US lawmakers seek to blacklist 3 hack-for-hire firms after 15-year campaign

The Entity List is not a typical cybercrime indictment—it is a supply-chain control. If the Commerce Department acts, these alleged hack-for-hire operators would lose access to the US-origin cloud and security tooling that modern intrusion operations often depend on, forcing a shift in adversary infrastructure and complicating attribution.

On September 11, 2026, two Democratic U.S. senators—Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island—and Republican Representative Pat Harrigan formally asked the Commerce Department to place three Indian IT firms on the U.S. Entity List. The companies are BellTroX, CyberRoot, and Sunkissed Organic Farms Pvt Ltd, formerly known as Appin Technology Pvt Ltd, along with their subsidiaries. The lawmakers allege that the firms are tied to hack-for-hire operations and a 'more than fifteen-year' campaign of targeted espionage against U.S. citizens, businesses, and lawyers. A copy of the letter has circulated online, intensifying public scrutiny of a cybermercenary sector that has long operated in regulatory gray zones.

“

The companies are BellTroX, CyberRoot, and Sunkissed Organic Farms Pvt Ltd, formerly known as Appin Technology Pvt Ltd, along with their subsidiaries.

The Entity List is an export-control mechanism maintained by the Bureau of Industry and Security. Entities on the list generally require licenses to receive U.S.-origin items, including software, cloud services, and cybersecurity tools. That makes the request more than symbolic. If Commerce agrees, the three firms and their subsidiaries would face immediate practical restrictions on the infrastructure underpinning surveillance and hacking operations. It would also make U.S. companies and cloud providers legally responsible for screening these customers more carefully.

The allegations are not new. Reuters reported in 2022 that BellTroX and CyberRoot were prominent players in the cybermercenary sector, allegedly hired by Western lawyers and private investigators to spy on rivals during legal and business disputes. A subsequent 2023 Reuters investigation examined Appin Technology, describing it as an early entrant in the hack-for-hire industry that evolved from an educational venture into a global espionage operation allegedly targeting executives, politicians, military officials, and wealthy individuals. The New Yorker and the Bureau have also examined the sector, according to the Free Press Journal report.

The congressional request names lawyers among the alleged victims, which carries distinct reputational and legal implications. Law firms, corporate legal departments, and clients may now need to reassess whether any outsourced IT, e-discovery, or investigative services have indirect ties to the named companies. For U.S. law firms, a vendor with Entity List status would create immediate compliance conflicts: continuing to use or pay such a vendor could expose the firm to export-control liability, and discovery between parties could become entangled with national security concerns.

For India's broader IT services industry, the letter is a reputational risk even though these companies are not representative of large outsourcing firms. The hack-for-hire label could prompt western corporate buyers to tighten vendor questionnaires and demand more granular subcontractor disclosure. The economic impact may be limited to the named entities unless investigations widen, but the reputational spillover for Indian cyber vendors is substantial.