{"id":53025,"date":"2023-08-01T15:44:43","date_gmt":"2023-08-01T15:44:43","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/34852\/Cloud-Company-Assisted-17-Different-Hacking-Groups.html"},"modified":"2023-08-01T15:44:43","modified_gmt":"2023-08-01T15:44:43","slug":"cloud-company-assisted-17-different-hacking-groups","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cloud-company-assisted-17-different-hacking-groups\/","title":{"rendered":"Cloud Company Assisted 17 Different Hacking Groups"},"content":{"rendered":"
\n
\n
\n
\"The<\/div>\n<\/div>\n

The home page of the Cloudzy internet service provider is seen in this photo illustration taken in Washington, U.S., July 31, 2023. REUTERS\/Raphael Satter\/Illustration<\/p>\n<\/figure>\n<\/div>\n

\n

Aug 1 (Reuters) – An obscure cloud service company has been providing state-sponsored hackers with internet services to spy on and extort their victims, a cybersecurity firm said in a report to be published<\/a> on Tuesday.<\/p>\n

Researchers at Texas-based Halcyon said a company called Cloudzy had been leasing server space and reselling it to no fewer than 17 different state-sponsored hacking groups from China, Russia, Iran, North Korea, India, Pakistan and Vietnam.<\/p>\n

Cloudzy CEO Hannan Nozari disputed Halcyon\u2019s assessment, saying that his firm couldn\u2019t be held responsible for its clients, of which he estimated only 2% were malicious.<\/p>\n

In an exchange over LinkedIn, Nozari told Reuters: \u201cIf you are a knife factory, are you responsible if someone misuses the knife? Trust me I hate those criminals and we do everything we can to get rid of them.\u201d<\/p>\n

Digital defenders say the case is an example of how hackers and ransomware gangs use small firms operating at the fringes of cyberspace to enable big hacks.<\/p>\n

Halcyon estimated that roughly half of Cloudzy\u2019s business was malicious, including renting services to two ransomware groups.<\/p>\n

\u201cIt’s a rogues\u2019 gallery on that through one provider,\u201d said Halcyon executive Ryan Golden ahead of the report\u2019s publication.<\/p>\n

Halcyon arrived at its conclusion by mapping out Cloudzy\u2019s digital footprint, in part by renting servers directly from the firm and by tying it to known hacking operations.<\/p>\n

The cybersecurity firm CrowdStrike, which wasn\u2019t involved in the research, said that it hadn\u2019t seen state-sponsored hackers using Cloudzy. But it had seen other cybercriminal activity connected to it.<\/p>\n

Cloudzy’s geographic base of operations is unclear.<\/p>\n

Halcyon researchers analyzed Cloudzy\u2019s employees\u2019 social media, including LinkedIn and Facebook postings, and found the firm is \u201calmost certainly” a front for another internet hosting company called abrNOC, which Nozari runs from Tehran.<\/p>\n

Nozari, who says he lives outside Iran but would not be more specific, told Reuters the companies are separate, although he acknowledged that abrNOC employees helped with Cloudzy\u2019s operations. He didn\u2019t provide details.<\/p>\n

Cloudzy is registered under its previous name, RouterHosting, in Cyprus and the U.S. state of Wyoming, according to corporate records reviewed by Reuters and confirmed by Nozari. He said the company needed U.S. domicile to be able to register internet protocol addresses in America.<\/p>\n

It\u2019s not clear whether Nozari\u2019s registered agent \u2013 CloudPeak Law, a Wyoming law firm based in the small city of Sheridan \u2013 was aware of the allegations against its client.<\/p>\n

A woman who answered at CloudPeak Law\u2019s office confirmed that her firm was RouterHosting\u2019s agent but said that, due to client confidentiality, \u201cthat is the extent of what anyone in our firm is going to be able to tell you.\u201d The firm didn\u2019t respond to a follow-up email.<\/p>\n

Cloudzy\u2019s business model is typical of several small virtual private server providers that rent internet hosting services in exchange for cryptocurrency, no questions-asked, said Adam Meyers, an executive with CrowdStrike.<\/p>\n

\u201cThere\u2019s a whole ecosystem of ne\u2019er-do-well kind of folks who are in this business,\u201d he said.<\/p>\n

Reporting by Christopher Bing; Editing by Cynthia Osterman<\/span><\/p>\n

Our Standards: The Thomson Reuters Trust Principles.<\/a><\/p>\n

\n
\n
<\/p>\n