A nine-month intelligence operation that culminated in a multi-state crackdown last month exposed how a ISI-linked Pakistani gangster used social media and organised crime to build a low-cost terror network across India. In a sweeping pre-Independence Day crackdown, Indian security agencies last month detained 253 people across 14 states and arrested more than 200 operatives linked to the Pakistan-based Shahzad Bhatti Network, foiling what officials said were plans for subversive attacks around August 15. The August 12 operation, conducted through coordinated intelligence-sharing between central agencies and state police, exposed a disturbing model of cross-border terrorism: one in which Pakistani handlers recruit Indian youth through social media, pay them for seemingly minor criminal tasks and gradually draw them into reconnaissance, weapons trafficking and targeted violence. The operation was the culmination of nearly nine months of coordinated work that began in November 2025, with intelligence being collated and disseminated among multiple state police forces and through the Multi-Agency Centre. The scale of the crackdown shows why Indian agencies regard the network as more than another gangster outfit. More than 90 FIRs have been registered against the Shahzad Bhatti Network, or SBN, with more than 200 people arrested under provisions including the Unlawful Activities (Prevention) Act, the Bharatiya Nyaya Sanhita, the Arms Act, the Narcotic Drugs and Psychotropic Substances Act and the Explosive Substances Act. The network, which Indian authorities describe as backed by Pakistan’s Inter-Services Intelligence (ISI), is associated with grenade, IED and petrol-bomb attacks, targeted killings, espionage and the movement of weapons and narcotics into India. The seizures during the crackdown included IEDs, grenades bearing Pakistan Ordnance Factory markings, pistols, live ammunition and CCTV equipment allegedly intended for surveillance. More than 80 FIRs have also been cited in connection with the network. Lethal Operation At the centre of this sprawling operation is Shahzad Bhatti, a Pakistani gangster from Bahawalnagar in Punjab province who has reinvented himself online as a digital influencer and alleged proxy of the ISI. Also spelled ‘Shehzad Bhatti’, he is known by his moniker - “Don of Punjab” - in Pakistani criminal circles. On social media he presents a very different persona as a digital influencer and reel creator, with an online reach reportedly running into hundreds of thousands. Bhatti has multiple criminal cases in Pakistan and cannot safely return there, according to officials, helping explain his reported movements between Pakistan, the Gulf and Europe, including Dubai and Portugal. Intelligence inputs describe him as a Pakistan-based underworld gangster who allegedly operates as an associate, proxy or operative of the ISI. Rather than sending trained militants across the border, Bhatti and his associates have built an online distributed network of vulnerable Indian recruits who can be hired, tasked and discarded remotely. What makes Bhatti’s model distinctive, according to Indian investigators, is that he does not rely on traditional underground militant cells. Instead, he built an open, social-media-driven recruitment machine reportedly amassing roughly 2.5 lakh (250,000) followers on Instagram and over 4.5 lakh (450,000) on Facebook, a following more typical of an online influencer than a terror handler. He used this reach to identify and contact young men across India, offering money, and in some cases promises of help settling abroad, in exchange for small tasks like putting up posters, to reconnaissance, to smuggling and indulging in violence. Intelligence inputs describe Bhatti’s associates operating multiple social-media accounts, sometimes distinguished by numerical suffixes, and aggressively reaching out to potential recruits. The network uses Instagram, WhatsApp, Telegram, Signal, Snapchat, YouTube and other platforms to identify people who appear susceptible to money, status, gangster culture or the promise of adventure. The pool is said to include unemployed young men, petty criminals, people with substance dependencies and others in financial distress, particularly those aged between 18 and 25. Yet recruitment is not necessarily confined to a particular religion, region or ideological constituency. Social-media profiles, criminal associations and word-of-mouth contacts can be enough. A recruit might initially be offered a few thousand rupees to put up posters carrying the name “Tehreek-e-Taliban Hindustan”, an entity that investigators describe as a fabricated front rather than an established independent organisation. Recruits were typically paid as little as Rs. 5,000 for such tasks, with payments escalating to as much as Rs. 3 lakh for targeting and killing police personnel. From there, assignments