Online Traps, Hawala Trails And...: How ISI-Underworld Module Weaponised Social Media to Target Mumbai

Mumbai: A cross-border conspiracy has been unfolded as investigators unravel the operational blueprint of a newly disrupted Inter-Services Intelligence (ISI)-underworld hybrid module.

Intelligence sources have revealed that the terror apparatus began its aggressive pipeline roughly four months ago, turning away from traditional back-alley networks and instead leveraging social media networks and end-to-end encrypted messaging applications to recruit Indian youth.

Cyber-Hunting and Digital Indoctrination

Rather than deploying ground operatives, Pakistan-based handlers systematically scanned public online profiles to identify vulnerable, impressionable, or ideologically aligned targets. 

Once an individual was marked, handlers initiated communication via social media, gradually tightening their grip through continuous digital grooming, radicalisation, and psychological influence.

Through this online clinical trap, three primary operatives, Huzaifa Hashmi, Touqeer, and Sajid Sheikh, were pulled into the network.

Immediately upon recruitment, the handlers fragmented the trio’s tasks, assigning specific, highly secretive operations to each accused to ensure that if one cell collapsed, the broader network would remain insulated.

The Pakistan Remote Control: Jhingada and Bhatti

Counter-terror investigators have established that the module’s entire architecture was managed remotely from Pakistan. 

The operation directly marries the strategic coordination of ISI operatives with the logistical muscle of the cross-border underworld.

Two notorious syndicate figures have been identified as the key handlers steering the network:

1. Munna Jhingada: A prominent underworld figure and a long-standing asset linked directly to transnational crime networks.

2. Shahzad Bhatti: A notorious Pakistani gangster who served as the primary online intermediary guiding the local recruits.

The accused were given rigorous instructions on urban tradecraft, specifically, how to avoid attracting the attention of local law enforcement, manage their digital presence safely, and blend into the heavy fabric of Mumbai while executing inspection missions.

Hawala Supply Chain and Bandra East Recce

To avoid state banking surveillance and evade stringent anti-money laundering triggers, the handlers bypassed financial institutions, utilising an underground hawala network (an informal, trust-based value-transfer system).

An initial operational advance of Rs 1 lakh was directly from Pakistan to finance local expenses. 

To avoid raising immediate red flags, the handlers broke the capital down into tiny, layered tranches distributed through separate couriers and channels before the hands of the primary accused.

The fund injection immediately fueled domestic espionage. Investigators suspect the operatives completed multiple tactical surveys and reconnaissance missions across sensitive zones in Mumbai, with a particular focus on dense, high-profile segments of Bandra East.

Photographs, structural videos, and geospatial maps gathered during these surveillance rounds were immediately exfiltrated to handlers in Pakistan through heavily protected, encrypted applications.

Mass Data Deletion and the Ahilyanagar Raid

A major shift in the timeline occurred following a targeted sweep by security units in Ahilyanagar, where four local youths were taken into custody. 

Preliminary questioning revealed that these four individuals were fully aware of the highly suspicious activities being carried out by Huzaifa, Touqeer, and Sajid Sheikh.

Furthermore, data suggests that the four detained youths maintained distinct, direct communication loops with gangster Shahzad Bhatti via encrypted apps.

The investigation now faces a race against digital self-destruction. Following initial arrests in the broader terror network, members of the module moved swiftly to wipe group chat logs, call archives, and digital footprints. 

Security agencies have confiscated an array of smartphones and electronic hardware, forwarding them for deep forensic retrieval to reconstruct the missing data.

Central agencies are working to pin down exactly which other locations, including VIP transit routes or high-density religious structures, were surveyed, while simultaneously investigating whether operational consignments of weapons had already arrived or were scheduled for a later drop.

Also Read: Punjab Road Tragedy: 9 Killed, Around 25 Injured In Truck-Jeep Collision