Sources say the ISI has actively propped up Lahore-based gangster Shahzad Bhatti as a cost-effective, deniable proxy to orchestrate low-intensity terror
In a major national security development, intelligence agencies have decoded a dangerous new dimension of the Pakistani Inter-Services Intelligence (ISI) hybrid warfare strategy against India. According to top intelligence sources, the ISI has actively propped up Lahore-based gangster Shahzad Bhatti as a cost-effective, deniable proxy to orchestrate low-intensity terrorism, targeted radicalisation, and criminal disruption across India. Bhatti, who previously operated from Dubai before relocating to Pakistan under the direct protection of state handlers, represents a highly sophisticated “gangster-turned-operative” model. This structural setup allows Islamabad to maintain persistent security pressure on Indian border states and metropolitan centres at minimal diplomatic risk, keeping state fingerprints completely hidden behind the facade of independent gang activity.
Operating as a key pivot for the ISI, Bhatti has demonstrated lethal efficiency in digital narrative management and social media recruitment, specifically targeting vulnerable Indian youth. These recruits are groomed into highly disposable, localised modules tasked with executing high-risk operations, including grenade attacks, targeted killings of police personnel, and the defacement of public property. To fund these expansive operations, the ISI has established a continuous stream of capital through cross-border narco-terror smuggling networks, aimed primarily at triggering widespread communal and civil unrest across Punjab and other strategic border regions.
The TTH Banner and Recent Pan-India Plots
A critical component of Bhatti’s recent operational blueprint is the creation of a front organisation known as the Tehreek-e-Taliban Hindustan (TTH). Under this banner, the module has unleashed aggressive propaganda campaigns alongside highly coordinated targeted killing plots. The extent of this hybrid threat was starkly exposed throughout May 2026, when law enforcement agencies busted multiple interconnected interstate modules. These crackdowns revealed extensive propaganda operations, police shooting plots, and provocative terror graffiti painted across public spaces in Delhi and Faridabad, leading to several high-profile arrests that effectively unmasked the TTH as an ISI-Bhatti construct.
Simultaneously, the module had been actively laying the groundwork for a series of spectacular strikes on highly sensitive installations across the National Capital Region (NCR) and neighbouring states. Investigations in May 2026 exposed advanced terror plots targeting a prominent temple in Delhi, a crowded commercial dhaba on the Delhi-Sonipat highway, and a heavily fortified military camp spanning Delhi NCR and Haryana. By utilising local criminal logistics, Bhatti came close to executing these reconnaissance-backed operations before federal agencies intervened to neutralise the immediate threat.
Extensive Geographic Footprint and Judicial Crackdowns
The operational history of the Shahzad Bhatti module reveals a relentless trajectory of violence stretching over the last two years. Bhatti first drew significant federal scrutiny following a high-profile grenade attack on the residence of YouTuber Rozer Sandhu in Jalandhar, Punjab, a case that subsequently culminated in a comprehensive chargesheet filed against him by the National Investigation Agency (NIA). Undeterred by federal indictments, the module struck again in November 2025, executing a targeted grenade attack directly on a police station in Gurdaspur, Punjab, in a blatant bid to demoralise local law enforcement.
