INDIA’S CYBER HITMEN: Inside ‘Hack-for-Hire’ Firms Washington Sought to Blacklist

Ayush Joshi with Abir Dasgupta and Paranjoy Guha Thakurta
For years, it was common knowledge that particular organisations in the country had made it their lucrative business to teach and train people to become computer hackers who were not of the ‘ethical’ variety. Their activities are now out in the open because of actions by lawmakers in the United States. This exclusive report has been in the making for several years.
On September 9, 2026, a bipartisan coalition of United States lawmakers petitioned the US Department of Commerce to use economic statecraft against some of the most prominent actors in the global hack-for-hire industry. Democratic Senators Ron Wyden and Sheldon Whitehouse, alongside Republican Representative Pat Harrigan, sent a formal letter to Commerce Secretary Howard Lutnick. The lawmakers urged the Bureau of Industry and Security to add three Indian firms and their subsidiaries to the Entity List, essentially blacklisting them. The targeted organisations are BellTrox, CyberRoot and Sunkissed Organic Farms, formerly known as Appin Technology.
The Entity List is an export-control mechanism governed by Export Administration Regulations, which restrict trade with foreign entities deemed a threat to US national security. If adopted, this designation would sever these organisations from the American technological ecosystem. US corporations would be prohibited from exporting software and technology to the listed entities without a specialised government licence. These licences operate under a strict “presumption of denial” policy.
The operational impact on hack-for-hire firms could be severe because these organisations rely on US-based cloud infrastructure like Amazon Web Services or Google Cloud to host spoofed login portals. They rely on American cybersecurity tools, open-source software repositories and Western domain-registration services.
The Geopolitical Backdrop
The Trump administration’s foreign policy during this period has involved economic protectionism and the use of tariffs to enforce geopolitical objectives. The request to sanction Indian technology firms occurs against a backdrop of increasing friction between Washington and New Delhi on several contentious issues regarding trade, immigration and energy security.
In August 2026, the US Senate passed the Lindsey O Graham Sanctioning Russia and Iran Act of 2026, which provided the Trump administration with expanded powers to impose tariffs of up to 100 per cent on goods from countries making significant purchases of Russian petroleum. Following global shifts in energy markets, India’s imports of crude oil from Russia as a proportion of the country’s total imports rose from over a third in April 2026 to over a half in July, mirroring the trend in 2025 before Washington mounted pressure on New Delhi for providing Moscow US dollars to fund its war against Ukraine.
The US administration simultaneously extended restrictive immigration policies impacting the Indian information technology sector. In September 2026, the White House extended Proclamation 10973. This kept restrictions on the H-1B visa programme until September 21, 2027. The policy mandated a $100,000 payment requirement for certain H-1B workers seeking entry into the United States. The White House reported a 92 per cent decline in combined H-1B registrations by large firms staffing personnel engaged in the IT (information technology) sector.
In this atmosphere of protectionism, the revelation that Indian cyber-mercenary firms spent a decade hacking American targets may have provided political capital for US lawmakers seeking to weaponise the Commerce Department’s regulatory apparatus.
Roots of the Hack-for-Hire Syndicate
Long before they drew the attention of US senators in 2026, these entities were described as operating under the guise of computer education institutes. While providing training in cybersecurity and computer applications, these companies in different parts of the country also provided hacking services to clients located across the globe.
In 2022, The Times newspaper of London, United Kingdom, published a report exposing a gang of computer hackers operating from Gurugram in Haryana. This group targeted high-profile individuals and organisations. The targets included the international soccer association FIFA (Fédération Internationale de Football Association), the upmarket car maker BMW, several politicians, activists and journalists from the UK, Qatar and Pakistan. The Times report followed an earlier investigation by Reuters, which exposed the hack-for-hire industry. The investigation was based on US court documents and suggested potential links between specific hackers and Indian government intelligence agencies.
