Lone actors and buddy pairs: How India's terror threat is evolving in 2025
Synopsis
Indian intelligence agencies say the era of structured terror modules is ending — replaced by lone actors and buddy pairs with zero communication trails. With the ISI pushing self-funded home-grown cells and Islamic State flooding the internet with DIY attack content, officials warn that India faces its most difficult counter-terror tracking challenge yet.
Key Takeaways
Intelligence agencies warn that structured terror modules are being replaced by lone actors and buddy pairs with minimal communication trails.
The ISI is pushing for home-grown, self-funded modules with no Pakistan-linked communication or financial trail before an attack.
The Islamic State is radicalising individuals through DIY and radical internet content , targeting states including Kerala , Tamil Nadu , and now the rest of India.
Recent cases include Zaib Zubair Ansari in Mumbai , Rizwan in Delhi , and Tushar Chauhan alias Hizbullah Khan in Uttar Pradesh .
Agencies are shifting from network interception to digital monitoring , community awareness , and daily takedown of radical content online.
Indian intelligence agencies are tracking a significant shift in the nature of domestic terror threats, with officials warning that structured terror modules with foreign handlers and ideological mentors are giving way to lone actors, buddy pairs, and self-radicalised individuals operating with little to no communication trail. The assessment, shared by senior officials on 29 April in New Delhi, underscores a dual threat driven by the Inter-Services Intelligence (ISI) of Pakistan and the Islamic State (IS), each pursuing distinct but equally dangerous strategies.
The Shift Away From Structured Modules
According to officials, terror operatives are increasingly moving away from the hierarchical, handler-dependent model that agencies had traditionally tracked. Instead, small cells — often just two individuals, referred to as buddy pairs — are being deployed to minimise scrutiny and reduce the risk of detection. The logic is straightforward: fewer people means fewer communication intercepts, fewer financial trails, and a dramatically narrowed window for law enforcement to intervene.
An Intelligence Bureau (IB) official noted that this evolution is not accidental. Both the ISI and the Islamic State have studied past operational failures and are actively adapting their recruitment and activation strategies to exploit the blind spots of conventional counter-terrorism frameworks.
ISI Strategy: Home-Grown, Self-Funded, Pakistan-Proof
The ISI's current approach, according to officials, is to cultivate home-grown modules that are entirely self-funded and self-motivated, with no direct communication with handlers in Pakistan in the lead-up to an attack. The funding trail is expected to remain entirely within India, ensuring that no digital or financial thread leads back to Islamabad.
Officials acknowledged that this model carries a tactical silver lining for Indian agencies — members of ISI-styled modules are still likely to leave some trail, however faint. The ISI is also acutely aware, officials said, that a traceable attack on Indian soil risks triggering a response akin to Operation Sindoor, which has made it more cautious about direct fingerprints.
Islamic State: Radicalisation Without a Footprint
The Islamic State's strategy is considered the more acute challenge. Rather than directing operations, IS has focused on flooding the internet with radical and Do-It-Yourself (DIY) content, aiming to radicalise individuals to the point where they act entirely on their own initiative. The group, officials say, is indifferent to the scale of an attack — even one or two casualties serve its purpose of generating psychological terror.
An official described the threat starkly:
Point of View
Which was built to intercept networks, not isolated individuals. The ISI's 'Pakistan-proof' home-grown model and the Islamic State's DIY radicalisation pipeline represent two distinct threat vectors that demand two distinct responses. India's agencies are candid about the challenge, but candour is not the same as capability. The deeper worry is that community reporting — the last line of defence when digital trails go dark — is also eroding, as radicalised individuals grow more adept at masking their beliefs. Without a sustained counter-narrative infrastructure and a legal framework for proactive digital content removal, reactive interdiction will always be a step behind.
NationPress
1 May 2026
Frequently Asked Questions
What is the lone actor terror threat that Indian agencies are warning about?
Indian intelligence agencies warn that terror operatives, particularly those inspired by the Islamic State, are increasingly acting alone or in very small groups without any foreign handler or communication trail. This makes them significantly harder to detect and intercept compared to traditional structured terror modules.
How is the ISI's strategy different from the Islamic State's approach in India?
The ISI is reportedly pushing for self-funded, home-grown modules that maintain no communication with Pakistan before an attack, ensuring no traceable link to Islamabad. The Islamic State, by contrast, focuses on online radicalisation through DIY content, motivating individuals to act entirely on their own initiative without any organisational direction.
Which recent cases illustrate the lone actor threat in India?
Officials cited three recent cases: Zaib Zubair Ansari in Mumbai, Rizwan in Delhi, and Tushar Chauhan alias Hizbullah Khan in Uttar Pradesh. These cases reportedly reflect a surge in individuals radicalised through online content with no prior communication trail flagged by agencies.
Why is the Islamic State's radicalisation strategy considered more dangerous than the ISI model?
Unlike ISI-linked modules, Islamic State-inspired lone actors leave virtually no communication or financial trail, making pre-emptive detection extremely difficult. The group is also unconcerned with the scale of an attack, meaning even a low-casualty incident serves its goal of spreading psychological terror.
What steps are Indian agencies taking to counter the lone actor threat?
Agencies are shifting from traditional network interception to digital intelligence, community-based monitoring, and daily removal of radical and DIY content online. They are also appealing to families and communities to report unusual behaviour, a method that has shown some success in South India, though officials note that radicalised individuals are becoming more adept at appearing normal.
