Halcyon_Cloudzy_C2P_Report.pdf (5 MB)

Halcyon identified Cloudzy as a command-and-control provider whose RDP VPS services appear to support ransomware operators and multiple state-sponsored APT groups. The DPRK-relevant evidence is limited to Halcyon’s assessment that threat actors tied to North Korea, alongside groups linked to several other governments, have leveraged Cloudzy infrastructure. The report’s main hunting method pivots on RDP hostnames in attacker infrastructure metadata, which Halcyon says can reveal attack infrastructure before ransomware operations launch. Halcyon also assessed that Cloudzy accepts cryptocurrency for anonymous RDP VPS access and that 40% to 60% of observed activity using the provider may be malicious. Defenders are advised to search for the listed hostnames and IOCs to identify possible abuse of this provider in their environments.