On June 18, 2026, Saif Ansari alias Rohit was arrested in Ranchi, Jharkhand, while Aman Ansari alias Golu and Sayam Sujan were arrested near Gajhandi Railway Station in the Koderma District of Jharkhand on June 17, 2026, for hurling petrol bombs at the Rashtriya Swayamsevak Sangh (RSS) office in Ranchi, Jharkhand.
All three were linked with Pakistan’s Inter-Services Intelligence (ISI)-funded Tehreek-e-Taliban Hindustan (TTH). Officials said all three were in constant touch with their handlers through encrypted messaging platforms, including Botim and WhatsApp. The Botim app is widely used in Dubai. It was reported that the accused recorded the entire incident involving the throwing of petrol bombs on their mobile phones and later shared the footage with their handlers. Investigators also said that the accused Saif Ansari and Aman Ansari had travelled to Dubai, where they came into contact with Shahbaz Rana alias Bhatti, a Pakistani national. They are believed to have been radicalised during this period and later agreed to carry out activities in support of TTH’s anti-India agenda.
On June 18, 2026, the Anti-Terrorist Squad (ATS) of the Uttar Pradesh Police arrested two men, Mohammad Umar, 19, and Faizan, 21, residents of Akbarpur Village in the Bulandshahr District of Uttar Pradesh (UP), for working for Pakistan’s Inter-Services Intelligence (ISI)-based operatives, engaging in activities aimed at creating fear, as well as espionage.
The accused were entrusted with conducting surveillance of the Army Cantonment in Lucknow and the Indian Air Force (IAF) Station at Bamrauli in the Prayagraj District of Uttar Pradesh, and sharing information with their handlers. For this task, they were promised INR 10,000. Investigators added that the two accused came in contact with Pakistani gangsters Shahzad Bhatti, Abid Jatt, Hammad Barkati and Rana Hunain through WhatsApp and Instagram. According to ATS, the network was backed by ISI and was attempting to create sleeper cells in India through social media platforms.
On June 16, 2026, Delhi Police dismantled a Pakistan ISI-backed terrorism-crime module operating across the Delhi-NCR region and arrested seven operatives – Anas Tyagi, Mohit alias Yogi, Deepak Agrola, Arif alias Pradhan, Jatan, and Sabir, all residents of Ghaziabad in Uttar Pradesh, and Karanvir Singh from Punjab – accused of smuggling arms and narcotics from across the border. The module was being run by Pakistan-based gangster-turned-terrorists Shahzad Bhatti and Ajmal Gujjar, who are believed to be operating under the patronage of Pakistan’s Inter-Services Intelligence (ISI). The accused were involved in procuring and distributing illegal arms, ammunition and narcotic substances smuggled into India through drone drops along the Punjab border, before being supplied across Delhi-NCR.
On June 9, 2026, the National Investigation Agency (NIA) carried out operations at 18 locations in nine Districts of Haryana and Punjab in connection with three major cases linked to Pakistan-based narco-terrorist Shahzad Bhatti. NIA’s investigation in case RC-22/2025/NIA/DLI had traced the March 16, 2025, grenade attack at the residence of social media influencer Roger Sandhu in Jalandhar, Punjab, to Shahzad Bhatti. NIA further found that Bhatti was the mastermind behind the November 25, 2025, explosion at the Women’s Police Station, Sirsa, Haryana (case RC-24/2025/NIA/DLI), and the January 10, 2026, blast at Baldev Nagar Police Station in Ambala, Haryana (case RC03/2026/NIA/DLI). Operating from across the border, Bhatti is also behind narco-terrorism networks in Jammu and Kashmir (J&K) and has recently floated a new terrorist formation, the TTH, according to official sources.
On May 26, 2026, NIA disclosed that it had filed a charge sheet against nine people, including Pakistani nationals and handlers, Shahzad Bhatti (the ‘mastermind’ behind TTH) and Sohail Ahmad alias Sohail Baloch; and had arrested Indian nationals Dheeraj alias Dhiru, Vikas alias Vikky, Sandeep alias Daimar, Vikas, Sushil alias Sillu, Mohammad Sijaan alias Sijaan alias Ghazi, and Gurjant Singh, in connection with the November 25, 2025 grenade attack on a women’s Police Station in the Sirsa District of Haryana.
