Uttar Pradesh has emerged as a prime target in Pakistan’s evolving digital extremism and sleeper cell recruitment strategy, with the anti-terrorism agency’s recent arrests and investigations in multiple districts revealing an expansive network allegedly operated through social media by Pakistan-based gangster Shahzad Bhatti and handlers linked to the Inter-Services Intelligence (ISI), senior central and state security agencies said.
Security agencies say the network reflects a new-age “hybrid threat” model, where online extremism, espionage, organized crime and covert anti-India activities are increasingly integrated through decentralized, embedded civilian units that are difficult to detect.
The revelations come in the wake of one of the biggest coordinated crackdowns in recent years, during which central agencies and anti-terrorism units carried out simultaneous raids across Uttar Pradesh, Delhi, Haryana, Punjab, Rajasthan and Madhya Pradesh earlier this week. About 300 suspects were detained for interrogation and digital scrutiny.
Investigators believe Bhatti was working as a proxy digital recruiter who used Instagram, YouTube and encrypted communication platforms to identify and influence vulnerable Indian youth, especially in northern states.
Read also: A Nigerian national is detained in Delhi on charges of running an online fraud network: UP STF
According to officials, Bhatti projected a carefully curated image of wealth and influence through videos showing luxury cars, foreign travel, lavish villas, expensive resorts and wads of cash. The agencies suspect that the content was designed to attract impressionable youth seeking money, identity and social status before gradually exposing them to extremist narratives and covert operational missions.
Uttar Pradesh has become increasingly vulnerable because of its large youth population, widespread smartphone penetration, and the rapid spread of influence networks on social media, officials said.
In Rampur district, agencies are investigating links to a local youth, Ghias Pasha, who was allegedly in contact with Bhatti through social media platforms. Investigators suspect that several other young people from the area, aged between 20 and 25, may also have interacted with the online network.
Fears deepened after UP ATS recently arrested two youths, Hizbullah Ali Khan alias Tusshar Chauhan from Meerut and Sameer Khan from Seemapuri in Delhi, both around 20 years old and allegedly in the initial stages of online indoctrination.
A senior ATS officer said the two were not militant activists but vulnerable recruits undergoing systematic digital luring. Their alleged handlers, Shahzad Bhatti and his accomplice Abid Jat, are said to have used Instagram and similar platforms to build trust before providing extremist content and operational directives.
UP Director General of Police (DGP) Rajeev Krishna said the recent cases across the state and NCR region indicate an emerging ‘hybrid threat’ pattern where social media extremism, criminal activity and espionage are being coordinated by foreign handlers.
“These are not isolated cases. Youth are first lured by simple criminal activities or financial inducements, and then gradually pushed towards more serious anti-national acts,” Krishna said.
He added that decentralized units operating through encrypted platforms and civic spaces made detection more difficult, though timely intervention by UP Police and ATS helped avert potential incidents.
Read also: Lucknow is staring at 44 degrees Celsius amid heatwave warning in UP
Investigators said the evolving strategy represents a shift away from traditional organized terror units toward small, seamless digital networks capable of conducting reconnaissance, propaganda dissemination, sabotage and low-intensity attacks.
In Ghaziabad, agencies recently dismantled an alleged spy network that included about 21 arrests, including the arrest of a woman. Investigators alleged that the accused shared videos and locations of sensitive facilities with Pakistan-based therapists in exchange for money while using civilians with local access to avoid suspicion.
In Bijnor, police uncovered another unit accused of publishing videos with firearms, engaging in arson and damaging railway signal infrastructure. Investigators said the group had explored plans to target auto showrooms in the NCR and western UP region while trying to create panic by disrupting transport systems.
Security agencies said rail infrastructure was increasingly viewed as a vulnerable target, because even limited sabotage of signaling systems could disrupt large parts of the transport network.
Investigators also pointed to previous cases involving fugitive gangster Shariq Satha, whose alleged links with his handlers in Pakistan came to light during the investigation into the Sambhal violence in November 2024 in which four people were killed.
The agencies are now mapping digital footprints, financial transactions and communication patterns between states to determine the full extent of the alleged ISI-backed ecosystem that operates through scattered networks across UP and northern India, officials said.
