Three US lawmakers just asked Washington to blacklist three Indian firms accused of running a spy-for-hire operation for fifteen years

Three U.S. lawmakers have formally asked the American government to blacklist three Indian IT firms over what they describe as more than fifteen years of cyber espionage. As reported by Reuters, Democratic Senators Ron Wyden and Sheldon Whitehouse, along with Republican Representative Pat Harrigan, sent a letter on Wednesday urging the Commerce Department to add BellTroX, CyberRoot, and Sunkissed Organic Farms Pvt. Ltd. to the Entity List. Sunkissed Organic Farms was formerly known as Appin Technology Pvt. Ltd.

Placement on the Entity List would block the three companies from accessing U.S. software, cloud infrastructure, and cybersecurity tools. The list is managed by the Bureau of Industry and Security, and being added to it subjects a company to specific license requirements for the export, reexport, or transfer of controlled items. The lawmakers argue the firms have engaged in targeted espionage against U.S. citizens, businesses, and the legal professionals who represent them.

The history behind the request stretches back years. A 2023 report identified Appin as a pioneer in the hack-for-hire industry, describing how it evolved from an educational startup into an operation that stole secrets from military officials, politicians, executives, and other wealthy targets around the world. A separate 2022 report named CyberRoot and BellTroX as central players in the cybermercenary industry, alleging they were frequently hired by private investigators and Western lawyers to spy on opposing parties in business and legal disputes.

Tech giants and journalists have been tracking these firms for years

Google and Meta Platforms have both published reports linking hacking activity to these companies, and outlets including The New Yorker and the Bureau of Investigative Journalism have identified the same firms as hackers-for-hire. Executives at all three companies have denied any wrongdoing. The dispute has also spilled into the courts, as Reuters is currently facing litigation in India brought by the Association of Appin Training Centers, a group that says it represents the interests of Appin alumni and accuses Reuters of damaging the reputations of students and training centers, an allegation Reuters disputes.

If the Commerce Department acts on the lawmakers’ request, the consequences for the three firms would be substantial. Once a company is on the Entity List, transactions with it carry a serious red flag, and the government generally applies a policy of denial when U.S. companies apply for licenses to deal with listed entities.

It remains technically possible for a U.S. company to do business with a listed entity, though the Bureau of Industry and Security has said that doing so requires extreme caution and a case-by-case license review. Removing a company from the list afterward is a rigorous process, requiring a formal request to the End-User Review Committee and final approval from the Principal Deputy Assistant Secretary for Strategic Trade and Technology Security.

The Entity List functions as one piece of the broader U.S. export control system, intended to keep items subject to the Export Administration Regulations from being diverted toward activities that harm American interests. A listing is only added when the government finds reasonable cause to believe an entity poses a significant risk. The request comes as Washington has faced other recent friction over foreign surveillance and security concerns, including Iran’s response to a captured US drone drawing attention this week.

Requests for comment sent to Sunkissed representatives, CyberRoot, and the Commerce Department have gone unanswered, and BellTroX could not be reached for comment. The push also lands alongside separate scrutiny of federal agencies, including a whistleblower lawsuit over ICE misconduct that has drawn similar attention from lawmakers this week.

Any future action on the Entity List request would be published in the Federal Register, as is standard procedure for additions or modifications to the list.