Between February and May 2026, security agencies across India uncovered a series of seemingly unrelated incidents stretching from Punjab to Uttar Pradesh, Rajasthan, Delhi, Haryana, Uttarakhand, Telangana and Maharashtra. Some involved targeted killings of police personnel. Others centred on espionage, reconnaissance of sensitive locations, social media recruitment, sleeper cells, grenade attack plots and the emergence of a previously unknown organisation called Tehreek-e-Taliban Hindustan (TTH). Initially, these incidents appeared disconnected. A police checkpoint attack in Punjab. A graffiti campaign in Hoshiarpur. A reconnaissance module in Hapur. A surveillance network in Ghaziabad. A recruitment cell in Noida. A weapons procurement effort in Delhi-NCR. A statewide probe in Maharashtra. Taken individually, each case appeared limited in scope.

However, as investigations progressed, one name repeatedly surfaced in police dossiers, charge sheets, ATS investigations and intelligence assessments: Shahzad Bhatti. Over a period of months, investigators from Punjab Police, Delhi Police Special Cell, Uttar Pradesh ATS, Rajasthan ATS, Maharashtra ATS, the National Investigation Agency (NIA), and other agencies confirmed that Bhatti was operating far beyond the role of a conventional gangster. According to multiple investigations, his network functioned as a bridge between organised crime, online radicalisation, espionage, recruitment, propaganda operations and terror-linked activities.

The picture emerging from these investigations points toward a decentralised ecosystem that relies on social media recruitment, encrypted communication, criminal facilitators and local operatives rather than a traditional hierarchical terror organisation.

Key Findings

Emergence of TTH

• Tehreek-e-Taliban Hindustan (TTH) emerged publicly after the killing of ASI Gurnam Singh and Home Guard jawan Ashok Kumar in Punjab on 22 February 2026.
• The group subsequently claimed responsibility for additional attacks, including the killing of ASI Joga Singh in May 2026.
• Investigators linked TTH propaganda, recruitment campaigns, and operational activities to Shahzad Bhatti and his associates.

Development of a Multi-State Espionage Network

• Security agencies uncovered surveillance and reconnaissance modules operating across Uttar Pradesh, Rajasthan, Delhi, Uttarakhand, Telangana, and Punjab.
• Recruits gathered photographs, videos, GPS coordinates, route information, and observations relating to sensitive locations.
• Several investigations identified direct communication with Pakistan-based handlers.

Social Media Recruitment Architecture

• Recruiters primarily used Instagram, WhatsApp, Telegram, gaming platforms, and encrypted messaging applications.
• Young individuals were targeted through low-risk assignments before being introduced to more sensitive operational activities.
• Investigations revealed deliberate recruitment of women, minors, and economically vulnerable youth.

Transition from Reconnaissance to Attack Planning

• Multiple investigations uncovered plans involving grenade attacks, targeted shootings, extortion-linked violence, and attacks on religious sites, public locations, and military-sensitive facilities.
• Operational cells in Delhi-NCR, Punjab, Uttar Pradesh, and Haryana demonstrated increasing organisational sophistication.

Emergence of a Hybrid Gangster-Terror Model

• Intelligence assessments suggested increasing integration between criminal syndicates, extremist organisations, recruiters, propagandists, and foreign handlers.
• Security agencies viewed the model as an evolution of previously observed criminal-terror linkages in Punjab.

Who is Shahzad Bhatti?

A Pakistan-based underworld figure with ties to the Inter-Services Intelligence (ISI), Shahzad Bhatti has emerged as a mastermind in multiple espionage, terror recruitment, reconnaissance, and targeted killing investigations across India. Indian security agencies describe him as a gangster-turned-terrorist who coordinates with Pakistan-based handlers and recruits Indian youth through social media platforms, offering financial incentives for surveillance of sensitive installations, attacks on security personnel, smuggling operations, and other criminal activities. His known associates include Pakistan-based operatives Abid Jutt and Ajmal Gujjar.

Shahzad Bhatti originates from Pakistan’s Punjab province. While he presents himself on social media as a businessman, social worker, and commentator on religious and social issues, law-enforcement records and intelligence assessments paint a different picture. According to Pakistani police records, authorities registered multiple criminal cases against Bhatti in 2013, including theft and robbery. In the years that followed, he also faced more serious allegations, including rape. Around 2015, Bhatti reportedly left Pakistan and relocated to Dubai, where he became involved in the dairy business.

