Differentiating between normal and attack clusters
First of all please ignore my previous answer. I did not understand you properly.

The difficulty of the your problem goes back to the distribution of normal points in train and test. The distribution of new normal points are so different than what your model can learn from only green points (training set) so I assume any model will have a relatively poor performance on it. Anyways, having a look at scikit-learn documentation is good if you did not. 

About Clustering as you asked I have an idea. An active are in Graph Analysis and Network Science is Community Detection (which is simply the clustering of graph nodes). The idea is that, assume all your points in this figure are nodes of a graph and based on their Euclidean distance in PC space, you put an edge between them (either binary or weighted). Then you can use Modularity-based algorithms to find dense subgraphs. I assume if you apply it to your data it will work. Also a similar idea is Spectral Clustering which internally uses the idea of graph partitioning. 

According to the density of clusters, I would also propose to use density-based clustering approaches. They might be able to distinguish between those overlapping clusters "a little bit" (e.g. this paper). This paper has an approach to find the peaks of densities. Sounds compatible with your data.
Please note that those overlapping clusters are anyways difficult to distinguish.

My apologies for the first misunderstanding and hope it helps.

Good Luck!