US lawmakers seek sanctions against three Indian hack-for-hire firms

A bipartisan group of US lawmakers is calling for sanctions against three Indian companies accused of carrying out cyberattacks and espionage on behalf of paying clients.

Democratic Senators Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island, together with Republican Congressman Pat Harrigan, have urged the US Department of Commerce to place BellTroX, CyberRoot and Sunkissed Organic Farms, formerly known as Appin, on its “entity list.”

The lawmakers made the request in a letter to US Commerce Secretary Howard Lutnick on Wednesday, alleging that the companies have targeted Americans, including business owners and their lawyers, and used cyber operations to influence ongoing legal disputes.

Placement on the entity list would restrict US companies from doing business with the named firms and could limit their access to critical technologies, including software licences and cloud infrastructure.

According to the lawmakers, the three companies have spent more than a decade conducting cyberattacks and espionage against Americans, with stolen information allegedly used to “manipulate ongoing litigation.”

They further accused the firms of running what they described as an “aggressive censorship campaign” aimed at preventing the public from learning their alleged cyber activities.

“This coordinated effort effectively allows foreign entities to use foreign courts to keep the American public in the dark cyber threats to their own country and undermines the fundamental constitutional rights of U.S. citizens,” the lawmakers said.

The request comes amid increased scrutiny of the global hack-for-hire industry, in which cyber operators are paid to infiltrate the accounts and devices of individuals to obtain information that can be used in legal, political or business disputes.

One of the companies named, Appin, previously obtained a court order in India requiring Reuters to remove its reporting the company while the news organisation appealed the decision. Reuters maintained its reporting, and the order was later lifted, allowing the report to be republished.

The Electronic Frontier Foundation has also previously defended Techdirt and the MuckRock Foundation against legal threats linked to Appin, describing the company’s actions as “a campaign of bullying and censorship seeking to wipe out stories” its alleged involvement in mercenary hacking.

The lawmakers further alleged that the hack-for-hire firms “operated at the behest of the Qatari government” and said one of their targets was a former senior Republican lawmaker.

Appin has previously been linked to Qatar. Earlier reports connected the company to cyberattacks targeting FIFA officials, allegedly as part of efforts by Qatar to protect its plans to host the 2022 World Cup.

The other two companies, BellTroX and CyberRoot, have also been the subject of separate investigations and reporting over alleged espionage activities.

The New Yorker and digital investigative organisation The Citizen Lab have previously reported on activities linked to the two firms.

It remains unclear whether the US Commerce Department will approve the lawmakers’ request. The department did not respond to requests for .

TechCrunch also reported that attempts to obtain from representatives of CyberRoot, BellTroX and Sunkissed Organic Farms were unsuccessful, while a representative of the Qatari government in Washington, D.C., did not respond to questions.