On May 24, 2026, an outfit identifying itself as TTH claimed responsibility for the killing of Punjab Police Assistant Sub-Inspector (ASI) Joga Singh in the Majitha area of Amritsar District in Punjab. A poster circulated on social media by the group’s ‘Al-Burak squad’ claimed involvement in the attack and threatened further assaults against Police, Army, and intelligence personnel.
On May 24, 2026, Intelligence and law enforcement agencies uncovered that gangster-turned-terrorist Shahzad Bhatti, operating from Pakistan, was the ‘mastermind’ behind the propaganda and operations of TTH.
On April 9, 2026, the Uttarakhand Special Task Force (STF) arrested a 29-year-old man, Vikrant Kashyap, a resident of the Jhajhra area of Premnagar in Uttarakhand, for suspected involvement in anti-national activities and conspiring to establish a foothold for TTH in the state. According to the Police, Kashyap had come under the influence of Pakistani handlers, specifically identified as Shahzad Bhatti and an associate known as ‘Rana’.
On March 23, 2026, an 18-year-old key TTH operative, Harmandeep Singh alias Harman, linked to Shehzad Bhatti, was arrested by the special cell of the Delhi Police. The arrestee was being groomed to carry out grenade attacks and to paint pro-TTH graffiti across Delhi, Punjab and Uttar Pradesh.
On February 22, 2026, two Policemen, Assistant Sub-Inspector (ASI) Gurnam Singh and Home Guard Ashok Kumar, were killed at Adhian village under Dorangla PS limits in the Gurdaspur District of Punjab near the International Border (IB). Initial findings suggested that the officers were shot while asleep, pointing to a targeted attack rather than a coordinated strike. TTH posters were circulated on social media, claiming responsibility.
According to partial data collated by the Institute for Conflict Management (ICM), at least three persons have been killed, and nine persons have been arrested linked to the TTH in the current year (data till June 21, 2026). 13 persons linked with Shahzad Bhatti were arrested in 2025 and another 40 in 2026.
Shahzad Bhatti, originally from the Punjab Province of Pakistan, is identified as a Pakistan-based underworld figure who operates an advanced criminal network with deep ties to Pakistan’s intelligence agency, the Inter-Services Intelligence (ISI).
According to Indian officials, he is described as a key ISI proxy, tasked with managing cross-border terrorist modules and recruiting Indian youth through social media platforms to carry out high-profile strikes. Beyond terrorism, Bhatti commands an extensive arms and narcotics smuggling syndicate, especially in J&K, using his international reach to challenge rival factions like the Bishnoi gang, and was at one time known to have friendly ties with gangster Lawrence Bishnoi.
Bhatti first came under the radar of Pakistan’s Police in 2013, when cases involving theft and robbery were registered against him. Around 2015, Bhatti is believed to have moved to the UAE, where he claimed to own an agricultural and dairy business. His current location remains unclear, but investigators believe he moves between Pakistan and Gulf countries.
Bhatti is not only linked to ISI but also receives support from Pakistan-based ISI handlers such as Abid Jatt, Ajmal Gujjar, his close aides, and Yawar Khan, a Dubai-based ISI handler, linked to the Dawood network. Authorities have further stated that Bhatti’s network operates through social media platforms such as Facebook, Instagram and YouTube. The network identifies vulnerable youth in India, initiates conversations through private messaging and then connects them to Bhatti via video calls.
After it was reported by Indian agencies that Bhatti was the mastermind behind TTH, the deeper conspiracy unravelled following two operations by the agencies and the Delhi Police Special Cell in May 2026. In the first operation, the cell arrested Sohail, who had a prior criminal record, from Delhi. Investigations revealed that Bhatti had assigned Sohail the task of painting ‘TTH’ graffiti across prominent walls and locations in Delhi and Faridabad.
Sohail was specifically instructed to paint the letter ‘S’ beneath the TTH acronym to signal Bhatti’s personal signature behind the outfit. Financial mobilisation from Pakistan was also established, as Bhatti had paid Sohail for executing this “test task”. Further investigations exposed the involvement of the targeted killing of Police personnel, driven by Bhatti and backed by ISI. In the second operation, the Delhi Police Special Cell arrested three youths who were found to be in direct contact with Bhatti, Jatt, and Ajmal Gujjar. Bhatti had ordered the trio to record videos displaying firearms and to film themselves shooting a policeman, promising financial rewards in return.
