Loading story…
A bipartisan group of U.S. lawmakers has asked the Department of Commerce to add Indian hack-for-hire companies BellTroX, CyberRoot, and Sunkissed Organic Farms—formerly Appin—to the U.S. Entity List. The request alleges the firms spent more than a decade conducting cyberattacks and espionage against Americans, including business owners and lawyers, to obtain material intended to influence active litigation; it also alleges theft of data from thousands of U.S. victims and activity on behalf of the Qatari government.
The allegations build on reporting that mercenary hackers have been used to shape litigation disputes, as well as legal campaigns aimed at suppressing coverage of alleged cyber-mercenary activity through foreign-court actions. Entity List designation would restrict the firms' access to U.S. technology and exports, subject to licensing requirements. The Commerce Department had not said whether it would impose the requested restrictions.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Senators Ron Wyden and Sheldon Whitehouse and Representative Pat Harrigan sent Commerce Secretary Howard Lutnick a letter urging the Department of Commerce to add BellTroX, CyberRoot, and Sunkissed Organic Farms (formerly Appin) to the U.S. Entity List. The department had not announced a decision at the time of reporting.
The Electronic Frontier Foundation defended Techdirt and the MuckRock Foundation against legal threats that it characterized as part of Appin's effort to suppress reporting on alleged mercenary hacking.
Appin obtained an Indian court order that temporarily required Reuters to remove reporting about the company. The order was later lifted and Reuters republished its report.
Citizen Lab published research uncovering Dark Basin, which it characterized as a massive hack-for-hire operation. This constitutes a new technical disclosure not represented in the existing timeline.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
techdirt.com
Open sourcecitizenlab.ca
Open sourcecyberscoop.com
Open sourcenextgov.com
Open sourcetechcrunch.com
Open sourcewyden.senate.gov
Open sourceeff.org
Open sourcereuters.com
Open sourcecitizenlab.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. State Department has imposed visa restrictions on people responsible for or complicit in foreign cybercrime and cyber-enabled crime, including **cyber scammers**, **sextortionists**, and in some cases their immediate family members. Secretary of State Marco Rubio said the policy is intended to deter overseas criminal enterprises that target Americans through phishing, fraud, impersonation, and related schemes, with particular attention on industrial-scale scam operations in Southeast Asia. U.S. officials said many of these networks are tied to transnational criminal groups, including Chinese-linked organizations, and are often associated with **human trafficking** and **money laundering**. The move advances a broader U.S. campaign launched under a March executive order directing a whole-of-government response to ransomware, phishing, sextortion, and other predatory cyber-enabled crimes. That order called for stronger law enforcement, diplomatic pressure, technical disruption, and possible offensive actions against foreign criminal organizations, alongside a federal operational cell to coordinate activity. The visa restrictions also follow other enforcement steps, including a June Justice Department seizure of infrastructure linked to subsidiaries of Cambodia-based **Huione Group**, which has been associated with a major marketplace used for cyber scams; U.S. estimates put losses from such scams at **$10 billion** in 2024.
Jul 24, 2026
A new bill has been introduced in the U.S. House of Representatives that seeks to establish government-wide processes for attributing and sanctioning foreign hackers responsible for major cyberattacks against the United States. The proposed legislation, known as the Cyber Deterrence and Response Act, would empower the executive branch to formally designate certain foreign entities as 'critical cyber threat actors' and impose a range of sanctions, including asset blocking, financial restrictions, export controls, procurement prohibitions, visa bans, and suspension of assistance. The bill also outlines a framework for attribution, leveraging input from federal cyber agencies and private threat intelligence firms, and is intended to strengthen the government's ability to hold malicious actors accountable and protect critical infrastructure. The legislative push comes amid growing concern in Congress over the increasing sophistication and frequency of cyberattacks targeting U.S. interests, as well as perceived gaps in the nation's ability to deter such threats. The move follows high-profile incidents such as the Salt Typhoon cyberespionage campaign and reflects a broader effort to enhance national cyber defense and response capabilities. Congressional leaders and the Trump administration have emphasized the need for real-time detection and deterrence, with the new bill positioned as a key component of the administration's evolving cyber strategy.
Jun 29, 2026
Citizen Lab and NortonLifeLock linked the **Dark Basin** hacking campaign with high confidence to Delhi-based **BellTroX InfoTech Services**, exposing a large-scale hack-for-hire operation that targeted thousands of people and organizations across six continents. Reported victims included journalists, advocacy groups, elected officials, senior government personnel, hedge funds, legal and energy firms, and U.S. nonprofits focused on climate change and net neutrality. Investigators said the campaign relied on tailored phishing emails, fake Google News alerts, spoofed Twitter direct messages, and shortened links using Indian-themed words such as *Holi* and *Rangoli* to lure targets into credential theft and account compromise. The reporting placed BellTroX at the center of a broader narrative about an Indian cyber-mercenary ecosystem in which private firms allegedly provide offensive cyber services to commercial and political clients, including interests in the Gulf. Later commentary cited BellTroX alongside other India-linked operators and firms accused of phishing, surveillance, disinformation, and related abuses, arguing that weak oversight and opaque client relationships have allowed hack-for-hire activity to persist. Citizen Lab said it could not conclusively identify Dark Basin's clients, but it notified hundreds of affected individuals and institutions and shared evidence with the **U.S. Department of Justice**.
Jul 12, 2026