.png)
The Digital Face of Terror: A Case Study of the Shahzad Bhatti Network
Today, radicalisation has entered social media feeds, quietly weaponising everyday platforms for terror. While online radicalisation is already a known threat, a parallel shift is taking place as organised crime networks are using these same platforms to recruit people for task-based jobs. A clear example of this is the case of the Shahzad Bhatti Network, a Pakistani ISI-backed hybrid terror syndicate.
Illustration by The Geostrata
This network glamourised a “gangster” lifestyle online to attract and recruit Indian youth with promises of quick money and opportunities for foreign travel, for carrying out espionage tasks like installing CCTVs near Indian military bases.
WHO IS SHAHZAD BHATTI?
Shahzad Bhatti was a local underworld figure in Pakistan before he became involved in cross-border terror activities. He steadily built an extensive criminal network that was involved in extortion, drug trafficking, and arms smuggling.
His path shifted when he linked up with foreign crime syndicates and Pakistan’s ISI, evolving from a regional gangster to a valuable proxy for state-sponsored operations.
Operating remotely from Pakistan and Dubai, he branded himself across social media platforms. He created a new model for proxy warfare: a hybrid operator bridging organised crime, digital influence and state-backed terror.
FROM REELS TO RECRUITMENT
The Bhatti network throws light on what happens when a terror handler no longer hides in the dark but steps into the spotlight with a glamourised lifestyle. Bhatti ran a huge network of social media accounts on Instagram, Facebook, YouTube, and Snapchat and used his online presence to create a parallel identity as an online influencer to grow the network’s reach.
A crucial distinction needs to be noted here: while online radicalisation relies on ideological brainwashing, this model of recruitment was driven by financial incentives and digital clout.
The trap began with simple social media engagement. People scrolling through their feeds started mistaking Bhatti for a wealthy social media influencer. He posted videos with high energy and trending music, showcasing a lavish mafia lifestyle and weapons. To a young person struggling financially, Bhatti simply looked like a successful influencer living a rich life. Because this appeal was largely financial rather than ideological, it lowered the viewer’s guard.
This clever illusion made dangerous criminal activity seem like an exciting and easy way to gain wealth and status. Once the targets were hooked through comments and DMs (direct messages), recruiters reached out to them offering a better life and financial rewards. As soon as a target expressed interest, the communication was shifted from social media to encrypted apps, keeping the entire operation hidden from public view and law enforcement agencies.
The tasks assigned to these recruits dangerously escalated. Initially, they were given small tasks like putting up Bhatti’s promotional posters and spraying graffiti on walls. Later, the recruits were pushed towards far more dangerous assignments like smuggling drugs and weapons across state borders, filming police stations, tracking military movements, planting explosives, and installing CCTVs at railway stations and army bases. The shocking part was that these recruits had no idea that they were working directly for a Pakistani handler.
PROXY WARFARE IN THE DIGITAL AGE
What makes the Shahzad Bhatti Network so dangerous isn’t just its online presence, but how it operates differently from conventional proxy warfare. Traditional terror models require long-term investments. Here, members are deeply committed to the organisation’s ideology, and they spend months training in camps, procuring weapons, and maintaining strict command structures. These structures create a trail that intelligence agencies can track and monitor.
However, the case of the Shahzad Bhatti Network breaks this entire framework as it functions as a fragmented syndicate, combining ISI handlers in Pakistan, local gangs, and random online task-based recruits.
An operative need not be a fully committed and radicalised member of the group, but simply someone willing to complete a specific task for quick money.
This creates a “disposable operative” model, altering the nature of proxy warfare. If a local recruit gets caught while installing a CCTV or delivering a package, the entire network doesn't collapse. The handler simply severs the link and replaces them with another recruit. More importantly, this structure turns proxy warfare into an experimentation loop.
Foreign handlers can test the target state’s security apparatus using disposable recruits and isolated tasks. Even a failed attempt or a caught operative provides the handler with real-time data on how law enforcement agencies detect and react to threats, mapping out the state’s vulnerabilities.
DISMANTLING THE NETWORK
Before this model of digital recruitment could lead to major attacks, Indian security agencies launched multi-state operations across 14 states. They arrested over 200 suspects, seized smuggled arms, grenades and surveillance equipment, effectively shutting down the network’s active modules. Recognising the serious threat posed by this network, the Ministry of Home Affairs formally declared the Shahzad Bhatti Network as a terrorist organisation under the Unlawful Activities Prevention Act (UAPA).
Although this operation weakened the network’s physical footprints, it exposed a bigger vulnerability. When social media platforms that are so deeply integrated into our daily lives can be weaponised for task-based terror, merely disrupting individual groups is not enough. Defending national security now requires protecting the digital space as much as the physical one.
RETHINKING COUNTERTERRORISM
Earlier, counterterrorism efforts focused on tracking and dismantling fixed organisations. If the police identified a core cell, intercepted its communication channels, or captured a senior leader, their entire plan would collapse. But the Shahzad Bhatti Network’s task-based digital model demands a shift in the approach to counterterrorism efforts.
Since the recruits acted as isolated operatives with no direct knowledge of the broader plan, arresting a single member would barely give information about the handlers operating across the border. To adapt to this new reality, security agencies must pivot from solely tracking known terror groups to monitoring everyday digital activity, focusing on three key priorities:
Firstly, it demands deep integration with financial intelligence units to trace micro-transactions, crypto payouts, and suspicious digital wallets used to pay the recruits. Secondly, local cyber cells and police units must be further equipped with predictive monitoring tools to detect sudden engagement spikes around high-risk criminal-influencer profiles. Thirdly, it requires strict digital platform accountability to disrupt algorithmic recommendation loops that glamourise mobsters, alongside faster diplomatic protocols to unmask handlers operating from safe havens across borders.
Thus, what looks like routine online noise- a shady Instagram DM, someone filming a police station, or a small money transfer can no longer be treated as isolated incidents. Intelligence agencies will need to connect these scattered digital footprints through real-time data sharing among local police stations, cyber units, and central intelligence agencies to target the entire digital ecosystem that enables this threat.
The case of the Shahzad Bhatti Network marks a quiet turning point in modern proxy warfare. It proves that terrorism no longer relies solely on physical training camps or ideological brainwashing. It can now happen using a social media feed, a flashy lifestyle edit, and an encrypted app.
Dismantling this network was a major success for Indian security agencies, but the underlying digital ecosystem that enabled its rapid growth remains widely accessible.
Ultimately, as social media continues to integrate deeper into our daily lives, protecting national security depends on our ability to predict and dismantle the hidden digital, financial, and algorithmic channels that quietly turn everyday technology into a weapon for cross-border terror.
BY RUTUJA GANGURDE
TEAM GEOSTRATA
Comments