Loading story…
SentinelOne said it temporarily removed its research article "Elephant Hunting | Inside an Indian Hack-For-Hire Group" after receiving notice of a pending court order. The company identified the report as research by Tom Hegel and said the takedown was made out of an abundance of caution while related legal proceedings continue.
The company said it stands by its findings and maintained that the report was based on many hours of research, verified sources, and transparent presentation of supporting evidence. SentinelOne added that it is monitoring the legal action tied to the article, signaling that the dispute now extends beyond the underlying cyber-espionage allegations to a legal challenge over publication of the research.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SentinelOne said it temporarily removed the article due to a pending court order, acting out of an abundance of caution. The company also stated that it stood by its findings and was monitoring the related legal action.
SentinelOne published the article "Elephant Hunting | Inside an Indian Hack-For-Hire Group," authored by Tom Hegel. The report presented findings that the company said were based on extensive research and verified sources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Lawyers and executives linked to **Appin Technology**, its cofounder **Rajat Khare**, and the **Association of Appin Training Centers** have been accused of using lawsuits and legal threats to suppress reporting that Appin operated as a hack-for-hire outfit. The pressure campaign followed a Reuters investigation alleging that Appin spied on opposition leaders, corporate rivals, lawyers, and wealthy individuals for clients around the world; an interim Delhi court order then required Reuters to remove that article, and Reuters has challenged the order in India. The takedown effort expanded to other publishers and platforms, prompting a public pushback from **Techdirt**, **MuckRock**, and the **Electronic Frontier Foundation**. They argue the Indian injunction applies only to Reuters and Google, does not create a global removal obligation, and would be difficult to enforce in the United States under the **First Amendment** and the **SPEECH Act**. The dispute has instead amplified scrutiny of the original allegations, with republication efforts and wider coverage turning the attempted suppression into a broader anti-censorship fight.
Jun 29, 2026
Huntress said internal investigations and consultations with law enforcement found no evidence supporting allegations by a former employee that the company had an insider threat involving illegal conduct, unauthorized access, customer or partner data disclosure, source code exposure, or an insider allegedly "caught by the FBI." The company said it re-opened and continued reviewing the matter after the former employee resurfaced concerns and sent additional communications. The company acknowledged that a current teammate told a threat actor that law enforcement had contacted them about that actor, calling the disclosure poor judgment but not illegal. Huntress said it immediately investigated the incident by reviewing systems and communications, interviewing staff, and consulting law enforcement, then imposed administrative actions and coaching and strengthened internal researcher policies.
Jun 30, 2026
SentinelOne reported that reexamining older cyber intrusions with modern tooling is yielding new intelligence that can improve present-day defense. The research says retrospective analysis can expand indicators of compromise, reveal broader victimology, strengthen attribution, and surface infrastructure or malware relationships that were missed during the original investigations. Examples cited include new insights into the **Sandman** cluster, **ModifiedElephant** activity targeting individuals in India, Chinese-attributed operations in Africa linked to **Backdoor Diplomacy** and **BRONZE STARLIGHT**, and the **Appin** hack-for-hire operation in India. SentinelOne said improved **YARA** techniques and access to large malware repositories such as **Stairwell** and **VirusTotal** are helping analysts extract fresh findings from historical datasets, malware samples, and legacy infrastructure.
Jun 29, 2026