Appin (company)

Summarize Timeline Top Qs Fact Check

In December 2003, Rajat Khare, along with high school friends, conceived Appin to offer technology training workshops to university students. By 2005, Rajat Khare had been joined by his brother Anuj Khare, a former motivational speaker, and the company had an office in western New Delhi. Their franchise offered courses in programming, robotics, and cybersecurity. By 2007, Appin had opened a digital security consultancy helping Indian organisations defend themselves online. This drew the attention of Indian government officials, who were navigating internet-era intelligence challenges and seeking ways to hack into computers and emails.^[2]

Shortly thereafter, Appin established a subsidiary called Appin Software Security, also known as the Appin Security Group, to conduct surveillance activities for the Indian government. Employees signed non-disclosure agreements and were assigned to military-controlled facilities, where they worked away from their colleagues in the wider company. Their targets included Pakistan, China, and Khalistan movement separatists from India's Punjab state.^[2][9]

By 2009, the company's clients had included the Research and Analysis Wing (RAW), the Intelligence Bureau, India's military, the Ministry of Home Affairs, and the Central Bureau of Investigation (CBI).^[2][5] Appin claimed its solutions were used by government intelligence agencies to monitor hostile individuals, marketed software for analysing call metadata, and explored importing Israeli cell phone interception devices. For the fiscal year ending in 2009, the company earned nearly $1 million in revenue and a profit of about $170,000, with projections of a nearly tenfold revenue increase over the following 36 months.^[2]

The company also generated additional revenue by covertly reselling material it had hacked for one Indian agency to another.^[2] This practice was eventually uncovered, prompting several Indian intelligence agencies to terminate their contracts with Appin. According to Reuters, following the loss of government contracts, Appin shifted its focus to private sector clients.^[2]

According to a 2023 New Yorker report citing Geneva investigator Jonas Rey, Khare approached private intelligence firms across Europe around 2010 offering hacking services, and an Appin presentation from that period advertised the company's hacking capabilities.^[5][2] Khare's lawyers at Clare Locke have said he had never seen the 2010 presentation and that "the document is a forgery or was doctored."^[2] Around 2011, Appin began operating a digital dashboard dubbed "My Commando" for spy services, resembling an e-commerce platform with a menu of hacking options. Customers logged in to request Appin to hack emails, computers, or phones, monitor the operation's progress, and later download the stolen data.^[2][9] Seventy global clients hired Appin to hack hundreds of targets through "My Commando."^[2][5]

Among the system's early users were Israeli private detectives Aviram Halevi and Tamir Mor, who accessed it in 2011. That year, Mor ordered hacks on more than 40 targets, including Malaysian politician Mohamed Azmin Ali, Russian oligarch Boris Berezovsky, and members of Berezovsky's legal team.^[2] Around the same time, another user hired Appin to hack 30 targets, including a Rwandan dissident and the wife of another wealthy Russian going through a divorce.^[2]

The targets also included Kristi Rogers—the wife of Representative Mike Rogers, who was the Chairman of the U.S. House Intelligence Committee at the time.^[2][5]

Other individuals, such as a landscape architect in New Jersey and a Native American tribal member, were also targeted using the system.^[2] Appin also targeted a human rights activist associated with the Oslo Freedom Forum, along with governmental and private organisations.^[2][4][9]

In January 2012, a series of targeted emails containing malicious attachments were sent to Peter Hargitay, a Zurich-based FIFA insider and former adviser to FIFA President Sepp Blatter, who had been consulting for Australia's 2022 FIFA World Cup bid.^[10][2] Hargitay and his son Stevie detected the intrusion, and an expert they hired traced the attack to a server near Zurich airport whose billing records listed Khare as the client.^[2] The Hargitays filed a criminal complaint with Swiss authorities.^[2][10]

