A bipartisan group of U.S. lawmakers sent a letter on September 9, 2026, urging the Commerce Department to place three Indian hack-for-hire companies on its economic sanctions “entity list,” which would bar U.S. businesses from transacting with them and cut off their access to software licenses and cloud infrastructure.
Democratic senators Ron Wyden of Oregon and Sheldon Whitehouse of Rhode Island, along with Republican congressman Pat Harrigan, addressed the letter to Commerce Secretary Howard Lutnick. The three companies named are BellTroX, CyberRoot, and Sunkissed Organic Farms — which previously operated under the name Appin.
The lawmakers allege that the firms have spent more than a decade conducting cyberattacks and targeted espionage against Americans, business owners, and their lawyers in order to manipulate ongoing litigation. They also accuse the companies of running an “aggressive censorship campaign” using foreign courts to suppress media coverage of their alleged activities. The letter states the firms “operated at the behest of the Qatari government” and that their targets included a former senior Republican lawmaker.
Appin’s ties to Qatar have been reported previously. Earlier investigations linked the company to cyberattacks against FIFA officials, reportedly directed by Qatar in connection with its efforts to host the 2022 World Cup. Appin also previously obtained a court order from an Indian court requiring Reuters to remove its reporting on the company, though that order was later lifted. The digital rights group Electronic Frontier Foundation also defended Techdirt and the MuckRock Foundation against legal threats from Appin. Separate investigations by The New Yorker and The Citizen Lab documented espionage activity by BellTroX and CyberRoot.
It remains unclear whether the Commerce Department will act on the request. A department spokesperson did not respond to a request for comment. Representatives for CyberRoot, BellTroX, Sunkissed Organic Farms, and the Qatari government in Washington also did not respond to requests for comment.
If added to the entity list, the designation could significantly limit the firms’ ability to operate by restricting their access to U.S. technology and services.
Source: TechCrunch