The Shehzad Bhatti gang, which allegedly recruited scores of Indian youth for criminal and surveillance activities on behalf of the Pakistani intelligence agency ISI, has largely been dismantled by Indian security agencies — but officials warn that Bhatti is now deploying new tactics, including the use of VPN, to rebuild his modules inside India.

How Bhatti Is Attempting a Comeback

Following the crackdown, most of Bhatti's social media accounts — primarily on Instagram — were taken down through legal requests coordinated by Indian agencies. In response, Bhatti has reportedly shifted to VPN-based communication to reach out to existing recruits and potential new targets, according to officials familiar with the matter. His associates are using similar methods to evade detection while continuing to scout for recruits on open social media platforms.

Notably, Bhatti publicly pushed back against claims of his network's dismantling. After Union Home Minister Amit Shah announced that the module had been destroyed, Bhatti released a video challenging the assertion, claiming those arrested were not his operatives and that all men recruited by him remained active. Officials have dismissed the claim as false.

The ISI Connection and Strategic Value

An Intelligence Bureau officer, speaking on condition of anonymity, described Bhatti as an ISI asset whose network is among the most cost-effective the Pakistani spy agency runs. Unlike high-cost outfits such as Lashkar-e-Tayiba or Jaish-e-Mohammad, the Bhatti network reportedly operates at a fraction of the cost — with recruits reportedly lured for as little as ₹5,000 to ₹10,000.

According to officials, the network's primary function is surveillance, not direct violence. Recruits are expected to serve as intelligence gatherers — providing continuous ground-level information to the ISI so that larger terror groups can plan and execute bigger attacks. The relatively low-risk nature of the role, officials say, makes it easier to recruit young, financially vulnerable individuals.

Recruiting Indians Abroad as a New Channel

Officials say Bhatti is now also in contact with Indians living abroad, with a plan to recruit them as intermediaries. These overseas recruits would then be tasked with identifying and luring targets back in India — creating an additional layer of operational distance from Bhatti himself and complicating surveillance by Indian agencies.

India's Counter-Measures: The Sahyog Portal

On the counter-intelligence front, Indian agencies have been systematically flagging and removing Bhatti-linked accounts. A significant development in this effort is Meta's integration of its platforms — Instagram and Facebook — with the Sahyog portal, developed by the Indian Cybercrime Coordination Centre (I4C). The portal enables automated, real-time content blocking directions under Section 79(3)(b) of the Information Technology Act, bypassing the need for individual human review by Meta. This allows law enforcement to act faster and at scale.

The Road Ahead

Officials acknowledge that countering this network will be an ongoing effort. The ISI has reportedly directed Bhatti to find alternative means to sustain his India operations and ensure modules are rebuilt. With automated takedown tools now in place and agencies tracking all known Bhatti-linked accounts, the battle has shifted to a digital cat-and-mouse dynamic — one that security officials say will not resolve quickly.