A group of hackers were reportedly operating under the name “Whiteint” from a fourth-floor office in an apartment complex in Gurugram. This organised gang, allegedly led by Aditya Jain, a former employee of UK-based accounting firm Deloitte, had been active for over seven years. Jain was previously implicated in a computer piracy case in North Carolina, US, in 2021.
The targets of this gang included the political editor of the British Broadcasting Corporation (BBC), the President of Switzerland and high-ranking military officials in Pakistan. Executives associated with FIFA, diplomats and politicians were also targeted. The hackers employed tactics such as gaining control over email accounts and surreptitiously accessing computers through cameras and microphones to eavesdrop on private conversations.
In early 2022, journalists from The Times travelled to India posing as corporate-espionage investigators seeking to hire hackers. They encountered several individuals suspected of involvement in cybercrime, and Aditya Jain was among them. He shared messages indicating his successful acquisition of email data from high-profile individuals associated with FIFA in the UK, supposedly done at the request of a client sponsored by a Gulf country.
While the London Metropolitan Police had received a tip-off regarding the hacking operation, it did not take action. The Times discovered that a former Metropolitan Police officer named Nick Del Rosso had provided the Gurugram gang with a list of at least 40 targets for cyber-attacks.
IntelligenceOnline, a Paris-based website and magazine, disclosed that Jain had also been involved in NETRA (NEtworking TRaffic Analysis), a surveillance software network developed by the Defence Research and Development Organisation (DRDO) within India’s Ministry of Defence. The Intelligence Bureau (IB) in the Ministry of Home Affairs has reportedly utilised NETRA, as has the Research and Analysis Wing (R&AW) that works under the Cabinet Secretariat.
This was the second detected instance of Indian cybercriminals participating in hacking operations in 2022. Earlier, in July 2022, a report revealed that Indian cyber mercenaries had breached the email accounts of litigants and lawyers across the globe, likely acting on behalf of opposing legal counsel. The report detailed no fewer than 35 instances dating back to 2013 in which Indian hackers sought confidential documents through credential theft and phishing schemes.
A prominent example occurred in 2012 during litigation between Visalus and Ocean Avenue, two US-based nutritional supplement firms. Visalus alleged that former distributors breached non-compete clauses to join Ocean Avenue. Investigations revealed that Visalus engaged private investigators, who subsequently contracted hackers to compromise Ocean Avenue’s communications network. Sumit Gupta, who also operated under the alias Sumit Vishnoi, a Delhi-based hacker, was identified as an alleged participant. Although charged with cybercrime offences in a California court, Gupta was never taken into custody.
From Classrooms to Corporate Espionage
Before launching his own company, BellTrox Infotech Services Private Limited, Gupta gained experience at Appin Securities. As a subsidiary of Appin Technology Private Limited, this firm was primarily recognised for its cybersecurity education and training programmes.
Legal filings reveal that CyberRoot Risk Advisory Private Limited, owned by Vibhor Sharma, Vijay Singh Bisht and Chiranshu Ahuja, also engaged in email-hacking operations alongside BellTrox. Operating out of Gurugram during the incident, both CyberRoot and BellTrox are thought to have shared physical facilities and infrastructure to execute cyber-attacks.
Sumit Gupta and Aditya Jain followed similar career trajectories, both having trained and worked at Appin Securities Private before creating their own independent firms in 2013. Reports from IntelligenceOnline allege that Appin Securities grew into a key partner for legal teams, lobbyists and private investigation agencies requiring hacking capabilities. The company also reportedly maintained partnerships with Indian intelligence bodies, allowing it to conduct its profitable activities as long as it took action against targets designated by the state authorities.
Media reports often describe Appin as the birthplace of India’s cyber-mercenary sector. Established in New Delhi in 2003 by brothers Anuj Khare and Rajat Khare, the firm began as a modest educational initiative offering coursework in basic cybersecurity, robotics and artificial intelligence. Beneath this academic front, however, according to media investigations, allegedly lay an expanding digital espionage operation.
Rajat Khare and his legal counsel have consistently denied any association with illegal hacking, stating the accusations are false.
