Hack-for-hire services do not operate as state-sponsored group but likely as a hack-to-hire company that conducts commercial cyberespionage against given targets on behalf of private investigators and their clients. University of Toronto’s Citizen Lab started its investigation into the ‘Dark Basin’ group in 2017 after it was contacted by a journalist targeted with phishing pages that were served via the self-hosted open-source Phurl URL shortener. Researchers found that attackers used the same shortener to disguise at least 27,591 other phishing links containing the targets’ email addresses.
Source: https://thehackernews.com/2020/06/hacker-for-hire-belltrox-india.html