Appin (company)

Founding and government work

In December 2003, Rajat Khare, along with high school friends, conceived Appin to offer technology training workshops to university students. By 2005, Rajat Khare had been joined by his brother Anuj Khare, a former motivational speaker, and the company had an office in western New Delhi. Their franchise offered courses in programming, robotics, and cybersecurity. By 2007, Appin had opened a digital security consultancy helping Indian organisations defend themselves online. This drew the attention of Indian government officials, who were navigating internet-era intelligence challenges and seeking ways to hack into computers and emails.[1]

Shortly thereafter, Appin established a subsidiary called Appin Software Security, also known as the Appin Security Group, to conduct surveillance activities for the Indian government. Employees signed non-disclosure agreements and were assigned to military-controlled facilities, where they worked away from their colleagues in the wider company. Their targets included Pakistan, China, and Khalistan movement separatists from India's Punjab state.[1][7]

By 2009, the company's clients had included the Research and Analysis Wing (RAW), the Intelligence Bureau, India's military, the Ministry of Home Affairs, and the Central Bureau of Investigation (CBI).[1][4] Appin claimed its solutions were used by government intelligence agencies to monitor hostile individuals, marketed software for analysing call metadata, and explored importing Israeli cell phone interception devices. For the fiscal year ending in 2009, the company earned nearly $1 million in revenue and a profit of about $170,000, with projections of a nearly tenfold revenue increase over the following 36 months.[1]

The company also generated additional revenue by covertly reselling material it had hacked for one Indian agency to another.[1] This practice was eventually uncovered, prompting several Indian intelligence agencies to terminate their contracts with Appin. According to Reuters, following the loss of government contracts, Appin shifted its focus to private sector clients.[1]

Private sector operations

According to a 2023 New Yorker report citing Geneva investigator Jonas Rey, Khare approached private intelligence firms across Europe around 2010 offering hacking services, and an Appin presentation from that period advertised the company's hacking capabilities.[4][1] Khare's lawyers at Clare Locke have said he had never seen the 2010 presentation and that "the document is a forgery or was doctored."[1] Around 2011, Appin began operating a digital dashboard dubbed "My Commando" for spy services, resembling an e-commerce platform with a menu of hacking options. Customers logged in to request Appin to hack emails, computers, or phones, monitor the operation's progress, and later download the stolen data.[1][7] Seventy global clients hired Appin to hack hundreds of targets through "My Commando."[1][4]

Among the system's early users were Israeli private detectives Aviram Halevi and Tamir Mor, who accessed it in 2011. That year, Mor ordered hacks on more than 40 targets, including Malaysian politician Mohamed Azmin Ali, Russian oligarch Boris Berezovsky, and members of Berezovsky's legal team.[1] Around the same time, another user hired Appin to hack 30 targets, including a Rwandan dissident and the wife of another wealthy Russian going through a divorce.[1]

The targets also included Kristi Rogers—the wife of Representative Mike Rogers, who was the Chairman of the U.S. House Intelligence Committee at the time.[1][4]

Other individuals, such as a landscape architect in New Jersey and a Native American tribal member, were also targeted using the system.[1] Appin also targeted a human rights activist associated with the Oslo Freedom Forum, along with governmental and private organisations.[1][3][7]

In January 2012, a series of targeted emails containing malicious attachments were sent to Peter Hargitay, a Zurich-based FIFA insider and former adviser to FIFA President Sepp Blatter, who had been consulting for Australia's 2022 FIFA World Cup bid.[8][1] Hargitay and his son Stevie detected the intrusion, and an expert they hired traced the attack to a server near Zurich airport whose billing records listed Khare as the client.[1] The Hargitays filed a criminal complaint with Swiss authorities.[1][8]

According to a 2022 investigation by SRF Investigativ, the attack was part of an extensive espionage campaign in which Qatar sought to protect its 2022 World Cup hosting rights by hacking the emails and phones of FIFA officials and critics of its bid, and running smear campaigns to influence FIFA policy.[8][9] Qatar had hired Global Risk Advisors, a firm founded by former CIA operative Kevin Chalker, which frequently used subcontractors; the Hargitay hack was subsequently traced to Appin.[8][10][11] The broader campaign, dubbed "Project Merciless," spanned five continents over several years.[8][10] Hack-for-hire companies founded by Appin alumni were also later implicated in the campaign.[9]

Also in 2012, a German private investigator paid Appin $3,000 to hack an email during an inheritance feud involving a wealthy businessman.[2] In the Dominican Republic, authorities raided a local newspaper publisher in 2012 and formally accused him of collaborating with Khare to hack emails and extract information from the nation's elite for his digital newspaper. The publisher later admitted that in 2011, he paid Appin between $5,000 and $10,000 a month to spy on over 200 prominent Dominicans including Leonel Fernández, then president of the Dominican Republic.[1]

Investigations and attribution

In 2012, after analysing a hack and leak targeting a Native American tribal member, the FBI linked multiple cases to a single perpetrator. Collaborating with Swiss authorities, the FBI identified the perpetrator as Appin and shared that they had human intelligence through a confidential source.[1]