A 2023 Reuters investigation alleged that, facing hurdles in digital espionage during the early 2000s, Indian officials turned to Appin, which addressed the gap by organising a covert hacking unit under its division, Appin Software Security Private Limited. Operating from military safe houses under strict non-disclosure agreements, these operatives initially carried out state-directed missions, including targeting email accounts belonging to Khalistani separatists.
The same investigation alleged Appin subsequently expanded its support to R&AW and IB, tracking the activities of Pakistani government officials and military officers through malware deployment and fraudulent dating platforms. These activities drew surveillance from the US National Security Agency as early as 2009.
Several media reports have claimed that a strategic pivot occurred when Appin’s management identified the commercial potential of its hacking capabilities. The firm allegedly began secretly selling intelligence gathered for one Indian agency to competing domestic entities, prompting multiple state agencies to cancel their contracts upon discovering these unethical practices. According to these media investigations, freed from government exclusivity, Appin entered the commercial market, providing social engineering, email monitoring and digital surveillance to high-net-worth individuals, prominent law firms and private investigators across the world. By 2010, internal company presentations reportedly highlighted its capacity to “compromise” businesspersons for rival corporate clients.
On the so-called education front, Appin Securities sold franchise rights for amounts between Rs 5 lakh and Rs 10 lakh. Narendra Singh, owner of an Appin Technology Lab franchise in Haldwani, Uttarakhand, which shut down in 2020, recalled his experience during a phone interview with Ayush Joshi, the lead writer of this article. Singh alleged that Appin “failed to deliver on its promises regarding teacher training and student job placement.” According to Singh, his franchise charged students Rs 1,000 per month for basic computer education and training classes; advanced six-month diploma programmes in, among other things, certified ethical hacking, cost up to Rs 45,000 per student.
Following an exposure by the cybersecurity firm Norman Shark in 2013 regarding cyber-attacks on foreign government portals, Appin Technology Labs shut down its cybersecurity division. Despite denying responsibility and citing India’s armed forces and the Ministry of Defence as its clients, the company ceased operations. As legal scrutiny and international media coverage intensified over time, Appin systematically dismantled its original corporate framework, rebranding through several iterations before adopting the name Sunkissed Organic Farms.
Several former Appin employees subsequently established their own firms, including Ducara, which counted multiple Indian police departments among its clients. Media reports pointed to existing ties between Ducara and Appin personnel.
The BellTrox Connection
Citizen Lab, one of the world’s leading digital forensics research organisation based at Canada’s University of Toronto’s Munk School of Global Affairs, focusses its investigations on information controls that affect human rights, digital security and internet openness. Following a multi-year inquiry into large-scale cyber operations, Citizen Lab assigned the moniker DarkBasin to a hacker collective linked to BellTrox. The investigation exposed an extensive global network of entities deployed by BellTrox to target hundreds of organisations and thousands of individuals across six continents over a period seven years.
During its years as an active commercial entity, BellTrox overtly marketed services like online stalking through its website. While its official site has since gone offline, evidence of its commercial history remains traceable across digital platforms, including a dedicated Facebook group and web property tied to DarkBasin.
The involvement of more associates of BellTrox was highlighted in a June 2022 report from Google’s Threat Analysis Group, which reported links among former staffers of Appin and BellTrox to Rebsec Solutions. Operating a website that explicitly offered corporate espionage services, Rebsec was part of a bigger ecosystem that identified India, Russia and the United Arab Emirates as primary focal points for hack-for-hire activity.
Despite the ongoing international legal scrutiny, key figures and corporate entities tied to these networks continue to function with relative impunity inside India. Citizen Lab detailed BellTrox’s illegal hacking and cyberattacks phishing campaigns in a 2020 threat assessment, which was complemented by Meta’s 2021 ‘Surveillance-For-Hire’ report documenting similar activities. Continuing its enforcement efforts, Meta deactivated 40 social media accounts connected to CyberRoot in December 2022.
