Hackers for hire: surveillance as a paid service

Summary

• A New York federal court sentenced Aviram Azari, an Israeli private investigator, to 80 months in November 2023 for running a hack-for-hire scheme between 2014 and 2019. He was an intermediary: he hired hacking groups, one of them in India, and passed the results to people who paid him.
• Citizen Lab and Reuters reported in June 2020 that an India-based firm, BellTroX, was behind a very large phishing operation. Researchers had high confidence in that link. They did not know who paid for it.
• Former employees told Reuters that firms like this were usually hired by private investigators on behalf of business rivals or political opponents. The UK's National Cyber Security Centre says hackers-for-hire are reportedly used for legal disputes, intellectual property theft and insider trading.
• Most of this activity starts with a stolen password, not an implant on the phone. The account lives with the provider, so a phone often shows only part of what happened.
• The courts reached the middleman and, so far, not the buyers. Who ultimately paid is still contested, and no one in this article should be treated as guilty beyond what a court has found.

One case, from arrest to sentence

Aviram Azari was charged with computer hacking, wire fraud and identity theft after he traveled to the United States in September 2019. On 20 April 2022 he pleaded guilty to conspiracy to commit hacking, wire fraud and aggravated identity theft. On 16 November 2023 he was sentenced in New York to 80 months in prison and three years of supervised release, and ordered to forfeit about $4.84 million, the amount he made from the scheme. He ran an Israel-based firm that described itself as an intelligence business, and between 2014 and 2019 he hired groups of hackers, one of them in India, who used phishing emails to take over email accounts, according to the Justice Department as reported by SecurityWeek.

• 80 monthsPrison sentence, November 2023
• about $4.84MForfeited, the amount he made
• 2014 to 2019Years of the scheme

Figures from the Justice Department as reported by SecurityWeek, 17 November 2023.

The victims, as reported, included hedge funds, technology companies, journalists and climate change activists. Investigators identified about 300 targets and confirmed hacking of about 100, and prosecutors said thousands of organizations and people may have been targeted. The Justice Department said victims described the targeting as a psychological assault, with anxiety, paranoia and loss of sleep. Some stolen documents were leaked to the press and related to state attorney general investigations into Exxon Mobil's knowledge of climate change. Exxon has denied having any prior knowledge of Azari or the hacking campaign, The Record reports.

The people who paid Azari were not named by the court. His lawyer said in 2022 that the charges concerned work Azari did for the German payments company Wirecard, now defunct. Azari has not named his other customers. That gap matters for everything that follows: the case shows the middle of the chain clearly and the top of it hardly at all.

How the chain of roles works

Citizen Lab published its analysis of this activity in June 2020 under the name Dark Basin. It described thousands of individuals and hundreds of institutions on six continents, among them advocacy groups, journalists, elected and senior officials, hedge funds and companies, and a method that was credential phishing. It linked the operation with high confidence to the India-based firm BellTroX InfoTech Services, and said the work was likely commercial espionage for paying customers. It also said it had no strong evidence pointing to the party that commissioned the work.

Reuters, reporting the same day, said it reviewed data showing more than 10,000 email accounts targeted over seven years. Two former BellTroX employees told Reuters the company and others like it were usually hired by private investigators acting for business rivals or political opponents. BellTroX's owner, Sumit Gupta, denied wrongdoing and told Reuters he only helped investigators download emails after they supplied login details. Reuters also reported that Gupta had been charged in a 2015 U.S. hacking case in which two American private investigators admitted paying him to hack marketing executives' accounts, and that he was declared a fugitive in 2017. Figure 1 shows the order of roles that these sources describe.

One reading of this, ours and not a finding of any source: each layer can honestly say it knows little about the layers on either side, which is what makes the arrangement useful to the people at the top. That is also why a technical finding on one device so seldom leads to the person who paid.

