The Islamic State (ISIS) has been actively directing its recruits in South India to carry out devastating terror attacks, including setting passenger trains ablaze and executing knife attacks on busy public streets, according to senior intelligence officials. The threat, which has been building since early 2023, is being treated as a serious and evolving national security concern by Indian agencies including the National Investigation Agency (NIA) and the Intelligence Bureau (IB).

ISIS Propaganda Directly Targeting South Indian Recruits

The blueprint for these attacks was first publicly signalled in the March 2023 edition of ISIS's official propaganda magazine, Voice of Khorasan. The publication carried an article explicitly titled 'A Message to the Inhabitants in the Land Occupied by Cow and Mice Worshipping Filth' — a piece deliberately crafted for the group's followers in South India.

This marked a significant escalation: ISIS was no longer issuing generic global directives but was producing region-specific, language-targeted propaganda aimed at radicalised youth in states like Tamil Nadu and Kerala. Since that publication, intelligence officials say the outfit has been systematically pushing its followers to move from passive radicalisation to active violence.

An Intelligence Bureau official confirmed that ISIS is "hell-bent" on implementing the plan and has been applying increasing pressure on its network to execute attacks. "They have begun pushing harder so that the plan can go through," the official stated.

How ISIS Plans to Strike: Trains, Knives, and Poison

The operational instructions being circulated by ISIS to its Indian followers are chillingly specific. Recruits have been directed to enter railway stations carrying cans filled with petrol and set trains on fire when the maximum number of passengers are on board.

ISIS has specifically identified Indian Railways as a high-value target because of its sheer scale — it is the most widely used mode of transport in India, carrying over 13 million passengers daily. The group calculates that attacking trains will create maximum psychological impact and generate the highest possible casualty count.

Beyond train attacks, the outfit has also been instructing followers to carry out street-level knife attacks on civilians, with explicit instructions to stab non-believers. Additional directives include poisoning food supplies and setting fire to the homes of non-Muslims. The strategy is designed to be a sustained, multi-pronged campaign of terror intended to keep fear alive in public consciousness over an extended period.

Why South India: The Radicalisation Pipeline

Officials explain that ISIS's focus on South India is not accidental. The region has historically been fertile ground for radical Islamist recruitment, partly due to the long operational history of outfits like Al-Ummah and the Popular Front of India (PFI) — the latter banned by the Indian government in September 2022 under the Unlawful Activities (Prevention) Act (UAPA).

For years, these organisations allegedly operated with a degree of patronage that allowed them to radicalise youth with relative freedom. When ISIS expanded its India operations, it found a pre-radicalised base in the South that was far easier to penetrate compared to other regions. States like Kerala and Tamil Nadu have consistently reported the highest number of ISIS-linked arrests and departures to conflict zones in Syria and Iraq.

Notably, the NIA has investigated and prosecuted multiple ISIS-related cases originating from Kerala alone over the past decade, making it one of the most monitored states for extremist activity in India.

Indian Agencies on High Alert: Plans Foiled Repeatedly

Despite the escalating rhetoric and planning, Indian security agencies have so far managed to neutralise multiple plots before they could be executed. The NIA, working in coordination with state police and the Intelligence Bureau, has maintained aggressive surveillance of online platforms, encrypted messaging applications, and social media channels used by ISIS to communicate with its Indian network.

Officials acknowledge that ISIS's shift to online radicalisation — avoiding physical camps and instead using the internet as its primary recruitment and indoctrination tool — has made the threat more diffuse and harder to track. However, this digital footprint has also allowed agencies to monitor and intercept communications before attacks are launched.

The NIA has in recent years arrested several individuals from Tamil Nadu, Kerala, and Karnataka on charges of ISIS-linked activities, demonstrating both the depth of the threat and the effectiveness of counter-terror operations.

Experts Call for Expanded De-Radicalisation Programmes

Senior officials and security analysts are increasingly vocal about the need for a more robust de-radicalisation strategy to complement law enforcement action. "More de-radicalisation camps are the need of the hour," one official said, warning that arresting operatives alone will not dismantle the ideological infrastructure ISIS has built in the region.

The concern is that ISIS has now completed what officials describe as Phase 1 — mass online radicalisation — and is actively trying to trigger Phase 2: sustained, decentralised terror attacks carried out by locally-motivated individuals who are difficult to detect in advance.

This model, sometimes called the "lone wolf" or "inspired attacker" strategy, has been used effectively by ISIS in Europe, the United States, and Southeast Asia, where self-radicalised individuals carried out attacks with minimal logistical support from the core organisation. India now faces the risk of this model being replicated on its soil.

As Indian agencies intensify their counter-terror operations and the government evaluates the scale of de-radicalisation infrastructure needed, the coming months will be critical in determining whether ISIS can successfully transition its South Indian network from ideology to action.