can become progressively more serious: taking photographs of a police station, transferring money, transporting material, conducting reconnaissance or facilitating the movement of weapons. Investigators describe this as a “proof of work” model. The recruit is paid for a relatively minor task, creating trust and demonstrating reliability before the next assignment arrives. The financial rewards rise with the danger. The recruit does not necessarily need to understand the entire conspiracy. He does not need to know the handler’s identity, the ultimate target or the location of the weapons. He needs only to complete the task in front of him. That compartmentalisation makes the network resemble a gig economy for violence. There is an important reason to resist describing every recruit as a terrorist in the conventional sense. Many of the people caught in these investigations appear to have entered the network without a deep ideological commitment. One recruit was a biryani seller. Another was a ginger vendor. Another was a money lender. Investigators have also named recruits including Sonu Meena, Sachin, Sohail, Md Rihan, Arif and Md Kaif. The traditional terrorist organisation invests heavily in ideological indoctrination and training. Bhatti’s model, as described by Indian agencies, can dispense with much of that investment. It can recruit someone who is already attracted to guns, gangsters or easy money and give him a job. The recruit may believe he is helping a gangster. He may think he is committing an ordinary crime. He may not understand that the target has been selected for political, religious or security reasons. By the time he recognises the larger purpose, he may already be implicated. That makes the network simultaneously more dangerous and more difficult to detect. According to Indian officials, the network’s objective was to sustain a persistent, low-intensity campaign of violence and destabilisation rather than a single large-scale attack. The objective of SBN is not necessarily to mount a spectacular attack but to make violence cheap and repeatable by keeping up a low-intensity campaign inside India by outsourcing individual acts to people who may never meet one another or even understand the organisation they are serving. Reported and alleged elements of the plan included reconnaissance of sensitive sites. Local recruits were paid to scout police stations, defence installations and religious sites, and to install hidden surveillance cameras to feed intelligence back to handlers. The network was also associated with grenade, IED and petrol-bomb attacks, including a grenade attack on the Gurdaspur City Police Station and other border-district police posts in Punjab, using explosives allegedly supplied through Bhatti’s smuggling channels. Targeted killings of police personnel and other individuals, including attacks tied to religious or political grievances, such as the Jalandhar influencer’s house and the home of a BJP leader was another aspect. Arms and narcotics trafficking formed another part of the alleged operation, with weapons and heroin (“chitta”) being smuggled from Pakistan through Punjab into Delhi-NCR to fund operations and arm recruits. Online radicalisation and recruitment without requiring any real ideological commitment completed the model. Security officials describe this as a deliberate strategy: rather than infiltrating trained militants, Bhatti’s network sought to weaponise ordinary, financially vulnerable Indian youth as low-cost, easily replaceable “foot soldiers”, making the network harder to fully dismantle even after individual cells are broken up. What makes the Bhatti network so lethal is that it merges Pakistan-backed terrorism with organised crime, narcotics trafficking and the social-media economy by preying on young, financially vulnerable youths, often with a criminal record. The recruit is sometimes barely aware that the seemingly petty job he has agreed to perform is part of a cross-border terror operation. Bhatti’s power is his ability to turn the internet into a recruiting market. Investigators describe a “dead-drop” delivery system for smuggled narcotics and weapons to avoid detection, and say Bhatti operated jointly with an aide identified as Ajmal Gujjar, running arms, ammunition and narcotics smuggling from Pakistan through Punjab into Delhi-NCR for further distribution. Bhatti and his associates have used dead-drop arrangements for weapons and narcotics, with consignments moving from Pakistan through Punjab and onward towards Delhi-NCR. The same infrastructure can serve multiple purposes: drugs can finance criminal operations, weapons can arm recruits, and the criminal network can provide cover for terror activity. Money can travel through hawala, cash, UPI, digital wallets, USDT and cryptocurrencies, according to the intelligence assessment, creating multiple channels for financing and making the trail harder to follow. Bhatti is also alleged to be a rival of jailed Indian gangster Lawrence Bishnoi, even as separate leaked videos purportedly showed contact between Bishnoi and Bhatti, prompting a Gujarat government probe. His associates have included Abid Jatt, Ajmal Gujar, Rana Hunain, Suhail Baloch and others involved, according to intelligence assessments, in recruitment, tasking, funding and cross-border arms trafficking. Associates such as Abid Jatt alias Abid Chhal, Ajmal Gujar, Munna Zingada, Hammad Memon, Rana Hunain and Yawar Khan have also been identified in intelligence inputs as part of the wider ecosystem around Bhatti. Criminal Trail The criminal cases associated with SBN illustrate the range of its alleged activities. In February 2026, two Punjab Police personnel were shot dead at a police post in Gurdaspur near the Pakistan border by unidentified assailants. In May, the group calling itself Tehreek-e-Taliban Hindustan claimed responsibility for the killing of Assistant Sub-Inspector Joga Singh and publicly declared security personnel and RSS members to be targets. In March 2025, investigators believed SBN-linked elements were involved in a grenade attack on the residence of BJP leader Manoranjan Kalia in Jalandhar. Another case involved Rozer Sandhu, a Punjab-based social-media influencer whose house was allegedly attacked with a grenade after Bhatti accused him of disrespecting Islam online. Punjab Police arrested nine people in that case, including the alleged principal accused, Hardik Kamboj of Haryana. Two petrol bombs were also hurled at an RSS office in Nivaranpur, Ranchi, during the night of June 16, 2026. Separately, a 20-year-old man named Krish Rai was arrested in Rajasthan for allegedly filming police stations in Hanumangarh and Raisinghnagar and sending the footage and coordinates to a person claiming to be Bhatti. Delhi Police’s Special Cell has separately investigated a Bhatti-linked terror-gangster module under FIR No. 126/2026, arresting, among others, Vijay alias Shooter Rajaram Baja of Pune, Sajid Mehboob Shaikh alias Arbaz, Hujaifa Farukh Ahmed Hashmi and Taukir Rizwan Ahmad, residents of Kurla in Mumbai. Other investigations show the network’s reliance on reconnaissance. Uttar Pradesh ATS has alleged that Daniel Ashraf Ansari received reconnaissance assignments involving sensitive locations. In Ghaziabad, police uncovered an online-radicalisation module involving geo-tagged photographs of military and strategic locations. The network has also been linked, through associate Zeeshan Akhtar, a Jalandhar-based criminal with a history of organised crime, murder and robbery, to the 2024 Mumbai murder of NCP leader Baba Siddique. Akhtar has been accused of providing logistical support and information to the shooters and subsequently fleeing India with assistance from Bhatti. The alleged involvement of Zeeshan Akhtar adds another dimension to the network’s crime-terror nexus. In India, Bhatti faces at least 15 registered cases in Punjab alone, including cases involving the targeting of police personnel in the border districts of Gurdaspur and Amritsar Rural. By middle of this year, Indian authorities have begun referring officially to the Shahzad Bhatti Network as a Pakistan-based, ISI-backed terror syndicate. Geographical Footprint The network’s geographical footprint is striking. Additional cases have surfaced around the India-Bangladesh border in West Bengal. The map matters because it suggests that the network is not simply exploiting Punjab’s proximity to Pakistan. It is attempting to build a distributed Indian supply of manpower. More than 90 FIRs have been registered in cases attributed to or associated with SBN, with more than 200 people arrested under provisions including the UAPA, BNS, Arms Act, NDPS Act and Explosive Substances Act. Punjab and Haryana were also searched separately by the National Investigation Agency, which has opened several cases connected to Bhatti. The threat became particularly acute ahead of Independence Day. On August 12, authorities mounted coordinated operations across 14 states and Union Territories. A total of 253 individuals were detained: 62 in Uttar Pradesh, 52 in Haryana, 51 in Delhi, 44 in Punjab, 15 in Rajasthan, eight in Maharashtra, five in Uttarakhand, three each in Karnataka and Gujarat, and two each in Telangana, Himachal Pradesh, Jammu and Kashmir, Bihar and Kerala. FIRs were also registered against suspected SBN associates in Delhi and Karnataka. The operation was the culmination of the intelligence-sharing system developed over the preceding nine months. More than 100 Instagram handles shared with various state police forces and linked to SBN have also been blocked. Cyber patrolling further revealed that Pakistan-based members of SBN were shifting to new social-media accounts, although a decline in Indian followers of SBN