Notably, BellTrox maintained an office in Amritsar, Punjab, sharing an identical physical address with Rebsec Solutions. Here’s the personal experience of the lead writer of this article (Ayush) from a few years ago.
Inside an Amritsar Training Firm
Upon arriving at the Ranjit Avenue B-Block premises of Rebsec Solutions in Amritsar, Punjab, the housekeeper, who claimed the entity had shuttered operations, met an initial inquiry with reluctance. However, after expressing interest in their cybersecurity curriculum, the author of this report was instructed to return a week later.
Revisiting the facility shared by Rebsec Solutions and BellTrox on January 9, 2023, and after exchanging contact details, company proprietor Vishwadeep Singh agreed to be interviewed through he refused to be photographed.
Singh denied all allegations of illegal conduct, maintaining that his business operated strictly within legal bounds. He dismissed the reference to cyber espionage in his promotional literature as mere marketing exaggeration, arguing that IT firms routinely deploy sensationalist phrasing to attract prospective clients and students.
Tracing his career, Singh explained that he launched Rebsec Solutions in 2013 after gaining experience at Appin Securities, where he had met Sumit Gupta. Following Appin’s closure, Singh briefly joined BellTrox before leaving the firm due to “operational disagreements.” He attributed Rebsec’s inclusion in Google’s threat analysis assessments to these historic organisational ties rather than active malicious collaboration.
Following Rebsec’s separation from BellTrox, Singh recalled being contacted by unknown entities from Dubai and the UK soliciting illicit hacking operations, both of which he claimed to have firmly turned down. Singh maintained that Rebsec Solutions operated primarily as an educational institute and web-development provider.
As the interview progressed, Singh told the lead author of this article that he had provided technical assistance to local law enforcement during cybercrime investigations. He refused to specify details. He said that his firm did not always receive payment for its services, adding that these agencies would recommend his firm’s training courses during seminars at local colleges and universities.
Singh said he feared for his personal safety fears after his identity was revealed to a person who was under investigation. He wondered whether other entities were “misusing” the Rebsec brand to market illicit services. When asked whether his former students had weaponised their training as ethical hackers for illegal services, he cryptically said that ‘’a sword-maker in Amritsar is not responsible if the sword is used as a weapon against someone.”
The Mechanics of Phishing
Phishing is a type of cyberattack where criminals pretend to be trusted sources to trick people into sharing private information or downloading malware, often conning them into parting their money.
A strategic insight into the operations of Appin, BellTrox and CyberRoot is that their success did not rely on highly sophisticated software exploits. Their operational architecture relied on industrial-scale credential harvesting and contextualised spear-phishing.
Exploiting human psychology remains more cost-effective and reliable than developing complex software vulnerabilities. Hackers set up production lines for credential harvesting. The core mechanism involved sending tens of thousands of malicious emails designed to mimic legitimate communications.
Unlike bulk spam, the phishing emails were highly targeted. Operators researched their victims extensively. They crafted lures impersonating colleagues, supervisors or family members. Emails were often pinned to live legal cases, active corporate deals or specific personal interests researched via social media. In 2021, Meta disabled approximately 400 Facebook accounts linked to BellTrox, used primarily for reconnaissance. The operators impersonated politicians or activists to build rapport and harvest target email addresses before launching an attack.
Victims who clicked on malicious links were directed to cloned login pages imitating platforms like Gmail, Yahoo, Facebook and Dropbox. These pages were dynamically personalised and displayed the victim’s own name and email address to increase the illusion of legitimacy.
To evade spam filters and track engagement, the hackers utilised custom URL (uniform resource locator) shorteners built on the open-source Phurl software package. The target email address was embedded directly into each unique link. This allowed the attackers to record exactly who clicked the link, at what time and from which IP address. They utilised embedded spy pixels to verify active inboxes.
High-value targets were subjected to persistent attacks. Some received over 100 highly customised phishing emails with varied bait topics over long periods until a moment of human error occurred.
