Threat actor
BellTroX
Last fetched
BellTroX is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
BellTroX InfoTech Services is an Indian IT firm offered its hacking services to help clients spy on more than 10,000 email accounts over a period of seven years. A cache of data reviewed by Reuters provides insight into the operation, detailing tens of thousands of malicious messages designed to trick victims into giving up their passwords that were sent by BellTroX between 2013 and 2020. The data was supplied on condition of anonymity by online service providers used by the hackers after Reuters alerted the firms to unusual patterns of activity on their platforms. Citizen Lab revealed in an investgiation that Dark Basin is a hack-for-hire organization linked to BellTroX. Their report also noted that Dark Basin is the group behind the phishing of organizations working on net neutrality advocacy, uncovered by a report by the Electronic Frontier Foundation.
Techniques by tactic
No ATT&CK techniques are recorded for BellTroX in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to BellTroX today — this states the absence of a published link, not that BellTroX has no infrastructure.
References
- https://www.reuters.com/article/us-india-cyber-mercenaries-exclusive/exclusive-obscure-indian-cyber-firm-spied-on-politicians-investors-worldwide-idUSKBN23G1GQ/
- https://www.newyorker.com/news/annals-of-crime/a-confession-exposes-indias-secret-hacking-industry
- https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/
- https://www.eff.org/deeplinks/2017/09/phish-future
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from BellTroX into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.