ISI’s Digital Dagger: How Delhi Police, UP ATS and NIA Shredded Shehzad Bhatti’s Pan-India Terror Hydra

Indian security agencies swiftly dismantled a vast terror network led by ISI operative Shehzad Bhatti from Pakistan, regarded by investigators as one of the gravest threats since the Pahalgam attack. Indian recruits had planned grenade attacks, shootings, and large-scale strikes targeting key sites across Delhi, Uttar Pradesh, Punjab, Haryana, and other regions.

On 28 May, acting on intelligence leads, the Uttar Pradesh ATS and STF arrested four suspects in Saharanpur: Mehkab, Gagandeep Singh (also called Guri), Shahrukh, and Musharraf. Before the arrests, Mehkab and Guri scouted hospitals in Delhi and Punjab, a political party office, and a school operator. The school operator’s identity stayed secret until weapons arrived. Shahrukh and Musharraf searched online guides on attacking hospitals and sent locations, videos, and photos of the targets to Bhatti and his associate, Abid Jatt, in Pakistan. At the time of arrest, the group waited for weapons and explosives from Bhatti's smuggling network to carry out their plans.

Earlier in May, during the Delhi Police Special Cell’s “Gang Bust Operation 2.0,” nine suspected operatives were arrested in several states. During subsequent questioning, one suspect admitted to watching a Delhi temple, taking photos, and sending them to handlers who sought to incite panic by targeting police and paramilitary forces. Another member had planned to throw a grenade at a busy dhaba on the Delhi-Sonipat highway. At the same time, a third recorded a military camp in Hisar, Haryana, and sent the video across the border. Police stations in Uttar Pradesh were also targeted, with weapons recovered. In the preceding month, April, Rajveer (21) and Vivek Banjara (19) from Gwalior, Madhya Pradesh, were apprehended while planning attacks in Delhi-NCR on Bhatti’s instructions. Going further back to March, an 18-year-old from Rampur was arrested for operating propaganda and recruitment groups. Since then, the UP ATS has dismantled four Bhatti-led groups, questioned over 150 suspects, and jailed 13 individuals.

On 29 May, the National Investigation Agency raided 12 sites in four states, targeting a group supplying weapons to Bhatti’s operatives via cross-border drones. Days earlier, nine people, including Bhatti and his associate Sohail Ahmad (aka Sohail Baloch), were charged for the November 2025 grenade attack on the Sirsa women’s police station in Haryana. Investigators said Dheeraj (Dhiru), the main coordinator in India, and others were radicalised online. The attack was practised, recorded, and shared to intimidate police nationwide.

Investigators from different agencies have a similar view. Shehzad Bhatti is a Pakistani national believed to work between Pakistan and Dubai. He acts as the ISI’s operator, able to deny involvement. Bhatti works with associates Abid Jatt, Hammad, and Ajmal Gujjar. They use Instagram, WhatsApp, and voice messages to find Indian youths who are tech-savvy and have no criminal record. These youths are often teenagers or in their early twenties. The recruits are offered money and fame for following orders. They are told to record themselves with weapons, target people in uniform, and collect proof of soft targets with location data. Police have seized country-made pistols and expect to find grenades and IEDs soon.

Currently, investigators from various agencies largely agree on the threat's structure. Shehzad Bhatti, a Pakistani national believed to operate between Pakistan and Dubai, serves as the ISI’s deniable operator, working with associates Abid Jatt, Hammad, and Ajmal Gujjar. Their recruitment method, using Instagram, WhatsApp, and voice messages to target Indian youths with no criminal records, has become more sophisticated.

These young recruits, often teenagers or in their early twenties, are promised money and fame for following orders such as recording themselves with weapons, targeting people in uniform, and collecting location-tagged evidence of soft targets. Police have seized country-made pistols thus far, with the expectation of finding grenades and IEDs soon.

These actions build on India’s strong response during Operation Sindoor, countering renewed attempts by groups based in Pakistan to restart low-level urban attacks. By targeting public places with limited resources, Bhatti’s network sought to sow fear. With Delhi on alert and raids ongoing, authorities have acted quickly and in coordination to pre-empt attacks and break up sleeper cells. Bhatti and his ISI handlers have been stopped for now; their network disrupted, recruits detained, and plans exposed.