Space Kook

Space Kook is a threat actor, or malicious entity, identified in the cybersecurity industry for its involvement in ransomware operations. Named after a villain from Scooby Doo, Space Kook was first linked to malicious activities by Halcyon's analysis, which showed connections to an initial access broker named Exotic Lily, as reported by Google’s Threat Analysis Group in March 2022. The investigation further revealed that Space Kook relies on Cobalt Strike, a legitimate penetration testing tool often misused by attackers, and deploys Quantum Locker and Royal ransomware strains. Cloudzy, a server hosting service, has allegedly provided its services to several infamous ransomware gangs including Ghost Clown and Space Kook. According to estimates by researchers, between 40% - 60% of the total servers hosted by Cloudzy appear to be directly supporting potentially malicious activity. This includes renting services to previously unreported ransomware groups like Space Kook, which uses the Royal ransomware strain. In addition to Space Kook, the Halcyon report also identifies another ransomware affiliate, Ghost Clown, which uses the BlackBasta ransomware strain. Both Space Kook and Ghost Clown were found to be part of a larger network of ransomware affiliates leveraging Cloudzy's services. These findings underscore the need for increased vigilance and improved security measures within the digital landscape to counteract the growing threat posed by these malicious actors.