A bipartisan group of US lawmakers has urged the Trump administration to blacklist three Indian companies over allegations that they have been involved in “hack-for-hire” operations targeting American citizens, businesses and lawyers.In a letter to US Commerce Secretary Howard Lutnick, Democratic Senators Ron Wyden and Sheldon Whitehouse and Republican Representative Pat Harrigan asked the Commerce Department to add BellTroX, CyberRoot and Sunkissed Organic Farms Pvt Ltd, formerly known as Appin Technology Pvt Ltd, along with its subsidiaries, to the US Entity List.The lawmakers alleged that the companies had been linked to more than 15 years of targeted espionage operations against Americans and accused them of using hacking services to obtain sensitive information.If placed on the Entity List, the companies could face restrictions on accessing US technology, including software, cloud infrastructure and cybersecurity tools. The move would require US companies to obtain government licences before exporting certain controlled items or technologies to them.
What are these three Indian firms?
The three companies named in the letter have previously been linked by cybersecurity researchers and media investigations to the global hack-for-hire industry.BellTroX and CyberRoot have been described as prominent players in the cyber-mercenary sector. Investigations have alleged that such groups were hired by private investigators, lawyers or other clients to gain access to targets’ emails and other information.Sunkissed Organic Farms is the present name of the company formerly known as Appin Technology. Appin began as a technology training company before becoming the subject of investigations into alleged cyber-espionage activities.A Reuters investigation in 2023 described Appin as a major player in the global hack-for-hire industry and reported that hackers linked to the company had targeted executives, politicians, military officials and wealthy individuals.The companies and executives associated with them have denied wrongdoing.
The letter by US lawmakers to Howard Lutnick
Lawmakers cite attacks on US targets
The lawmakers said in their letter that the firms had been involved in cyber operations against US citizens and businesses, including lawyers representing them.Their request follows years of reporting and investigations into the hack-for-hire industry. Cybersecurity companies including Google and Meta have also published reports identifying hacking activity associated with the firms.The lawmakers said the US government should use its economic and technological leverage to prevent American technology from being used by companies accused of conducting such operations.“Hack-for-hire” operations typically involve cyber groups being paid by clients to target specific individuals or organisations. The targets can include business rivals, lawyers, journalists, activists and political figures.The industry has attracted scrutiny because it can allow wealthy individuals or organisations to obtain sophisticated cyber capabilities without directly operating hacking infrastructure themselves.
What happens if US sanctions are imposed?
Being added to the Commerce Department’s Entity List would not automatically mean the companies are banned from operating globally. However, it would significantly restrict their ability to obtain US-origin goods, software and technology.US companies generally need a licence to export controlled items to entities on the list, and such licences can face a presumption of denial depending on the circumstances.The lawmakers are therefore seeking to make it harder for the three Indian firms to access the technology and infrastructure that could support cyber operations.The companies named in the letter have not been found guilty by the US government merely because lawmakers have requested their addition to the Entity List. The Commerce Department will have to consider the allegations and determine whether action is warranted.
