Appin

Appin was a New Delhi-based Indian hack-for-hire operation that Reuters described as pioneering India’s cyber-mercenary industry and spawning copycat firms. The company was run by brothers Rajat Khare and Anuj Khare and began as a technology training startup, but reporting cited in the content says it also operated a customer-facing intrusion service, including a portal dubbed "My Commando," through which clients could request hacks, track progress, and retrieve stolen data. Reuters reviewed Appin materials advertising capabilities including cyber spying, email monitoring, cyber warfare, and social engineering, and reported that Appin created malicious code and websites to support operations. The content states Appin targeted political leaders, executives, attorneys, journalists, activists, and other victims globally, and that Google observed Appin-linked actors targeting tens of thousands of Google email accounts over the last decade. Reuters reviewed logs showing about 70 clients, largely private investigators from the U.S., Britain, Switzerland, and other countries, seeking hacks of hundreds of targets. Reported victims and targeting included Chuck Randall of the Shinnecock Nation, Aegis-related targeting, and broader industrial espionage activity. The content also states that previously unconfirmed historical activity has since been attributed to Appin, including Operation Hangover and targeting involving human-rights-related malware with custom Mac malware. The content links Appin to credential theft and account compromise operations and describes broader hack-for-hire tradecraft consistent with phishing-based intrusions and data exfiltration for paying clients. Reuters also reported that Appin initially supported Indian government intelligence work through Appin Software Security Pvt. Ltd., also referred to as the Appin Security Group, and worked with India’s Research & Analysis Wing and Intelligence Bureau according to former insiders cited there. Reported activity included targeting Pakistani officials and using fake dating websites to lure Pakistani military officers. An Appin memo also described "Operation Rainbow" as penetrating Chinese military computers, although Reuters could not independently confirm that intrusion. The content further states that researchers from SentinelOne, Mandiant, and Symantec independently matched Appin-linked infrastructure to publicly known cyberespionage campaigns, and that Oslo-based Norman Shark publicly linked the 2013 Telenor intrusion to Appin. Reuters reported investigations in the U.S., Switzerland, Norway, and the Dominican Republic into Appin-linked intrusions, but said these largely ended without major enforcement outcomes against Appin leadership. The content also notes that Appin’s web presence faded after 2013 and that associated entities were rebranded, while alumni and successor or copycat firms continued similar activity. Google TAG said that since 2012 it has tracked an interwoven set of Indian hack-for-hire actors, many of whom previously worked for Appin and BellTroX, and linked former employees of Appin and BellTroX to Rebsec. Known aliases directly mentioned in the content are Appin and Appin Security Group.