Three Indian-based companies have been accused of conducting hacking campaigns and stealing data from thousands of Americans and US businesses, according to a bipartisan group of US senators. As part of the request, the lawmakers sought restrictions that could limit companies' access to American technology and services in a letter to U.S. Commerce Secretary Howard Lutnick.
Among the companies named in the letter are Sunkissed Organic Pvt Ltd, BellTrox Ltd, and CyberRoot Ltd. Democratic Senator Ron Wyden and Sheldon Whitehouse, along with Republican Senator Pat Harrigan, allege that the groups had engaged in targeted espionage activities against US citizens, businesses and legal professionals over the past fifteen years.
A number of senators cited investigations conducted by Reuters and The Citizen Lab, in which they claimed that the companies had been involved in hacking campaigns targeting pharmaceutical companies, private equity firms, and attorneys employed by major law firms. It was stated in the letter that the groups operated under the direction of the Qatari government and some of these operations were intended to influence ongoing litigation.
According to the senators, the alleged activities included targeting individuals who oppose Qatar's bid for the World Cup, as well as the family members of the former Republican Chairman of the House Permanent Select Committee on Intelligence.
A number of allegations go beyond the hacking activities themselves, as well.
A number of foreign legal actions were taken by legislators that were intended to restrict public reporting of the alleged activities. One such case involved Appin, in which executives related to the company obtained a global court order from an Indian court requiring Reuters to cease investigating the company. The order was subsequently lifted, allowing the investigation to be republished by Reuters.
According to the senators, the episode illustrates the possibility of restricting the availability of American information through foreign legal proceedings. Additionally, previous reporting has documented legal threats to media outlets that cover alleged hack-for-hire operations related to Appin. The US Commerce Department has now requested that BellTroX, CyberRoot, and Sunkissed Organic Farms be added to the Entity List by the Bureau of Industry and Security of the US Commerce Department.
By making such a designation, US companies may not export or transfer certain technologies, software, and other controlled items to these listed entities without a license. The requested restrictions would specifically target access to American software, cloud infrastructure, and cybersecurity tools. This move remains a request from Congress, and any Entity List designation requires the Commerce Department to take action.
US authorities are now considering possible restrictions on the three firms' access to American technology and services in light of the lawmakers' request for the three firms to be under renewed scrutiny.
