Three US lawmakers, including Senators Ron Wyden and Sheldon Whitehouse, along with Representative Pat Harrigan, have formally requested that the US Department of Commerce add three Indian IT firms to the Entity List. The request follows allegations that these companies have been involved in paid hacking services and cyber espionage targeting US citizens, businesses, and legal representatives for over 15 years.
The companies named in the petition are BellTroX, CyberRoot, and Sunkissed Organic Farms Pvt. Ltd., the latter of which was formerly known as Appin Technology Pvt. Ltd. If added to the Entity List, these firms would face severe restrictions on accessing American software, cloud infrastructure, and cybersecurity tools. The US Department of Commerce has not yet confirmed whether it will act on the lawmakers' proposal.
Investigations by Reuters, The New Yorker, and the Bureau of Investigative Journalism, as well as security reports from Meta and Google, have previously linked these entities to hacking activities. Reuters reported in 2022 that CyberRoot and BellTroX were frequently hired by Western lawyers and private investigators to target individuals involved in commercial disputes. A 2023 investigation identified Appin as an early industry participant.
The scope of the alleged attacks reportedly includes corporate executives, politicians, military personnel, and high-net-worth individuals. While the companies involved have denied any wrongdoing, the situation remains complex. Reuters is currently involved in ongoing litigation with the Appin Training Center Association in India, which claims that the news agency's reporting has damaged its reputation, a charge Reuters denies.
