Govind Tekale
Estimated reading time: 2 minutes
On —three days before Independence Day—law enforcement agencies coordinated arrests across 14 states, detaining 253 people linked to a terror recruitment network operated by Shahzad Bhatti. The operation represented a systematic dismantling of what Indian intelligence agencies describe as a hybrid model of organized crime and militant operations designed to evade attribution to Pakistani state actors.
The network operated under the banner of TTH (Tehreek-e-Taliban Hindustan), a newly created outfit established to provide plausible deniability for operations. By creating a “homegrown” label, handlers in Pakistan reduced direct attribution to the Pakistani state apparatus while maintaining separate propaganda channels for claimed attacks. Between 2025 and 2026, at least nine separate modules had been identified and targeted by law enforcement across Uttar Pradesh and Delhi before the August operation.
Recruitment leveraged accessibility and financial desperation. Operatives used WhatsApp, Telegram, and gaming applications to identify targets with immediate financial needs or ideological receptivity. A biryani seller and ginger vendor in western Uttar Pradesh accepted modest payments for initial logistical tasks—SIM procurement, photographing defense installations, coordinating communications—before escalating to surveillance duties. This “pay-per-task” model assigned low-risk reconnaissance work to operatives across western UP, Haryana, and Rajasthan, establishing a replaceable ecosystem that persisted despite repeated law enforcement action.
Intelligence linking the network to cross-border support emerged from equipment recovered during arrests. Grenades marked with stamps and espionage cameras confirmed direct supply chains from Pakistan rather than improvised capabilities. The timing of the August operation reflected institutional learning: real-time coordination across 14 states demonstrated law enforcement’s improved ability to synchronize action against distributed networks.
The network had claimed responsibility for previous operations. In March 2025, a YouTuber named Roger Sandhu was attacked in Jalandhar. In November 2025, a women’s police station in Sirsa was targeted. In January 2026, Baldev Nagar in Ambala saw an attack. These incidents reflected the operational reach of Bhatti’s organization across multiple states and targets.
CONCLUSION
The detained individuals now face charges under the Unlawful Activities Prevention Act (UAPA), Bharatiya Nyaya Sanhita (BNS), Arms Act, and Explosive Substances Act. The operation coordinated across 14 states and identified a network structure spanning nine separate modules according to officials between 2025 and 2026.
