Shahzad Bhatti Network Busted: How India Dismantled an ISI-Backed Terror Network Ahead of Independence Day
India has carried out a major multi-state counter-terror operation against the Shahzad Bhatti Network (SBN), an alleged Pakistan-based, ISI-backed terror-gangster network that security agencies say was attempting to establish an operational footprint inside India.
The scale of the crackdown is significant. According to the Union Home Ministry, 253 people were detained across 14 states on August 12, 2026, while more than 80 FIRs and 200-plus arrests have been recorded in cases linked to the network. Security agencies also recovered IEDs, grenades, pistols, live ammunition and CCTV equipment allegedly connected with surveillance activities.
The operation came just days before Independence Day, with Union Home Minister Amit Shah saying that security forces had disrupted the network’s plans for subversive attacks around August 15. The government described the operation as an example of its “zero tolerance” approach towards cross-border terrorism.
Who is Shahzad Bhatti?
At the centre of the investigation is Shahzad Bhatti, a Pakistan-based gangster whom Indian agencies now describe as a terrorist and a key figure in a growing cross-border terror-gangster ecosystem.
The National Investigation Agency has described Bhatti as a “gangster turned terrorist” operating from across the border. Investigators allege that his network combines elements of organised crime, terror recruitment, surveillance and attacks, while using Indian recruits to carry out activities on the ground.
This alleged model is important because Bhatti does not necessarily need to send trained terrorists across the international border. Investigations have indicated that Indian recruits could instead be contacted remotely, given money or instructions and gradually drawn into increasingly serious activities.
The alleged network has therefore been described as a hybrid model in which Pakistan-based handlers operate remotely while Indian operatives provide the local manpower.
A digital recruitment and terror model
One of the most worrying aspects of the Bhatti investigation is the alleged use of social media and digital communication to identify and recruit Indian youths.
Investigators have been examining communication networks, financial transactions and digital devices associated with Bhatti’s associates. The NIA said in June that searches at 18 locations in Punjab and Haryana were aimed at uncovering the larger cross-border conspiracy and identifying Bhatti’s associates and other individuals linked to the network.
The alleged recruitment model represents an evolution in the way cross-border terror networks can operate.
Instead of establishing large, conventional terror cells, handlers can potentially recruit individuals inside India for specific tasks. Those tasks can include surveillance, reconnaissance, transportation of weapons, logistical assistance and, ultimately, attacks.
This makes such networks harder to detect because an individual recruit may not initially appear to be part of a conventional terrorist organisation.
Bhatti already linked to several terror cases
The August crackdown is not an isolated development.
The NIA has been investigating Bhatti’s alleged role in several attacks in Punjab and Haryana.
One of the cases concerns the March 2025 grenade attack at the residence of social-media influencer Roger Sandhu in Jalandhar, Punjab. The NIA took over the investigation from Punjab Police and in April 2026 chargesheeted Bhatti as an absconder along with another accused. The charges invoked provisions of the Unlawful Activities (Prevention) Act, Explosive Substances Act, Arms Act and Bharatiya Nyaya Sanhita.
Investigators subsequently linked Bhatti to other attacks.
The NIA said its investigation found that Bhatti had allegedly masterminded the November 2025 explosion at the Women Police Station in Sirsa, Haryana, as well as the January 2026 blast at Baldev Nagar police station in Ambala. In the Sirsa case, the agency chargesheeted nine people, including Bhatti and another Pakistan-based handler, Sohail Ahmad alias Sohail Baloch.
The Baldev Nagar investigation also found that an arrested accused had allegedly been in contact with Bhatti.
These investigations provide important context to the nationwide August operation: Indian agencies had already been building a case around Bhatti and his alleged network before the large-scale crackdown.
253 detained across 14 states
The geographical spread of the August 12 operation is perhaps its most striking feature.
According to information reported by officials, the 253 detentions were spread across 14 states and Union Territories.
| State/UT | People detained |
|---|---|
| Uttar Pradesh | 62 |
| Haryana | 52 |
| Delhi | 51 |
| Punjab | 44 |
| Rajasthan | 15 |
| Maharashtra | 8 |
| Uttarakhand | 5 |
| Karnataka | 3 |
| Gujarat | 3 |
| Bihar | 3 |
| Telangana | 2 |
| Himachal Pradesh | 2 |
| Jammu & Kashmir | 2 |
| Kerala | 2 |
| Total | 253 |
The four largest figures came from Uttar Pradesh, Haryana, Delhi and Punjab, which together accounted for 209 of the 253 detentions, or more than four-fifths of the total.