In early 2013, Norwegian telecommunications company Telenor discovered that hackers had stolen as many as 66,000 emails from its chief executive, two personal assistants, and a senior lawyer in what the company described as industrial espionage; Norwegian police traced the attack to IP addresses in New Delhi.[1] Appin's operations began attracting attention worldwide.[8] By 2013, they had become well known among security researchers. Researchers referred to the group using various monikers, including Operation Hangover by Shadowserver Foundation and Norman Shark,[12][13][14] Monsoon by Forcepoint,[15] and Viceroy Tiger by CrowdStrike.[16][17][18] These reports documented campaigns in which targeted emails containing malicious attachments with exploit-laden documents were used to deploy custom malware (keyloggers, document uploaders, and credential-harvesting tools) across more than 600 command-and-control domains, using only previously known exploits rather than zero-days.[13][18]

In 2023, SentinelOne's analysis of internal Appin records concluded that the company owned and controlled the attack infrastructure and had developed malware in-house, including a keylogger deployed against Pakistani government targets in 2009. Appin also procured exploits from freelancers and commercial vendors.[7]

From 2013 onward, Google spent a decade monitoring hackers linked to Appin who targeted tens of thousands of email accounts on its platform.[5][1] Due to the unusually high volume of activity by the hackers, Google expanded its systems and procedures to keep up with them.[1] Security researchers avoided publicly naming Appin due to legal concerns, though they privately confirmed the link to Reuters.[1] In 2013, an Appin representative told the Wall Street Journal that the company "denies it had any role in any of the attacks" and said that someone, possibly a former employee, had been using its name.[19] The representative separately called the Norman Shark report "a marketing gimmick" and said Appin was "in no manner connected or involved with the activities" described in it.[20]

Since 2012, Appin and its co-founder Rajat Khare have been the subject of criminal investigations in multiple countries. Swiss authorities linked Appin and Khare to a criminal complaint filed by the Hargitays for intrusion into their systems, while Norwegian investigators connected Appin to the Telenor hack. These multinational investigations were carried out over several years but were eventually closed without charges being filed.[1][8]

In 2016, the woman who had hired a private detective to access the email of her fellow Native American tribal member pleaded guilty in federal court. Later, in mid-2020, that detective confessed in an affidavit that he had hired Appin to carry out the email heist. Similarly, Aviram Halevi, who hired Appin to target at least three dozen people in 2011,[1] admitted to employing them to steal emails from a Korean businessman.[2] In 2021, the State Bank of India filed a criminal complaint with the Central Bureau of Investigation, Appin's former client, accusing Khare and others of embezzling ₹8.06 billion ($97 million) from loans to Educomp, where Khare was a director. Khare's lawyers said he had been "cleared" by Educomp's management but did not provide evidence; as of November 2023, Reuters could not determine the status of the case.[1]

Alumni firms

Following Norman Shark's public attribution of the Telenor hack to Appin,[13] the company faced increasing scrutiny, and the group began scaling back its online presence.[1] Around that time, former Appin employees branched out, founding similar hack-for-hire firms.[3] Khare's lawyers have said he cannot be held responsible for the activities of those alumni firms, comparing such attribution to "holding Harvard University responsible for the terrorist bombings carried out by its former student Ted Kaczynski."[1]

Two such companies—BellTroX Infotech Services, led by Sumit Gupta, and CyberRoot Risk Advisory[36]—started collaborating with Appin, sharing staff and computer infrastructure for their hacking operations.[2]

Their activities were identified using a database of over 80,000 phishing emails sent to 13,000 targets from 2013 to 2020.[2] This database was vetted by six expert groups, with each group independently confirming recognised hacking activity.[2] Further analysis by Mandiant, LinkedIn, Google,[5] and court records revealed that the hacking was carried out by three Appin-linked companies with an intermingling of resources among them.[2] This network of mercenaries charged clients anywhere from a few thousand to over a million dollars,[36] while paying workers just $370 per month.[2]

The hackers targeted attorneys and their clients, including companies, advocacy groups, media organisations, and business executives. According to Shane Huntley of Google's threat intelligence team, these attacks had "real potential to undermine the legal process."[2] Reuters linked Appin alumnus Sumit Gupta to Aviram Azari, a former Israeli policeman who was sentenced to 80 months in prison for his role in a global hack-for-hire scheme,[2][37][38] the Dark Basin campaign, and the wider network of Indian hack-for-hire operators.[2][4] In a 2020 interview with Reuters, Gupta denied wrongdoing, acknowledging that he provided technical support to private detectives but stating he was not personally involved in cyber espionage.[36][1] By 2023, attempts to reach him were unsuccessful.[1]

Rebrandings and aftermath

Appin Technology rebranded multiple times before adopting the name Sunkissed Organic Farms in 2017. Its subsidiaries also underwent rebranding. In 2015, Appin Software Security became Adaptive Control Security Global Corporate (ACSG).[1]

Later, Rajat Khare resigned as director of the company (by then renamed from Appin Technology) in 2016 and moved to Switzerland, where, according to SRF Investigativ, "he now presents himself as a renowned start-up investor."[1][8] Together with his wife Shweta, Khare runs Boundary Holding, a Luxembourg-based venture capital firm.[39] His family controls companies founded under the Appin name, as well as the renamed Indian firms, including ACSG, which describes itself as a "critical infrastructure protection company that caters to government clients."[1]