In a startling revelation of how modern technology is being weaponized, security agencies have dismantled a sprawling terror-gangster network orchestrated by Shahzad Bhatti. Operating from the safety of the UAE, Bhatti utilized his persona as a social media influencer to target vulnerable youth across India, turning digital engagement into a pipeline for espionage and violence.

The National Investigation Agency (NIA) and state police forces have revealed that Bhatti's modus operandi began with simple engagement. He targeted individuals who liked or commented on his posts, initially offering small payments ranging from ₹5,000 to ₹10,000 to put up posters of him in public spaces. This 'poster war' was designed to cultivate an image of fear and dominance, effectively branding him as a powerful underworld figure before transitioning the recruits into more sinister activities.

Why This Matters

BozokMedia analysis shows that this case represents a dangerous shift in hybrid warfare. By blending the 'glamour' of social media influence with the strategic objectives of the Inter-Services Intelligence (ISI), the network bypassed traditional recruitment methods. The use of small, fragmented financial transactions from Central Asian countries ensured that the funding remained under the radar of banking surveillance systems, highlighting a critical gap in monitoring micro-transactions for national security.

As the network grew, the tasks escalated. Recruits were instructed to plant Chinese-made CCTV cameras near air bases, railway stations, and arterial roads. The footage from these cameras was live-streamed directly to handlers in Pakistan, providing real-time intelligence on critical Indian installations. Furthermore, Bhatti provided online manuals to recruits in Punjab, instructing them on the assembly of petrol bombs and Improvised Explosive Devices (IEDs).

"The transition from petty organized crime to state-sponsored terrorism via social media platforms marks a new era of digital radicalization that requires a multi-layered intelligence response."

The reach of the Bhatti network was extensive, spanning 14 states including Uttar Pradesh, Punjab, Maharashtra, and Kerala. High-profile attacks, such as the March 2025 grenade attack on influencer Roger Sandhu in Jalandhar and blasts at police stations in Sirsa and Ambala, have been linked to Bhatti's orchestration. The NIA has since charge-sheeted him as an absconder, noting his coordination with other handlers like Sohail Baloch.

Adding a layer of complexity is Bhatti's public rivalry with jailed gangster Lawrence Bishnoi. This feud was actively promoted on social media to attract followers and recruits, using the 'gang war' narrative to mask the deeper geopolitical agenda of the ISI. The Intelligence Bureau (IB) is now coordinating with state police to fully purge the remaining modules of this network.

Modus Operandi Evolution

Phase	Activity	Objective
Initial Phase	Poster Campaign	Brand Building & Fear
Intermediate Phase	Grenades/Explosives	Instability & Terror
Advanced Phase	CCTV/Live-streaming	Strategic Espionage

Frequently Asked Questions

Q1: How did Shahzad Bhatti fund his operatives in India?
A: Payments were sent from Central Asian countries directly to bank accounts in small amounts to avoid triggering suspicious transaction alerts.

Q2: Which Indian agencies are leading the investigation?
A: The National Investigation Agency (NIA), Intelligence Bureau (IB), and various state police forces are collaborating on this operation.