During his time in the UAE, Bhatti established links with the Farooq Khokhar gang, a criminal network with roots in Balochistan, eventually emerging as one of its key associates. Operating under the digital signature “333”, he built an online following through videos discussing religious controversies, India-Pakistan relations, and social issues before gradually transforming that influence into a cross-border criminal and recruitment network.

Indian intelligence agencies and the Delhi Police Special Cell have identified Bhatti as the mastermind behind the emergence of Tehreek-e-Taliban Hindustan (TTH), a group that first surfaced following the February 2026 killing of two Punjab Police personnel in Gurdaspur.  Bhatti also cultivated links with organised crime figures across South Asia. His name surfaced prominently during the investigation into the murder of NCP leader Baba Siddique after Mumbai Police alleged that Zeeshan Akhtar, a key operative of the Lawrence Bishnoi gang and one of the accused in the case, received assistance from Bhatti after fleeing India. The connection drew further attention when Akhtar publicly thanked Bhatti in a 2025 video message and referred to him as his “elder brother.”

Bhatti previously maintained an alliance with jailed Indian gangster Lawrence Bishnoi. However, following the April 2025 Pahalgam terror attack, the relationship deteriorated into a bitter cross-border rivalry. The fallout triggered a wider gangland conflict that extended beyond India. Individuals claiming links to the Bishnoi syndicate later took responsibility for attacks on locations where Bhatti was reportedly staying, including a property in Portugal. Media reports throughout late 2025 and early 2026 also suggested that Bhatti survived multiple assassination attempts abroad, including incidents in Brazil and Portugal allegedly linked to rival Punjab-based gang networks.

Despite mounting scrutiny from Indian security agencies, Bhatti remains active on social media and continues to feature prominently in investigations involving espionage networks, terror recruitment, grenade attack conspiracies, targeted killings, reconnaissance operations, and the expansion of Tehreek-e-Taliban Hindustan. Multiple investigations by Punjab Police, Delhi Police Special Cell, UP ATS, Rajasthan ATS, Maharashtra ATS, and the National Investigation Agency have linked his name to an evolving cross-border ecosystem that combines organised crime, propaganda, recruitment, surveillance, and terror facilitation.

TTH: Emergence and Targeted Killings

On 22 February 2026, while national attention remained focused on counter-terror operations in Kishtwar, Jammu and Kashmir, three attackers identified as Ranjit Singh, Indrajeet Singh and Dilawar Singh targeted the Adda Adian police checkpoint near Dorangla in Punjab’s Gurdaspur district. The attackers opened fire on ASI Gurnam Singh and Home Guard jawan Ashok Kumar, killing both personnel and recording the attack on video. Their bodies were discovered the following morning when a police team reached the checkpoint.

Shortly after the killings, a previously unknown organisation calling itself Tehreek-e-Taliban Hindustan (TTH) claimed responsibility. The claim immediately raised questions within the security establishment, as no such organisation had previously existed and Tehreek-e-Taliban Pakistan had never announced the formation of an Indian branch.

On 24 February 2026, Pakistan-based gangster Shahzad Bhatti released footage of the attack, immediately drawing the attention of Indian security agencies. A day later, Punjab Police arrested Ranjit Singh, one of the accused involved in the killings. According to investigators, Ranjit escaped custody after a police vehicle transporting him overturned in Gurdaspur district. Security forces quickly launched a search operation and tracked him to Nawapind Bahadur village, where an encounter took place. Police stated that Ranjit opened fire on pursuing officers, prompting retaliatory fire that fatally wounded him.

Following the encounter, DIG Sandeep Goel disclosed that investigators had uncovered links between the attackers and Pakistan-based handlers. Punjab Police alleged that Ranjit Singh, Dilawar Singh, and Indrajeet Singh maintained contact with operatives linked to Pakistan’s Inter-Services Intelligence (ISI), conducted reconnaissance of the Adda Adian checkpoint before the attack, and agreed to carry out the killings in exchange for ₹4 lakh. Investigators subsequently expanded the probe to trace the financial transactions, communication channels, and handler network behind the operation.

Three months later, on 24 May 2026, unidentified motorcycle-borne assailants shot dead ASI Joga Singh of Amritsar Police while he was travelling to report for duty near Majitha. The attackers opened fire at close range before fleeing the scene. The killing marked the third fatal attack on Punjab Police personnel in less than three months.

Hours after the assassination, a poster attributed to Tehreek-e-Taliban Hindustan surfaced on social media claiming responsibility. The statement credited the attack to an “Al-Burak Squad” and threatened further attacks against police personnel, security forces, government officials and military targets. Soon afterwards, a video of the killing circulated online through channels linked to TTH and networks associated with Shahzad Bhatti.

