U.S. lawmakers on September 9 asked Commerce to add BellTroX and two other India-based hack-for-hire firms to the Entity List, escalating a campaign that Citizen Lab linked to Dark Basin and targeted espionage against U.S. citizens, businesses, and their lawyers.
The idea is to treat mercenary hacking as a sanctions and export-control problem, not only a criminal one. If Commerce acts, the firms can lose access to U.S. software licenses, cloud services, and other technology that helps them operate abroad, so the pressure lands on their operating capacity as well as on any single case.
For readers tracking mercenary espionage, the shift matters because it moves the fight upstream: a designation can squeeze the support systems that make these firms effective even when no criminal prosecution or takedown has landed. That leaves media, NGO, and legal-adjacent targets with a policy fight still in motion, not a closed threat picture.