"Halcyon concludes this report by taking a closer look at ISP Cloudzy, and presents evidence that even though Cloudzy purports to be an American-based company, it is assessed to actually be operating out of Tehran, Iran, possibly in violation of U.S. sanctions."

https://www.halcyon.ai/blog/report-ransomware-command-and-control-providers-unmasked-by-halcyon-researchers