Lawmakers push sanctions on Dark Basin's BellTroX
US lawmakers ask Commerce Dept to sanction India's BellTroX and two other firms tied to the Dark Basin hack-for-hire operation.
Sourcecitizenlab.ca — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Citizen Lab's 2020 investigation identified 'Dark Basin,' a large-scale hack-for-hire operation attributed to the Indian company BellTroX InfoTech Services and related entities. The group conducted credential-phishing and espionage campaigns against thousands of targets globally, including American nonprofits involved in #ExxonKnew climate litigation advocacy and net neutrality campaigns, as well as journalists and legal counsel representing these groups.
On September 9, a bipartisan group of U.S. lawmakers sent a letter to Secretary of Commerce Howard Lutnick urging that BellTroX and two other Indian firms be added to the U.S. economic sanctions (Entity) list. The lawmakers allege the firms conducted targeted espionage against U.S. citizens, businesses, and their legal representatives, and engaged in global 'lawfare' intended to suppress investigative reporting by major American media organizations.
This article is primarily a policy update rather than a new technical disclosure; it references and reinforces earlier Citizen Lab attribution work on Dark Basin/BellTroX. Defenders in the nonprofit, legal, and media sectors—particularly those involved in advocacy, environmental, or net-neutrality issues—should be aware that hack-for-hire firms of this type typically rely on spearphishing with credential-harvesting links (often using URL shorteners and spoofed login pages) rather than novel malware, and should review historical Citizen Lab Dark Basin indicators for retrospective detection.
Mentioned in this report
Source reporting: https://citizenlab.ca/group-of-bipartisan-lawmakers-ask-us-government-to-ban-several-hack-for-hire-firms
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs