Shahzad Bhatti Network: Pak’s New Terror Architecture Inside India

That is what makes the Bhatti network particularly significant. The network has been described by Indian agencies as Pakistan-based and ISI-backed. Its alleged activities range from arms, explosives and narcotics smuggling to targeted attacks, reconnaissance, recruitment and radicalisation. Most importantly, its reach inside India is not dependent on a conventional cross-border infiltration by trained terrorists. It works through Indian recruits who can be contacted, motivated, paid and directed from across the border.

The August crackdown revealed the scale of the problem. Security agencies detained 253 people across 14 states on August 12, ahead of Independence Day. More than 80 FIRs and over 200 arrests have subsequently been recorded in cases involving the network. IEDs, pistols, ammunition, surveillance equipment and grenades bearing Pakistan Ordnance Factory markings were among the reported recoveries.

The geographical spread is itself a warning. Uttar Pradesh accounted for 62 detentions, Haryana 52, Delhi 51 and Punjab 44. Rajasthan recorded 15, Maharashtra eight and Uttarakhand five, while Karnataka, Gujarat, Bihar, Telangana, Himachal Pradesh, Jammu and Kashmir and Kerala also figured in the operation. This was therefore not simply a Punjab problem or a border-state problem.

The most important transformation lies in the method of recruitment. Traditional Pakistan-sponsored terrorism depended heavily on infiltration, physical handlers and established militant organisations. The Bhatti model, according to Indian investigators, adds another layer - the mobile phone becomes the border.

Bhatti has allegedly used social-media platforms to identify and cultivate young Indians. Investigators say vulnerable young people and local criminals were approached online and subsequently drawn into activities ranging from reconnaissance and transportation of weapons to attacks. Uttar Pradesh Police had specifically sought action under Section 35 of the UAPA, citing allegations that the network used social media to connect with and radicalise young Indians.

This is a dangerous evolution because it lowers the cost of terrorism. A foreign handler does not have to send ten trained terrorists across the border when he can recruit ten Indians already living in the target country. He does not have to establish an elaborate clandestine infrastructure if social media can establish the first contact and encrypted communications can carry instructions. He does not have to personally transport every weapon if drones can deliver consignments across the border and local networks can move them onward. Terrorism becomes decentralised.
Bhatti's significance also lies in the merger of two worlds that were once treated separately: organised crime and terrorism.

ALSO READ: Bengal’s Madrasa Question: Who Allowed 2,396 to Operate?

The NIA has been investigating three cases linked to Bhatti. These include the March 2025 grenade attack at the residence of social-media influencer Roger Sandhu in Jalandhar, the November 2025 explosion at the Women's Police Station in Sirsa and the January 2026 blast at Baldev Nagar police station in Ambala.

In June, the NIA conducted searches at 18 locations across Punjab and Haryana in connection with these cases. The agency said its investigation had traced the Jalandhar attack to Bhatti and alleged that he masterminded the Sirsa and Ambala attacks. In the Sirsa case, the NIA had chargesheeted nine accused, including Bhatti and Pakistan-based handler Sohail Ahmad alias Sohail Baloch. Bhatti was also chargesheeted as an absconder in the Jalandhar case. The significance goes beyond these individual attacks.

Criminal networks already possess money channels, contacts, weapons suppliers, transport arrangements and people willing to undertake illegal activities. Terror handlers can exploit precisely this infrastructure. Conversely, organised criminals can acquire ideological or political objectives and become instruments of a state-sponsored terror strategy. This is the terror-gangster nexus in its most dangerous form.

There is another component that cannot be ignored - narcotics. The August crackdown involved cases under the NDPS Act alongside UAPA, the Arms Act, the BNS and the Explosive Substances Act. Indian agencies have also been investigating the movement of weapons and narcotics through cross-border channels. The combination is strategically important. Drugs generate money. Money finances criminal networks. Criminal networks provide manpower and logistics. Terror handlers provide direction and weapons. The result is a self-reinforcing ecosystem in which crime finances terror and terror protects the criminal ecosystem.

This is why looking at the Bhatti network merely as another terrorist organisation would be inadequate.
It is a hybrid security threat.

ALSO READ: If Modi Had Not Happened 

For decades, India's principal complaint against Pakistan has been its use of terrorism as an instrument of state policy. The organisational names and methods have changed, but the underlying objective of creating instability inside India has remained a recurring feature of India's security assessments.
What appears different now is the delivery mechanism.

The Bhatti network allegedly combines Pakistan-based direction with Indian manpower, social-media recruitment, narcotics, drone-based smuggling, surveillance and locally executed violence. Reports on the August operation said investigators recovered grenades bearing Pakistan Ordnance Factory markings, alongside weapons, explosives and surveillance equipment.

The significance of such recoveries is obvious - they provide investigators with physical evidence that can potentially connect local criminal activity to cross-border supply chains. The old question was - Who crossed the border? The new question is- Who inside India has been recruited, financed, supplied or directed from across the border? That is a much wider security challenge.

There is an uncomfortable lesson here for India's internal security establishment. Counter-terrorism can no longer be confined to border surveillance, intelligence files and physical weapons caches. The first stage of recruitment may happen in a bedroom thousands of kilometres away from the international border.

A young person may first encounter a gangster image rather than a terrorist ideology. Money may precede ideology. Criminal glamour may precede radicalisation. A promise of employment or easy money may be the first bait. This makes the Bhatti model particularly insidious. It also demonstrates why the fight against terrorism cannot be separated from the fight against organised crime, drug trafficking and online radicalisation.

Maharashtra recorded eight detentions during the August operation. That number is much smaller than the figures reported from Uttar Pradesh, Haryana, Delhi and Punjab, but it is nevertheless significant because Maharashtra has historically been a major target and transit point for organised criminal networks and terror conspiracies. The larger lesson is that no state can assume that geography provides immunity from a network designed to operate remotely.

ALSO READ: Mother’s Final Blessing: Son wins Rajasthan civic poll due to her last vote 

The government's decision to invoke the UAPA's terrorist-organisation framework is therefore significant. It formally moves the Bhatti network beyond the category of an ordinary criminal gang or a collection of disconnected terror cases. That matters because dismantling such a network requires more than arresting the people who actually throw grenades or transport weapons.

Investigators have to follow the money. They have to identify the recruiters. They have to identify the handlers. They have to map the communication channels. They have to trace the weapons. They have to uncover the drug networks. And, most importantly, they have to find the people who convert foreign instructions into local action.

The Bhatti case should therefore be viewed as a warning about the future of terrorism. The terrorist of tomorrow may not arrive wearing a militant uniform. He may arrive as a gangster. He may be recruited through Instagram. He may receive money through an apparently ordinary financial transaction. He may collect a weapon dropped by a drone. He may be asked first to conduct reconnaissance and only later to participate in an attack. That is precisely why the Bhatti network represents a qualitatively different challenge.

Pakistan's proxy war, if the allegations being investigated by Indian agencies are established, is adapting to a new technological and criminal environment. The battlefield is no longer only the border. It is the smartphone, the drug route, the financial channel, the local criminal network and the social-media ecosystem. India's response therefore cannot stop with banning one organisation.

The Bhatti network must be dismantled at every level—from the Pakistani handler to the Indian recruiter, from the drone-delivered weapon to the financial channel, from the social-media contact to the final target. The real victory will not be the declaration of a terrorist organisation.

It will be the destruction of the ecosystem that allows a Pakistan-based handler to turn an Indian criminal, a vulnerable youth or an online follower into an instrument of terror. That is the battle India has now been forced to recognise.