3 Indian spy firms face US blacklist push after 15 years of targeting lawyers

For law firms, corporate counsel, and litigation finance, this letter hits close to home: Reuters reporting found Western lawyers and private investigators hired these firms to spy during disputes. The proposed Entity List designation would not just punish the vendors — it raises urgent questions about how hacked material enters U.S. litigation, whether privilege is being compromised, and what sanctions-screening obligations law firms now face.

On September 9, 2026, three U.S. lawmakers asked the Commerce Department to place BellTroX, CyberRoot, and Sunkissed Organic Farms Pvt. Ltd. — formerly Appin Technology Pvt. Ltd. — and its subsidiaries on the Entity List. Senators Ron Wyden and Sheldon Whitehouse, joined by Representative Pat Harrigan, said the firms have engaged in "more than fifteen years of targeted espionage against U.S. citizens, businesses, and the lawyers representing them." The request, sent in a letter, represents a concrete attempt to use export controls rather than criminal charges to constrain a shadowy hack-for-hire ecosystem.

“

Senators Ron Wyden and Sheldon Whitehouse, joined by Representative Pat Harrigan, said the firms have engaged in "more than fifteen years of targeted espionage against U.S.

An Entity List designation would not indict anyone, but it would force U.S. software vendors, cloud providers, and cybersecurity toolmakers to either deny service or obtain export licenses. Because modern intrusion operations often depend on legitimate U.S.-built cloud infrastructure, SaaS platforms, and security tooling to conduct reconnaissance, exfiltrate data, and remain hidden, losing that access would be operationally significant. The letter frames the firms not as isolated actors but as front organizations with subsidiaries and rebranding histories, which suggests lawmakers understand the whack-a-mole nature of cyber mercenary operations.

The underlying reporting is substantial. Reuters named CyberRoot and BellTroX in a 2022 investigation as key players in the cybermercenary industry, frequently hired by Western lawyers and private investigators to spy on opponents during legal and business disputes. A 2023 Reuters report identified Appin as a pioneer of the field, describing its evolution from an educational startup into a hack-for-hire powerhouse that stole secrets from executives, politicians, military officials, and wealthy elites around the globe. Meta Platforms and Alphabet-owned Google have together published three reports linking hacking activity to the firms, and publications including The New Yorker and the Bureau of Investigative Journalism have also identified them as hackers-for-hire.

The implications extend beyond national security into commercial law, litigation, and corporate espionage. The explicit mention of lawyers representing U.S. citizens and businesses is unusual and pointed. It suggests that hack-for-hire groups are being used not simply for geopolitical intelligence but for leverage in lawsuits, business disputes, and high-stakes negotiations. A law firm's confidential case strategy, settlement positions, or client communications could be stolen and weaponized by opposing parties. That turns cybersecurity into an ethics and discovery-integrity problem as much as an IT problem. In-house legal departments and litigation funders may need to reassess whether opposing parties have access to mercenary intrusion services.