The significance of TTH increased further on 24 May 2026 when a Times of India investigation identified Pakistan-based gangster Shahzad Bhatti as the central figure behind the outfit’s propaganda and recruitment activities. According to Delhi Police Special Cell officials cited in the report, investigators linked Bhatti to multiple TTH-related operations, including graffiti campaigns in Delhi, Faridabad and Punjab, as well as recruitment efforts aimed at preparing operatives for grenade attacks and targeted violence. One such investigation involved the arrest of Sohail, who painted TTH graffiti at Bhatti’s direction to create visibility for the organisation. Investigators claimed Bhatti instructed him to include the letter “S” beneath the TTH acronym as a personal signature and provided financial support from Pakistan for the campaign.

In a separate operation, Delhi Police Special Cell arrested several youths who were in direct contact with Bhatti and his associates, including Abid Jutt and Ajmal Gujjar. According to investigators, the suspects were instructed to produce videos displaying firearms, spread TTH propaganda, and prepare for attacks on police personnel in exchange for financial rewards.

By May 2026, investigators increasingly assessed that TTH was not an independent organisation but a proxy platform used by Shahzad Bhatti and Pakistan-based handlers to combine propaganda, recruitment, terrorism and targeted violence under a single banner. The outfit operated with support from networks linked to Pakistan’s ISI and formed part of a broader effort to establish new hybrid criminal-terror structures inside India.

Spy, Surveillance and Reconnaissance Network

Hapur Reconnaissance Cell

In March 2026, intelligence agencies uncovered a reconnaissance and surveillance module operating in western Uttar Pradesh following the arrest of Azeem Rana of Dhaulana, Hapur, and Azad Rajput of Meerut. According to investigators, both individuals had maintained contact with Pakistan-based handlers through social media platforms and encrypted communication channels. The investigation revealed that the accused had allegedly been gathering photographs, videos, and location-specific information relating to religious sites, transportation infrastructure, and public spaces before transmitting the material across the border.

Investigators claimed that on 19 February 2026, the accused shared multiple videos and photographs with their handlers in Pakistan. Among the locations reportedly surveyed were the Sanatan Dharma Temple in Delhi, the Ravana Temple in Greater Noida, Ramesh Nagar Metro Station, and several other public locations. Security agencies believe the reconnaissance activities were intended to provide situational awareness, crowd assessments, access routes, and security arrangements at potential targets. According to investigators, the accused received financial incentives in exchange for collecting and transmitting information. During the probe, authorities also established alleged links between the accused and Pakistan-based gangster Shahzad Bhatti.

Sri Ganganagar Reconnaissance Module

On 27 March 2026, Rajasthan Police arrested Akashdeep (20), a resident of Sri Ganganagar district, for conducting reconnaissance activities on behalf of Pakistan-based handlers. According to investigators, Akashdeep maintained regular contact with Shahzad Bhatti and other Pakistan-based operatives through Instagram, WhatsApp, and international phone numbers. Police stated that he had been tasked with collecting videos, photographs, route information, and crowd assessments from multiple locations across Punjab, Rajasthan, Delhi, Chandigarh, and Haryana.

During interrogation, Akashdeep admitted to filming crowded public areas, strategically important locations, and transportation routes before transmitting the material to handlers in Pakistan through encrypted communication channels. Authorities recovered his mobile phone and discovered conversations with several Pakistan-based contacts, along with digital material relating to the reconnaissance activities.

Ghaziabad Spy Ring

The Ghaziabad espionage case emerged as one of the largest Pakistan-linked surveillance and intelligence-gathering networks uncovered during 2026. Initially registered by local police in March 2026, the investigation later expanded into a multi-state operation involving the National Investigation Agency (NIA), intelligence agencies, and multiple state police forces. By the time NIA formally took over the probe, authorities had arrested more than twenty individuals, including several juveniles.

According to investigators, the network operated through a structured hierarchy involving recruiters, surveillance operatives, logistics facilitators, and technical specialists. The accused allegedly installed solar-powered surveillance cameras near sensitive locations and provided live access to handlers operating from Pakistan. Investigators claimed the network collected photographs, videos, GPS coordinates, route information, crowd patterns, and security assessments from strategically important locations. The information was then transmitted through encrypted communication platforms to foreign handlers.