The sheer volume of the attacks inevitably led to significant operational-security failures. These blunders allowed cybersecurity researchers to attribute the campaigns to the Indian firms with high confidence. During the Dark Basin investigation, researchers capitalised on cryptographic errors. Because the BellTrox hackers used sequential shortcodes for their Phurl shorteners rather than randomised hashes, researchers were able to count upwards and enumerate nearly 28,000 unique URLs. This exposed the entirety of the target list.
Metadata analysis directly pointed to New Delhi. Server logs capturing stolen credentials and IP addresses were consistently timestamped in India Standard Time. The custom URL shorteners utilised culturally specific Indian names of festivals such as Holi and Rongali.
In egregious operational failures, BellTrox employees used their own personal documents as bait content when testing their URL shorteners on live servers. One such document was a curriculum vitae matching a current employee. Employees also routinely bragged about their capabilities on social media platforms like LinkedIn. They listed skills like email penetration exploitation and corporate espionage. They publicly posted screenshots that inadvertently featured links to the Dark Basin infrastructure.
Hacking the Global Justice System
The September 2026 letter by American lawmakers explicitly notes that these firms targeted more than 1,000 attorneys across major US law firms to manipulate ongoing litigation.
Access to an opposing counsel’s inbox provides an asymmetric advantage in litigation. By reading privileged communications, a party can secretly learn the opposing side’s trial strategy. This includes discovering the absolute minimum settlement floor a plaintiff will accept. It allows parties to identify weak expert witnesses before they are deposed, monitor confidential discussions between co-counsel and track the exact date an opponent’s litigation funding is projected to run out.
The cyber-attacks were meticulously timed to coincide with critical legal milestones. During the ExxonKnew climate-change litigation, BellTrox launched massive phishing campaigns against organisations like Greenpeace, the Rockefeller Family Fund and the Conservation Law Foundation. The volume of these attacks spiked precisely around key court filing dates in June 2017 and January 2018. Similar tactics were deployed against organisations advocating net neutrality.
The client roster extended to prominent business and political disputes. Media reports alleged that, in 2012, Appin breached the email of Chuck Randall during the Shinnecock Indian Nation dispute. Randall was a tribal member negotiating a real-estate deal. Excerpts of his private emails were printed in pamphlets and distributed across the reservation. The manufactured scandal caused his allies to be ousted and the casino deal collapsed.
In 2013, Norwegian telecom giant Telenor suffered an industrial-espionage breach resulting in the theft of 66,000 emails. Norwegian investigators reportedly traced malicious domains directly back to Appin. Before the collapse of the fraudulent German payment processor Wirecard, short-seller Matthew Earl was targeted by Dark Basin phishing emails mimicking his family members. According to news reports, during a multi-billion-dollar lawsuit in London in 2011, a private detective commissioned Appin to hack Russian oligarch Boris Berezovsky. In the Dominican Republic, entrepreneur Jochi Gómez allegedly hired Appin to dig up digital dirt on the elite for his digital newspaper.
Silencing the Press Through Transnational Lawfare
An alarming development surrounding Appin, BellTrox and CyberRoot is their alleged use of coordinated legal campaigns to censor investigative journalism globally. The September 2026 US Congressional letter emphasised that these actors mounted a censorship campaign to suppress public awareness of their activities.
This censorship relies on a strategy known as transnational lawfare or forum shopping. US courts protect press freedom under the First Amendment. These actors utilise foreign courts in India to obtain global takedown orders against American media outlets.
The most prominent example involves Reuters. The news agency published a 6,000-word investigative exposé into Appin on November 16, 2023. The report documented allegations of Appin’s transition from an educational startup to a hacking powerhouse. In an orchestrated response, an entity calling itself the Association of Appin Training Centers filed a defamation lawsuit in a New Delhi district court. The plaintiffs claimed the reporting damaged the reputations of innocent students who attended legitimate educational courses.
On December 4, 2023, New Delhi Additional District Judge Rakesh Kumar Singh issued a preliminary injunction mandating the total suppression of the investigation pending trial. The judge reasoned that if Reuters suffered financial harm from removing the article, the plaintiff could eventually compensate it monetarily. However, he said allowing the material to remain online could have a devastating effect on the general student population of India.