has also been noticed. The crackdown disrupted the digital infrastructure through which the network sought to replenish itself. For Maharashtra, the warning is especially serious because the state figures prominently in the network’s wider geographical spread and in cases involving Mumbai and Pune-based suspects. The concern expressed by investigators is that an SBN-linked incident could be attempted through a person who would not ordinarily attract the attention of a counter-terrorism unit. The appropriate response therefore cannot rest solely on conventional counter-terrorism surveillance. Local policing, cyber intelligence, crime branches and specialised counter-terrorism agencies have to connect information that would otherwise remain in separate silos. The lesson of SBN is precisely that the first indication of a terror plot may look like a minor crime. But the crackdown also demonstrates the capacity of Indian intelligence and policing agencies to identify, map and disrupt it before a diffuse network of petty criminals and vulnerable youths can be turned into a larger instrument of violence. A Low-Cost War Bhatti’s network is emblematic of the changing nature of Pakistan’s confrontation with India. The traditional image of a proxy war involves a militant trained across the border, supplied with weapons and infiltrated into India. The newer model can be far more fragmented. Instead of relying exclusively on trained ideological cadres, Bhatti’s network uses social media and encrypted platforms to identify people who appear susceptible to money, status, gangster culture or the promise of adventure. The network does not necessarily require a large standing army of militants. It requires a steady supply of people willing to do small things for money. That is what makes the model potentially more resilient than a conventional cell structure. The Indian state’s response will consequently have to extend beyond arresting handlers and recovering explosives. It will have to disrupt the economic and social machinery that allows criminal networks to convert vulnerability into violence: narcotics, illegal finance, weapons trafficking, online influence and the culture of gangster celebrity that gives such networks an aspirational sheen. The case of Shahzad Bhatti points to a potentially consequential evolution in asymmetric warfare: the outsourcing of terrorism to the criminal margins of society, managed from abroad but executed by people recruited inside India. The Dawood Connection The underworld-terrorist nexus is not new to India. From the 1970s onwards, the underworld in Mumbai gained strength through smuggling of contraband, and in the 1980s, inter-gang rivalry spilled onto the streets of Mumbai. The situation only worsened in the next decade with the Dawood Ibrahim syndicate emerging strongest by decimating rival gangs and spreading its criminal tentacles across the globe. While Dawood flew out to Dubai at the end of the decade, he continued to maintain his stranglehold of various sectors of Mumbai’s economy including the construction and film industries in particular and the business world in general. In the 1990s, the syndicate forged links with Pakistan’s ISI and assisted in the training of Indian youths in PoK. Most infamously, the Dawood syndicate assisted in the ‘Shekhadi landings’ – the illegal smuggling of nearly 3,000 kg of RDX supplied by ISI, weapons, and ammunition onto the Raigad coast in early February 1993, which was used to execute the Mumbai serial blasts that year, which killed 257 people while injuring 1400 more. By this time, Dawood had shifted to Pakistan and it was his key associates – Tiger Memon. Yakub Memon, Abu Salem and others who had carried out the ghastly blasts, which exposed the ISI-underworld nexus for the first time. Cut to 2026. One of Dawood’s cronies – Munna Zhingada (real name: Syed Mudassar Hussain) has been identified along with several others as part of the SBN. Munna is a Mumbai-born gangster and former top hitman of the Dawood gang who operates from Karachi, Pakistan as a key operative for the ISI. He gained notoriety in 2000, almost 10 years after joining the gang when he was sent to Bangkok as part of a hit squad to kill Chhota Rajan, Dawood’s former aide-turned-rival. Munna was arrested there and became the centre of a tug-of-war between India and Pakistan with both providing citizenship proofs. Pakistan claimed him to be one Mohd. Saleem, a Pakistani national. This was accepted by the Thai courts in 2019 which handed Munna to Pakistan. The SBN is even more sinister than it appears in its current form as Munna’s role is to act as bridge between the ISI and criminal networks as well as the Indian underworld. As was revealed in investigations, Munna uses social media and encrypted apps to recruit vulnerable youths in Mumbai and other Indian cities for espionage and terror plots.
Comments