The investigation identified Suhail alias Romeo as one of the principal operatives of the network, while Iram alias Mehak allegedly maintained direct communication with Pakistan-based handlers. Other accused included Praveen, Raj Valmiki, Shiva Valmiki, Hrithik Gangwar, Naushad Ali, and Meera, among others. According to investigators, Naushad Ali played a key role in recruitment and specifically targeted economically vulnerable youth possessing technical skills such as mobile repair, computer maintenance, and CCTV installation. Authorities further alleged that recruiters deliberately sought individuals with no significant criminal records in order to minimise law-enforcement scrutiny.

One of the most significant findings of the investigation was the alleged involvement of juveniles. NIA later filed an investigation report against five Juveniles in Conflict with Law (JCLs), alleging that they had assisted Pakistan-based handlers in obtaining photographs, videos, GPS coordinates, and other sensitive information relating to strategically important locations. Investigators claimed that some juveniles illegally entered restricted areas, helped install surveillance equipment, transmitted geo-tagged material, and facilitated the procurement of Indian SIM cards for use by Pakistan-linked operatives.

The probe also uncovered a deliberate identity-concealment strategy. According to authorities, several Muslim operatives adopted Hindu names, attire, and religious symbols to avoid suspicion while conducting reconnaissance activities. Suhail Malik operated under the alias “Romeo,” Naushad Ali using the name “Lalu,” Sameer using the alias “Shooter,” and Sane Iram posing as “Mahek.” Police also said that some members wore rudraksha beads, sacred threads, and applied tilak to blend into local environments while carrying out surveillance assignments.

“Pay-Per-Task” Recruitment Network

In May 2026, Rajasthan ATS launched one of its largest counter-intelligence operations, conducting raids at nearly 60 locations across 20 districts linked to a network associated with Shahzad Bhatti. The network operated on a “pay-per-task” model, recruiting individuals through social media, online gaming platforms, and encrypted messaging applications. Recruits were initially assigned low-risk tasks such as photographing railway stations, government buildings, cantonment areas, and public infrastructure in exchange for digital payments.

According to ATS, trusted recruits were gradually assigned more sensitive tasks, including reconnaissance of strategic locations, intelligence gathering, and propaganda activities. Investigators also found evidence suggesting that minors were being targeted through gaming platforms and social media.

The operation brought nearly 900 individuals across India under scrutiny, including around 60 from Rajasthan. During searches, ATS seized mobile phones and digital devices containing photographs and videos of military-sensitive locations, transportation infrastructure, and other sites of security interest. Authorities described the case as an example of a growing digital recruitment model that blends social media influence, financial incentives, and intelligence-gathering activities.

Attack Modules and Operational Cells

By April and May 2026, several investigations suggested a transition from reconnaissance to operational planning.

Delhi Police dismantled a Bhatti-linked module involving Rajveer and Vivek Banjara, who allegedly participated in weapons procurement, extortion-linked violence, and preparations for attacks in Delhi-NCR and Punjab.

UP ATS investigations uncovered additional modules tasked with:

• Recruiting new operatives
• Conducting target reconnaissance
• Procuring weapons
• Preparing grenade attacks
• Facilitating targeted killings

The May 2026 Special Cell operation further revealed alleged plans targeting:

• A historic temple in Delhi
• A popular dhaba on the Delhi-Sonipat highway
• A military installation in Hisar

Investigators stated that reconnaissance had already been conducted at several of these locations.

April 2026 | Delhi Police Bust Bhatti-Linked Target Killing Module

In April 2026, Delhi Police Special Cell dismantled an ISI-linked module operating under the direction of Pakistan-based gangster Shahzad Bhatti and preparing targeted shootings in the Delhi-NCR region. Acting on intelligence inputs regarding planned grenade attacks, target killings, and intimidation shootings, Special Cell registered an FIR on 31 March 2026 and launched an investigation. The first breakthrough came on 16 April when officers arrested Vivek Banjara from Dabra, Madhya Pradesh. His interrogation led investigators to Rajveer, who was arrested two days later from Delhi’s Sarai Kale Khan area.

Police recovered a pistol, six live cartridges, and mobile phones containing videos, voice notes, and communications linked to the conspiracy. According to investigators, Rajveer had been recruited online by an operative known as “Rana Bhai,” an associate of Shahzad Bhatti, and later introduced Vivek into the network. The investigation revealed that Bhatti allegedly directed the duo to procure weapons and prepare attacks. In March 2026, Vivek was sent to Ahmedabad to collect arms, while on 9 April both travelled to Amritsar and recovered a pistol, ammunition, and ₹20,000 from a designated location arranged by the network. According to Delhi Police, the weapon was intended for a firing attack on a club in Zirakpur, Punjab, which had previously received extortion threats linked to Bhatti. Investigators alleged that Rajveer attempted to execute the attack on 11 April but failed due to a malfunctioning weapon. Vivek reportedly recorded the operation and sent the footage to handlers as proof of the attempt.

