Ghost Clown

Ghost Clown is a malware entity that has been implicated in the deployment of malicious software, specifically ransomware strains like BlackBasta and Conti. This previously undetected ransomware group, along with another affiliate named Space Kook, were identified by anti-ransomware company Halcyon. The discovery was part of an investigation into Cloudzy, a command-and-control provider (C2P) believed to be operating out of Tehran, Iran, potentially violating U.S. sanctions. Cloudzy, although incorporated in the United States, is suspected of providing services to these ransomware groups. The Halcyon report highlighted that Cloudzy might be unknowingly facilitating attack campaigns by offering its platform to advanced threat actors. The report estimated that between 40% - 60% of the total servers hosted by Cloudzy appear to be directly supporting potentially malicious activity. This includes renting services to Ghost Clown and Space Kook, both deploying different ransomware strains. Ghost Clown primarily uses BlackBasta, while Space Kook relies on Royal ransomware. These revelations underscore the complex ecosystem of cyber threats, where ostensibly legitimate businesses can become unwitting accomplices to cybercriminal activities. The identification of Ghost Clown and Space Kook as new ransomware affiliates contributes to the ongoing efforts to understand and combat the evolving landscape of cyber threats. The findings also highlight the need for robust cybersecurity measures and constant vigilance against potential vulnerabilities and attacks.