Loading story…
Citizen Lab and NortonLifeLock linked the Dark Basin hacking campaign with high confidence to Delhi-based BellTroX InfoTech Services, exposing a large-scale hack-for-hire operation that targeted thousands of people and organizations across six continents. Reported victims included journalists, advocacy groups, elected officials, senior government personnel, hedge funds, legal and energy firms, and U.S. nonprofits focused on climate change and net neutrality. Investigators said the campaign relied on tailored phishing emails, fake Google News alerts, spoofed Twitter direct messages, and shortened links using Indian-themed words such as Holi and Rangoli to lure targets into credential theft and account compromise.
The reporting placed BellTroX at the center of a broader narrative about an Indian cyber-mercenary ecosystem in which private firms allegedly provide offensive cyber services to commercial and political clients, including interests in the Gulf. Later commentary cited BellTroX alongside other India-linked operators and firms accused of phishing, surveillance, disinformation, and related abuses, arguing that weak oversight and opaque client relationships have allowed hack-for-hire activity to persist. Citizen Lab said it could not conclusively identify Dark Basin's clients, but it notified hundreds of affected individuals and institutions and shared evidence with the U.S. Department of Justice.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab said it shared evidence from its investigation with the U.S. Department of Justice and notified hundreds of affected individuals and institutions. It also said it could not conclusively identify the clients behind the operation.
The reporting disclosed that Dark Basin targeted thousands of individuals and organizations across six continents, including journalists, advocacy groups, government officials, businesses, hedge funds, legal and energy sector entities, and U.S. nonprofits. The operation reportedly used tailored phishing emails, fake Google News alerts, fake Twitter direct messages, and themed URL shorteners.
Citizen Lab reported with high confidence that Delhi-based Belltrox Infotech Services was connected to the Dark Basin hack-for-hire operation. It said the conclusion was supported by work with NortonLifeLock that connected Dark Basin activity to Belltrox employees.
Citizen Lab said it began investigating the Dark Basin operation in 2017 after a journalist reported phishing attempts. The investigation later expanded to a broader hack-for-hire campaign targeting thousands of individuals and institutions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
mahdiabbastech.medium.com
Open sourcemahdiabbastech.medium.com
Open sourcemahdiabbastech.medium.com
Open sourceweb.archive.org
Open sourceredcanary.com
Open sourcecitizenlab.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky identified **DeathStalker**, a long-running hacker-for-hire group that targeted **European law firms** and **fintech companies**, with additional victims in the Middle East including **Israel, Jordan, and Egypt**. Researchers said the group appeared focused on stealing **business and financial intelligence** rather than conducting traditional state espionage, marking it as part of a broader **mercenary APT** market in which private operators sell intrusion capabilities to paying clients. The intrusions typically began with **spear-phishing emails** carrying weaponized `.LNK` shortcut files that launched **PowerShell-based backdoors**. Reporting on mercenary threat actors placed DeathStalker alongside groups such as **Bahamut, DarkBasin, Candiru, and NSO Group**, underscoring how commercial surveillance and hacking services are increasingly used against not only activists and dissidents but also enterprises. Researchers noted that, despite the sophistication associated with mercenary operators, campaigns like DeathStalker’s often still rely on familiar weaknesses such as phishing susceptibility and poor patching.
Aug 15, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026
Suspected former **Black Basta** affiliates have launched a fast-scaling social-engineering campaign against dozens of organizations, targeting more than 100 employees to gain network access for **data theft, ransomware deployment, and extortion**. According to ReliaQuest, the operators use mass email bombing to overwhelm victims and then follow up through **Microsoft Teams** messages or phone calls while impersonating IT help desk staff. The activity has been linked to former Black Basta members or closely aligned actors because the tooling, targeting, and execution closely mirror the group’s historical playbook, even after Black Basta fragmented following the leak of its internal chats. The campaign has increasingly focused on senior leaders and other highly privileged personnel, with executive targeting rising from **59%** in January and February to **77%** in March. Attackers have persuaded victims to install remote monitoring and management tools such as **Supremo Remote Desktop** or to launch **Windows Quick Assist**, sometimes obtaining remote access within minutes before running malicious scripts. Manufacturing and professional services have been hit hardest, with finance, insurance, construction, and technology also affected, underscoring how the operators are moving faster and using more automation to scale intrusions and make early detection more difficult.
Jun 29, 2026