Beyond the headline targets

It is easy to read the Azari case as a story about energy companies and national campaigns. The wider sources are more careful. The UK's NCSC wrote in April 2023 that hackers-for-hire range from low-skill crime to complex network intrusions that may go undetected, that their customers can be private entities and individuals, not only states, and that they are reportedly used for legal disputes, intellectual property theft and insider trading. The word "reportedly" is the NCSC's own. It also judged that they pose a potential corporate espionage threat to organizations and individuals who hold valuable confidential information.

Google's Threat Analysis Group drew a distinction in June 2022. Commercial spyware vendors, it said, generally sell a capability that the customer operates, while hack-for-hire firms carry out the attacks themselves. Some advertise openly to anyone willing to pay and some sell quietly to a limited audience. Targets in the reports it described included activists and journalists, and corporate espionage, where a hired hand can hide the buyer's role. A single campaign could hit unrelated organizations in several countries.

We found no source in this list that documents hack-for-hire use in family disputes, so we make no claim about it. The sources support legal disputes, business rivalry and political motives. They support a general caution: a person in the middle of a bitter dispute, litigation, an investigation or a contested business deal should treat a run of odd account problems as worth a look, not as proof.

Who gets caught

In this case the people nearest U.S. courts were reached first. Azari was arrested when he traveled to the United States. Reuters reported that Gupta was a fugitive from the 2015 charges and that the Justice Department declined to comment on his status or on any extradition request. We did not find a later public update on him in the sources we read.

A second man has now been charged in the same investigation. Amit Forlit was indicted by a New York grand jury in November 2022 on charges of conspiracy to commit computer hacking, conspiracy to commit wire fraud and wire fraud. After the UK High Court refused him permission to appeal in March 2026, E&E News reported on 8 April 2026 that he had been extradited, had pleaded not guilty and was released on a $1 million bond, with a pretrial conference set for 16 April 2026. He is presumed innocent. DeSmog reports that his lawyers say he never commissioned or paid for hacking. Defense filings reported there name companies as customers of his intelligence-gathering work, and those companies have denied any involvement in the hacking. This article takes no position on who is right. It notes only that, in 2026, the question of who paid is still before a court.

What this means if you think you are a target

The method in these reports is not exotic. Dark Basin was credential phishing, and Google's 2022 report says credential phishing is the main tactic of the hack-for-hire groups it described. A message gets you to type a password into a copy of a sign-in page. After taking an account, Google says, attackers can keep access by granting an access token to a legitimate email app or by creating an app password, and changing your password revokes both. Google recommends turning on its Advanced Protection program and enhanced Safe Browsing, keeping all devices updated, and checking for unfamiliar access after a suspected compromise.

Practical steps that follow, in the Lab's words: use sign-in methods that do not rely on typing a password into a page, such as passkeys or security keys where your provider offers them; look at your account's list of signed-in devices and connected apps; treat an unexpected "your password has expired" or document-share message as a reason to go to the service directly, not through the link. If you are a journalist, an official or work in a sensitive role, CISA publishes mobile communications guidance, last revised 13 March 2026, for highly targeted people in senior government, military and political roles. Apple names Access Now's Digital Security Helpline as a source of expert help for people at risk.

What an examiner can and cannot conclude

A phone is one place where a hack-for-hire attempt may leave something. Often the account itself, and anything taken from it, sits with the provider. Figure 2 sets out what common findings support.

Two cautions follow. An examiner's work ends at what the evidence in hand can show. Naming the paying party is a task for investigators with legal power, and the Azari case took years and a chance arrest to reach one middleman. And an empty result licenses a statement about the store that was read, not about a person's history (LAB-TR-0034). Where a dispute is involved, an examiner should also keep the examination to the question asked and the consent given, and leave the hunt for a culprit to those entitled to carry it out.

What this article does not claim

Sources

Every number and claim, and where it comes from. Pages were read on 2026-11-08. Where the Justice Department release was not available to the Lab's tools, the claim is cited to the outlet that reported it. LAB-TR-0034 is a Lab Technical Report available on this site, with no DOI yet (LAB-TR-0034).

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related