US lawmakers seek Entity List action against alleged hack-for-hire firms

Three US lawmakers have asked the Commerce Department to place several India-based companies on a federal export-control list over alleged hack-for-hire operations against US targets. The bipartisan, bicameral request, sent on 9 September 2026, had not produced a publicly identified designation or other listing action by the evidence cutoff.

Senators Ron Wyden and Sheldon Whitehouse and Representative Pat Harrigan addressed the letter to Commerce Secretary Howard Lutnick. They asked the department’s Bureau of Industry and Security, known as BIS, to add the companies to its Entity List.

The requested entries cover Sunkissed Organic Farms Pvt. Ltd., which the lawmakers describe as formerly Appin Technology, and its named subsidiaries Adaptive Control Security Global Corporate and ABP Holdings. The letter also names BellTroX Pvt. Ltd. and CyberRoot Pvt. Ltd.

The lawmakers allege that the three company groups spent more than 15 years conducting targeted espionage against US citizens, businesses and their lawyers, and that they stole data from thousands of Americans and US organisations. The reviewed record supports parts of that account, most clearly through historical technical findings on BellTroX. It does not independently establish the collective data-theft claim across all three companies.

Entity List request is not a blanket ban

An addition to the Entity List would be an export-control measure, not a universal ban on dealings with the listed organisation. BIS guidance says each entry specifies licensing requirements and review policies for covered exports, reexports and transfers within another country.

US companies could therefore still have dealings that fall outside those requirements, or potentially conduct covered dealings subject to the applicable licence rules. The process is also separate from Treasury sanctions and does not itself amount to an automatic asset freeze. Any practical effect would depend on a later BIS decision and the conditions attached to an entry.

The congressional letter alone creates no export-control restriction. By the evidence cutoff on 11 September 2026, no public Commerce or BIS action naming Sunkissed Organic Farms, Adaptive Control Security Global Corporate, ABP Holdings, BellTroX or CyberRoot had been identified.

BellTroX evidence stands apart

The strongest independent technical evidence concerns BellTroX. On 9 June 2020, Citizen Lab published an investigation into an operation it called Dark Basin and assessed with high confidence that the activity was linked to BellTroX.

Citizen Lab documented targeted credential phishing and social engineering intended to obtain webmail credentials. The campaigns used impersonation and credential-harvesting infrastructure rather than an identified software vulnerability. There is no CVE, affected software version, patch or proof-of-concept exploit associated with this story.

The investigation found that Dark Basin targeted thousands of people and hundreds of institutions across six continents. Its targets included government officials, journalists, advocates, legal professionals and financial organisations. Citizen Lab also found that stolen internal email was reused in one campaign cluster, supporting the conclusion that attackers successfully accessed one or more email accounts in that BellTroX-linked activity.

Those findings do not independently establish the letter’s wider claims against every named company. Equivalent primary technical attribution was not available in the reviewed record for CyberRoot or Sunkissed Organic Farms. The evidence also does not establish that all three companies used the same credential-phishing methods or operated together.

The lawmakers allege that the companies targeted private-equity firms, pharmaceutical businesses and more than 1,000 attorneys at major US law firms in an effort to manipulate ongoing litigation. The available record does not independently establish the number of successful compromises, what information was accessed or removed across those campaigns, or whether the alleged activity affected litigation outcomes.

The letter also alleges that the groups acted for the Qatari government, targeting opponents of Qatar’s World Cup bid and the family of a former Republican chairman of the House Permanent Select Committee on Intelligence. Those sponsorship and political-targeting claims remain unverified. In a separate US nonprofit campaign cluster, Citizen Lab said it lacked strong evidence identifying the client that commissioned the activity. That finding neither confirms nor contradicts the letter’s allegations about other clusters.

Cyber reporting faces a parallel legal risk

The dispute extends beyond the alleged hacking. TechCrunch reported that a Reuters investigation was removed under an Indian court order. In their press material, the lawmakers also cite litigation involving media and technology companies and allege that executives associated with one hack-for-hire group used court action as part of a campaign to suppress reporting.

The court action and litigation create a documented publication and press-freedom concern, but the claimed motive remains an assessment rather than a universal judicial finding. The reviewed record does not establish that courts determined every cited case was intended to conceal hacking activity. The current procedural position of the various proceedings also remains unresolved in the available evidence.

Current cyber activity is another open question. The lawmakers say the accused operators continue to act with impunity, but their September 2026 letter does not provide dated campaign indicators, victim notifications or other technical evidence confirming that all three companies were running active operations at that time.

Direct Australian relevance is limited because the reviewed sources identify no Australian victim, company or government action. The historical targeting nevertheless illustrates a transnational risk for Australian law firms, businesses, journalists and civil-society organisations exposed to focused credential phishing and commercial espionage.

The next material policy step rests with Commerce and BIS. Any restrictions would require a formal decision, with their reach determined by the entities named, the covered items and the licensing policy attached to each entry.

Credential-phishing analysis starts with the attempted route to webmail credentials: impersonation and credential harvesting differ from exploitation of a software flaw. Develop the surrounding fundamentals with The Hack Academy’s online cybersecurity training programme, which offers self-paced learning and practical exercises alongside theory, with cybersecurity fundamentals and internet vulnerabilities among its listed subjects.