, Pakistan, and Vietnam.
The CEO of Cloudzy, Hannan Nozari, disputed Halcyon’s findings, claiming that his company should not be held responsible for the actions of its clients. He estimated that only two percent of their clients were involved in malicious activities and compared their situation to a knife factory not being responsible for someone misusing a knife.
Halcyon’s investigation revealed that approximately half of Cloudzy’s business was related to malicious activities, including providing services to two ransomware groups. The researchers arrived at this conclusion by mapping out Cloudzy’s digital footprint and tying it to known hacking operations.
Cloudzy’s geographic base of operations remains unclear. However, Halcyon researchers found evidence suggesting that Cloudzy is likely a front for another internet hosting company called abrNOC, which is operated by Nozari from Tehran.
Cloudzy is registered under its previous name, RouterHosting, in Cyprus and the US state of Wyoming. The company needed a US domicile to register internet protocol addresses in America.
Despite the allegations against Cloudzy, the extent of its registered agent, CloudPeak Law, a Wyoming law firm, being aware of the situation remains unclear.
Cloudzy’s business model is similar to other small virtual private server providers that offer internet hosting services in exchange for cryptocurrency without asking questions about the client’s intentions.
The case of Cloudzy highlights how hackers and ransomware groups exploit small firms operating at the fringes of cyberspace to facilitate significant cyberattacks.