Uttar Pradesh recorded the highest number at 62, followed by Haryana with 52, Delhi with 51 and Punjab with 44. The operation nevertheless extended much farther south and west, with Maharashtra, Karnataka, Gujarat, Telangana and Kerala also appearing in the investigation.
The geographic spread suggests that investigators were not dealing with a single localised cell but were pursuing an alleged network with contacts and modules in multiple parts of India.
Weapons, explosives and surveillance equipment recovered
The security operation also produced significant recoveries.
Authorities reported the seizure of IEDs, grenades, pistols, live cartridges and CCTV cameras. Some of the grenades were reported to carry Pakistan Ordnance Factory markings, which investigators regard as evidence relevant to the alleged cross-border dimension of the network.
The recovery of surveillance equipment is particularly noteworthy.
Terrorist networks need information about potential targets before carrying out attacks. Surveillance of police facilities, defence-related locations or other sensitive sites can allow attackers to study security arrangements and movement patterns.
According to the government’s account, the Bhatti network was involved in reconnaissance and surveillance activities as well as attacks and weapons-related operations.
Why Independence Day made the operation especially important
The timing of the crackdown was crucial.
The coordinated operations were conducted on August 12, only three days before India’s Independence Day. Security agencies were therefore acting during one of the country’s most sensitive national-security periods.
The government says the network was preparing or facilitating subversive activities around Independence Day and that the operation prevented those plans from being executed. Amit Shah said the crackdown demonstrated India’s ability to coordinate intelligence and police action across multiple states to disrupt a terror threat before it could mature.
In counter-terrorism, preventing an attack is often considerably more valuable than responding to one after it occurs.
The absence of an attack can itself be evidence of successful preventive intelligence work.
The importance of real-time intelligence sharing
The operation also demonstrates the importance of cooperation between central agencies and state police forces.
A network operating across 14 states cannot be effectively tackled by a single state police force. Information about a suspect, financial transaction, communication link or weapons movement in one state may only become meaningful when matched with intelligence from another state.
The August operation reportedly relied on coordinated and real-time intelligence sharing between agencies and state police forces.
The NIA’s earlier investigation shows a similar pattern. In June, agency teams searched 18 locations across nine districts of Punjab and Haryana, examining digital devices, documents, communication networks and financial transactions in an effort to expose the larger conspiracy.
What does the crackdown mean for India?
The Shahzad Bhatti investigation highlights a broader challenge facing India’s security agencies: the convergence of terrorism, organised crime and digital recruitment.
A Pakistan-based handler can potentially remain outside India’s jurisdiction while using social media and encrypted communication to interact with recruits inside the country. Criminal networks can potentially provide access to money, weapons, logistics and local contacts.
That creates a security challenge considerably different from a traditional infiltration model.
The August operation suggests that Indian agencies had identified enough of this alleged infrastructure to launch a simultaneous crackdown across a large geographical area.
However, the investigation is not necessarily over.
The 253 figure represents people detained during the operation, while the government separately reports 200-plus arrests and more than 80 FIRs. Detention or arrest does not itself establish guilt. The individual roles of those accused will have to be determined through investigation and judicial proceedings.
A major blow, but the investigation continues
The Shahzad Bhatti Network operation is significant not simply because more than 200 people were arrested.
Its importance lies in what Indian agencies say they uncovered: a Pakistan-based terror-gangster network allegedly attempting to use local recruits, digital platforms, surveillance, weapons and criminal infrastructure to create an operational presence inside India.
Bhatti had already emerged in NIA investigations into attacks in Punjab and Haryana. By June, investigators were conducting searches across multiple districts to identify his associates and uncover the wider conspiracy. The August operation then expanded the crackdown dramatically, reaching 14 states and resulting in 253 reported detentions.
If subsequent investigations establish the full chain linking overseas handlers, financing, recruitment, surveillance, weapons procurement and attacks, the operation could prove to be an important counter-terrorism breakthrough.
For now, however, the immediate result is clear: Indian security agencies have dealt a major blow to the alleged Shahzad Bhatti terror network at a particularly sensitive moment, preventing what the government says were planned subversive activities around Independence Day.
The larger test will be whether investigators can completely expose and dismantle the network’s remaining financial, digital and human links — both inside India and across the border.
You May Also Be Interest In :
Comments are closed.