The formation of TTH is still in process, with the group’s identity coming into the spotlight with the arrests in 2026. There were no records relating to the group prior to this. Bhatti, however, has been known to be active in India at least since early 2025.
Bhatti’s name first surfaced in connection with the grenade attack at YouTuber Roger Sandhu’s house in Jalandhar’s Raipur Rasulpur Village on March 16, 2025. His name again came into the spotlight during investigations by the Uttarakhand STF following the arrest of suspected TTH operative Vikrant Kashyap on April 9, 2026.
Investigators found multiple suspicious contacts across Maharashtra, Rajasthan, Jammu & Kashmir, Punjab and Uttar Pradesh, suggesting the existence of a wider ISI-linked recruitment and communication network. According to the Uttarakhand STF, ISI and Pakistan-based handlers, including Bhatti and Abid Jatt, were targeting Indian youth through social media platforms.
Recruits were tasked with activities such as installing CCTV cameras at strategically important locations, enabling handlers in Pakistan to remotely monitor movements and local activities. On June 3, 2026, the Uttarakhand Police stated that the state’s youth were being influenced by the ISI network. According to Uttarakhand STF Senior Superintendent of Police (SSP) Ajay Singh, cyber commandos had been deployed for continuous surveillance in certain places in the state capital to monitor these activities.
After the Bhatti network came to light, agencies launched a major nationwide operation in the first week of May 2026. The 48-hour operation covered multiple states, including Delhi, Punjab, Haryana, Rajasthan, Uttar Pradesh, Madhya Pradesh and Maharashtra. Security agencies were tracking more than 500 mobile numbers and social media accounts.
40 suspects were rounded up in the border districts of Punjab. Around 90 youths were detained and questioned by the Haryana STF. More than 20 people were called in for questioning in Delhi, where some were counselled and asked to delete their social media accounts. In total, 481 suspects and criminals were detained as part of the operation. Later, on May 13, 2026, the Maharashtra Anti-Terrorism Squad (ATS) questioned 57 persons across Maharashtra over suspected links with Shahzad Bhatti and the Dogra gang, another Pakistan-based gangster network.
Coordinated operations were conducted at more than 40 locations, including Mumbai, Pune, Nagpur, Nashik, Nanded, Jalgaon, Mira Road, Nalasopara and Akola. According to ATS officials, the operation targeted individuals connected to Bhatti’s networks through social media or suspected of acting as sympathisers and local operatives. The latest operations were conducted by the NIA in Haryana and Punjab on June 9, 2026, identifying the Bhatti network as a substantial threat.
A media report on May 25, 2026, indicated that Indian Intelligence agencies believe that Bhatti’s criminal networks provide the logistical infrastructure through which the ISI seeks to expand TTH’s influence inside India. Agencies have concluded that social media has become the principal recruitment and radicalisation weapon for the group and, with Bhatti’s network and ISI backing, the agenda is to link the Tehreek-e-Taliban Pakistan (TTP) and TTH in India and Afghanistan.
A second objective is to spread a narrative suggesting that India is actively backing groups such as TTP to target the Pakistani Security Forces (SFs). Intelligence officials claim that TTH’s primary purpose is to create the impression of a homegrown Indian extremist group, providing Pakistan with another plausibly deniable proxy in the event of future terrorist attacks. ISI is attempting to portray TTH as an offshoot of TTP, even as Pakistan advances the narrative that both India and Afghanistan are supporting TTP, which has carried out numerous attacks against Pakistani SFs. Another element of the agenda behind floating TTH is to target the Indian Police and carry out terrorist attacks across India to create fear.
The broad strategic objective behind the Bhatti network is visible. ISI is combining online propaganda, proxy operations and support to on-ground recruitment, an instrument of hybrid warfare. However small it may seem now, TTH has the potential to become a dangerous challenge for Indian security and intelligence.
Author: Shivangi Sharma – Research Assistant, Institute for Conflict Management