According to a 2022 investigation by SRF Investigativ, the attack was part of an extensive espionage campaign in which Qatar sought to protect its 2022 World Cup hosting rights by hacking the emails and phones of FIFA officials and critics of its bid, and running smear campaigns to influence FIFA policy.^[10][11] Qatar had hired Global Risk Advisors, a firm founded by former CIA operative Kevin Chalker, which frequently used subcontractors; the Hargitay hack was subsequently traced to Appin.^[10][12][13] The broader campaign, dubbed "Project Merciless," spanned five continents over several years.^[10][12] Hack-for-hire companies founded by Appin alumni were also later implicated in the campaign.^[11]

Also in 2012, a German private investigator paid Appin $3,000 to hack an email during an inheritance feud involving a wealthy businessman.^[3] In the Dominican Republic, authorities raided a local newspaper publisher in 2012 and formally accused him of collaborating with Khare to hack emails and extract information from the nation's elite for his digital newspaper. The publisher later admitted that in 2011, he paid Appin between $5,000 and $10,000 a month to spy on over 200 prominent Dominicans including Leonel Fernández, then president of the Dominican Republic.^[2]

In 2012, after analysing a hack and leak targeting a Native American tribal member, the FBI linked multiple cases to a single perpetrator. Collaborating with Swiss authorities, the FBI identified the perpetrator as Appin and shared that they had human intelligence through a confidential source.^[2]

In early 2013, Norwegian telecommunications company Telenor discovered that hackers had stolen as many as 66,000 emails from its chief executive, two personal assistants, and a senior lawyer in what the company described as industrial espionage; Norwegian police traced the attack to IP addresses in New Delhi.^[2] Appin's operations began attracting attention worldwide.^[10] By 2013, they had become well known among security researchers. Researchers referred to the group using various monikers, including Operation Hangover by Shadowserver Foundation and Norman Shark,^[14][15][16] Monsoon by Forcepoint,^[17] and Viceroy Tiger by CrowdStrike.^[18][19][20] These reports documented campaigns in which targeted emails containing malicious attachments with exploit-laden documents were used to deploy custom malware (keyloggers, document uploaders, and credential-harvesting tools) across more than 600 command-and-control domains, using only previously known exploits rather than zero-days.^[15][20]

In 2023, SentinelOne's analysis of internal Appin records concluded that the company owned and controlled the attack infrastructure and had developed malware in-house, including a keylogger deployed against Pakistani government targets in 2009. Appin also procured exploits from freelancers and commercial vendors.^[9]

From 2013 onward, Google spent a decade monitoring hackers linked to Appin who targeted tens of thousands of email accounts on its platform.^[7][2] Due to the unusually high volume of activity by the hackers, Google expanded its systems and procedures to keep up with them.^[2] Security researchers avoided publicly naming Appin due to legal concerns, though they privately confirmed the link to Reuters.^[2] In 2013, an Appin representative told the Wall Street Journal that the company "denies it had any role in any of the attacks" and said that someone, possibly a former employee, had been using its name.^[1] The representative separately called the Norman Shark report "a marketing gimmick" and said Appin was "in no manner connected or involved with the activities" described in it.^[21]

Since 2012, Appin and its co-founder Rajat Khare have been the subject of criminal investigations in multiple countries. Swiss authorities linked Appin and Khare to a criminal complaint filed by the Hargitays for intrusion into their systems, while Norwegian investigators connected Appin to the Telenor hack. These multinational investigations were carried out over several years but were eventually closed without charges being filed.^[2][10]

In 2016, the woman who had hired a private detective to access the email of her fellow Native American tribal member pleaded guilty in federal court. Later, in mid-2020, that detective confessed in an affidavit that he had hired Appin to carry out the email heist. Similarly, Aviram Halevi, who hired Appin to target at least three dozen people in 2011,^[2] admitted to employing them to steal emails from a Korean businessman.^[3] In 2021, the State Bank of India filed a criminal complaint with the Central Bureau of Investigation, Appin's former client, accusing Khare and others of embezzling ₹8.06 billion ($97 million) from loans to Educomp, where Khare was a director. Khare's lawyers said he had been "cleared" by Educomp's management but did not provide evidence; as of November 2023, Reuters could not determine the status of the case.^[2]