Unlike earlier cases centred on propaganda, recruitment, or reconnaissance, this module had progressed to weapons procurement, financial facilitation, target selection, extortion-linked violence, and preparations for armed attacks, highlighting an escalation from surveillance activities to operational execution.

May 2026 | Delhi Police Dismantles ISI-Linked Multi-State Attack Module

On 8 May 2026, Delhi Police Special Cell arrested nine operatives across multiple states during “Gang Bust Operation 2.0”, dismantling an ISI-linked network allegedly directed by Pakistan-based gangster Shahzad Bhatti. Police recovered weapons, mobile phones, and digital evidence during the operation.

According to investigators, the module had identified several high-profile targets across northern India. One of the primary targets was a historic temple in Delhi, where operatives had allegedly conducted reconnaissance and transmitted photographs and security-related information to Pakistan-based handlers. Investigators claimed the plan involved attacking police and paramilitary personnel deployed at the site before targeting the temple itself. Another target was a popular dhaba on the Delhi-Sonipat highway. According to the investigation, operatives selected the location because of its large daily footfall and discussed carrying out a grenade attack to cause mass casualties and panic.

Investigators also uncovered reconnaissance of a military installation in Hisar, Haryana. One of the accused had allegedly filmed the facility and shared videos and location details with handlers across the border as part of preparations for a future attack. According to Delhi Police, the module operated through a structured network of recruiters, reconnaissance operatives, logistics facilitators, and local associates who allegedly worked under the direction of Shahzad Bhatti and Pakistan-based handlers linked to the ISI. The case highlighted the progression from surveillance and recruitment activities to advanced attack planning against civilian, religious, and military targets.

The Grenade Attack: On March 16, 2025, a grenade was hurled at the residence of Punjab-based YouTuber Navdeep “Roger” Sandhu in Rasoolpur village near Raipur, Jalandhar district. 

As the probe progressed, Punjab Police identified Pakistan-based gangster Shahzad Bhatti as the primary accused behind the conspiracy. Investigators confirmed that the attack was orchestrated from across the border through criminal and extremist networks operating in Punjab. Given the suspected international links and national security implications, the case was later transferred to the National Investigation Agency (NIA) for further investigation.

On April 2, 2026, the National Investigation Agency (NIA) filed a chargesheet in the Jalandhar grenade attack case involving YouTuber Navdeep “Roger” Sandhu. In the chargesheet, Pakistan-based gangster Shahzad Bhatti was named as an absconder. According to the NIA, Bhatti orchestrated the attack from Pakistan through encrypted communication channels while coordinating with operatives and facilitators based in India. The agency stated that the attack formed part of a broader cross-border conspiracy involving criminal and terror networks. 

From Khalistan-Era Networks to a Hybrid Gangster-Terror Architecture

Security assessments published during 2026 increasingly described a shift toward a hybrid operational model.

Instead of maintaining separate criminal and extremist ecosystems, handlers increasingly integrated:

• Gangsters
• Recruiters
• Propagandists
• Narcotics networks
• Reconnaissance cells
• Logistics facilitators
• Terror operatives

Within this framework, criminal organisations handled recruitment, logistics, financing, weapons procurement, and local facilitation, while extremist actors focused on propaganda, ideological influence, and target selection.

Investigations in Maharashtra, Rajasthan, Uttar Pradesh, Delhi, and Punjab suggested that this model was expanding beyond its traditional areas of operation.

Conclusion

The investigations conducted between February and June 2026 revealed a network that extended far beyond conventional organised crime or isolated terror cells. Across multiple states, investigators identified recurring patterns involving social media recruitment, reconnaissance activities, surveillance infrastructure, financial incentivisation, identity concealment, operational planning, and cross-border coordination. While many cases remain under investigation and judicial scrutiny, the cumulative findings suggest the emergence of a decentralised ecosystem in which organised crime, espionage, propaganda, recruitment, and terror facilitation increasingly overlap.

The Shahzad Bhatti network, Tehreek-e-Taliban Hindustan, and the various modules uncovered by Indian agencies illustrate how modern threat networks can exploit digital platforms, criminal infrastructure, and local recruits to create operational capability without relying on traditional hierarchical structures.

Disclaimer:

This report has been prepared using publicly available sources, including media reports, police statements, court records, and official releases. Information contained in this report reflects details available at the time of publication and may be subject to further investigation or judicial review.