Bipartisan lawmakers urge Commerce to add hack-for-hire firms BellTroX, CyberRoot, and Sunkissed Organic Farms (formerly Appin) to the Entity List

On September 9, 2026, Sen. Ron Wyden, Sen. Sheldon Whitehouse, and Rep. Pat Harrigan asked the US government to place three India-based hack-for-hire firms — BellTroX, CyberRoot, and Sunkissed Organic Farms (formerly Appin) — on the Entity List over alleged…

On September 9, 2026, a bipartisan letter from Sen. Ron Wyden, Sen. Sheldon Whitehouse, and Rep. Pat Harrigan asked the US government to place three India-based hack-for-hire firms — BellTroX, CyberRoot, and Sunkissed Organic Farms (formerly Appin) — on the Entity List. Two of three reports say the letter was addressed to Commerce Secretary Howard Lutnick; CyberScoop alone says the lawmakers urged Treasury. An Entity List designation would bar US businesses from transacting with the firms and restrict their access to American software, cybersecurity tools, and cloud infrastructure. The letter accuses the firms of targeted espionage against US citizens, businesses, and their lawyers for more than fifteen years (TechCrunch says over a decade), allegedly at the behest of Qatar's government, and of stealing data from thousands of Americans to manipulate litigation. Alleged Qatar-linked targeting includes FIFA officials tied to Qatar's 2022 World Cup plans, opponents of Qatar's World Cup bid, and Kristi Rogers, wife of Senate candidate Mike Rogers. The lawmakers also allege a lawfare campaign using foreign courts to censor investigative reporting on the hacking; Appin previously secured a global takedown order against Reuters that was later lifted. The request builds on Citizen Lab's 2020 discovery of the Dark Basin hack-for-hire operation, which targeted US nonprofits involved in #ExxonKnew and net neutrality advocacy and was linked to BellTroX and related entities.

• Letter sent September 9, 2026, signed by Sen. Ron Wyden, Sen. Sheldon Whitehouse, and Rep. Pat Harrigan.
• Firms named: BellTroX (full name BellTroX InfoTech Services per Citizen Lab), CyberRoot, and Sunkissed Organic Farms (formerly Appin); all described as India-based.
• Request: add the firms to the Entity List, which would bar US businesses from transacting with them and restrict their access to American software, cybersecurity tools, and cloud infrastructure.
• Recipient discrepancy: TechCrunch and Citizen Lab say the letter went to Commerce Secretary Howard Lutnick; CyberScoop says the lawmakers urged Treasury.
• Accusations: targeted espionage against US citizens, businesses, and lawyers for more than fifteen years (TechCrunch says over a decade), allegedly at the behest of Qatar's government, plus theft of data from thousands of Americans to…
• Alleged Qatar-linked targets: FIFA officials tied to Qatar's 2022 World Cup plans, opponents of Qatar's World Cup bid, and Kristi Rogers, wife of Senate candidate Mike Rogers.
• Lawfare allegations: use of foreign courts to censor US media reporting on the hacking; Appin previously obtained a global takedown order against Reuters that was later lifted.
• Context: the request builds on Citizen Lab's 2020 discovery of the Dark Basin hack-for-hire operation, which targeted US nonprofits involved in #ExxonKnew and net neutrality advocacy and was linked to BellTroX and related entities.