LUCKNOW A string of recent arrests across UP and the National Capital Region (NCR) has revealed an expanding and increasingly complex threat network combining espionage, online radicalisation, petty crime and terror-linked objectives, often directed by Pakistan-based handlers.
UP DGP Rajeev Krishna said the pattern points to an emerging “hybrid threat” where social media radicalisation, criminal activity and espionage are orchestrated by foreign handlers. “These are not isolated cases. Youth are first drawn in through minor criminal activities or financial inducements, and then gradually pushed towards more serious anti-national acts,” he said.
He added that decentralised modules and encrypted platforms make detection more difficult, but timely action by UP Police and ATS has helped prevent potential incidents. Efforts are underway to dismantle the wider network in coordination with central agencies.
The developments come close on the heels of the UP ATS arresting two youths – Hizbullah Ali Khan (alias Tushar Chauhan) of Meerut and Sameer Khan of Delhi’s Seemapuri, both barely 20 – who were allegedly groomed online to carry out attacks, indicating a broader and coordinated pattern.
A senior ATS officer said the two were not hardened operatives but recruits in the early stages of indoctrination. Their handlers, identified as Pakistan-based gangster Shahzad Bhatti and associate Aabid Jatt, allegedly used platforms like Instagram to establish contact, build trust and gradually introduce extremist narratives.
Officials say such tactics reflect a continuing trend where criminal networks and terror-linked elements increasingly overlap. Investigators also pointed to earlier cases involving fugitive gangster Shariq Sattha, whose links to Pakistan-based handlers surfaced in connection with Sambhal violence in November 2024, in which four people were killed. His associates were later arrested and arms were recovered.
In Ghaziabad, agencies recently dismantled an alleged espionage network with around 21 arrests, including that of a woman. The accused allegedly shared videos and locations of sensitive installations with Pakistan-based handlers for money, relying on civilians with local access to gather intelligence and evade detection.
In Bijnor, police uncovered a group accused of posting videos with firearms and engaging in arson. Investigators said the group set fire to a vehicle and damaged railway signalling infrastructure – acts capable of disrupting transport systems and triggering panic. They were also suspected of exploring plans to target automobile showrooms in the NCR and western Uttar Pradesh.
Security agencies said these cases highlight a shift towards smaller, decentralised modules assigned specific roles such as reconnaissance, propaganda or low-intensity attacks. Social media and encrypted channels are being widely used for recruitment, communication and coordination, complicating tracking efforts.
Railway infrastructure has emerged as a vulnerable target due to its accessibility and potential for cascading disruption, even limited damage to signalling systems can affect large sections of the network. Cases have been registered under provisions of the Bharatiya Nyaya Sanhita, Unlawful Activities (Prevention) Act, Official Secrets Act and Arms Act. Agencies are working to trace financial flows, establish interlinkages between modules and identify handlers operating from abroad.
Officials said while timely arrests have averted possible incidents, the broader concern remains the adaptability of such networks, which are increasingly dispersed, technology-driven and embedded within civilian spaces, making them harder to detect and counter.
www.hindustantimes.com
#hybrid #threat #Spies #arson #digital #grooming
