Overview
- Lawmakers sent a bipartisan letter to Commerce Secretary Howard Lutnick on Sept. 9–10, 2026 requesting that BellTroX, CyberRoot and Sunkissed Organic Farms be placed on the Commerce Department’s Entity List.
- Designation on the Entity List would restrict the firms’ ability to obtain U.S.-origin software, cloud infrastructure and cybersecurity tools, making their operations more costly and less reliant on American technology.
- Investigations by Reuters, The New Yorker, Citizen Lab and reports from major tech firms have previously identified these companies as participants in a hack‑for‑hire ecosystem that targeted U.S. citizens, businesses and more than 1,000 lawyers.
- Executives at the three firms have denied wrongdoing or not responded to requests for comment, and the lawmakers note that at least one operative tied to the network has been indicted by the U.S. Department of Justice.
- Even if the Commerce Department pursues the listing, the move would not by itself stop cross‑border legal pressure on journalists or fully halt hacking, so observers will watch for the department’s decision, ongoing litigation and any follow‑on criminal or diplomatic steps.