Faced with the threat of legal sanctions against their local Indian staff and business assets, Reuters temporarily complied. It removed the article globally and replaced it with an editor’s note. The injunction stood for nearly ten months until it was vacated by the court on October 3, 2024, allowing Reuters to republish the investigation.
The legal intimidation extended beyond Reuters. Rajat Khare retained Clare Locke, a US libel law firm based in the Washington suburbs, to issue legal warnings to secondary publishers and internet archives. The chilling effect was immediate. The Association of Appin Training Centers filed a defamation lawsuit in India against journalist David Kirkpatrick, The New Yorker and Google after Kirkpatrick referenced Appin in a broader piece.
Meta was sued in India by the same entity because Reuters reporters utilised WhatsApp to contact sources. The lawsuit claimed the outreach constituted gender-biased harassment and stalking. Wired removed a cybersecurity roundup item referencing the Reuters report. Lawfare unpublished excerpts of the investigation. The Wayback Machine removed archived copies of the Reuters article after receiving takedown requests referencing the Indian court order.
The Association of Appin Training Centers, which describes itself as an entity supporting Appin franchise training centres, was created in 2022. During the lawsuit against Reuters, the Indian court questioned its legitimacy, noting that it was created after the events described in the Reuters article. Khare’s lawyer has stated that his client ‘has no links with this association’ and that the accusations against Khare are ‘categorically false’ and ‘have been rejected by courts and regulatory bodies and debunked by experts’.
Rajat Khare is now in Switzerland. He runs Boundary Holding, a Luxembourg venture-capital firm.
Regulatory Voids
Security firm SentinelOne, along with Citizen Lab and Amnesty International, made efforts to establish a connection between the police in Pune and hackers who allegedly planted incriminating evidence in the laptops of activists imprisoned in the Bhima Koregaon case.
In December 2021, the Internet Freedom Foundation filed a First Information Report against Sumit Gupta and BellTrox with the Cyber Crime Cell of the Delhi Police. Five months later, in May 2022, the Internet Freedom Foundation received an automated message from the cell indicating that the complaint had been closed without any investigative action. No further communication was received from the Delhi Police.
Under Section 43 of the Information Technology Act of 2000, hacking is defined as illegal in India. Section 66 states that anyone found dishonestly engaging in activities described in Section 43 can be punished with imprisonment for up to three years or a fine of up to five lakh rupees. Section 75 grants Indian law-enforcement agencies jurisdiction over crimes committed using computers located in India. It also allows agencies to act against individuals who commit offences outside India if the computer network used for such crimes is located in India.
Despite these laws, cyber-security firms and individuals facing allegations in national jurisdictions have continued, in some cases, to operate without prosecution. Some openly display their credentials on social media to attract customers.
As mentioned, while cyber-security firms have collaborated with local police departments and national security agencies like the IB and the R&AW, there remains a question of whether law-enforcement agencies have turned a blind eye to hackers engaging in illegal activities. It is evident that private firms offering teaching and training programmes have consciously or inadvertently contribute to the creation of cybercriminals who provide their services for illicit purposes.
A Private Threat to Digital Privacy
The history of these organisations reveals that the threat to digital privacy is no longer solely the state-sponsored actor. It is a well-funded private investigator armed with a hack-for-hire contract. By weaponising human psychology through industrial-scale phishing, manipulating the global judiciary through strategic data theft and suppressing media exposure through aggressive transnational lawfare, the Indian cyber-mercenary ecosystem exploits vulnerabilities in democratic institutions.
The push by US lawmakers to place the firms on the Entity List shows the inadequacy of traditional law enforcement in addressing this threat. Despite indictments by the US Department of Justice and investigations by authorities in Switzerland, Norway and the Dominican Republic, cross-border cyber enforcement remains sluggish.
And, unfortunately, India became a hub for training unethical hackers and cyber criminals.