Uttar Pradesh has emerged as a major target in Pakistan’s evolving digital radicalisation and sleeper-cell recruitment strategy, with recent ATS arrests and multi-district investigations exposing an expanding network allegedly operated through social media by Pakistan-based gangster Shahzad Bhatti and handlers linked to Inter-Services Intelligence (ISI), senior central and state security agencies said.The revelations follow one of the largest coordinated crackdowns in recent years, during which central agencies and anti-terror units conducted simultaneous raids across Uttar Pradesh, Delhi, Haryana, Punjab, Rajasthan and Madhya Pradesh earlier this week. (For representation)Security agencies say the network reflects a new-age “hybrid threat” model in which online radicalisation, espionage, organised crime and covert anti-India activities are increasingly merged through decentralised and civilian-embedded modules that are harder to detect.The revelations follow one of the largest coordinated crackdowns in recent years, during which central agencies and anti-terror units conducted simultaneous raids across Uttar Pradesh, Delhi, Haryana, Punjab, Rajasthan and Madhya Pradesh earlier this week. Around 300 suspects were detained for questioning and digital scrutiny.Investigators believe Bhatti functioned as a proxy digital recruiter who used Instagram, YouTube and encrypted communication platforms to identify and influence vulnerable Indian youths, particularly in northern states.According to officials, Bhatti projected a carefully curated image of wealth and influence through videos featuring luxury vehicles, foreign travel, lavish villas, expensive resorts and bundles of cash. Agencies suspect the content was designed to attract impressionable youths seeking money, identity and social status before gradually exposing them to extremist narratives and covert operational tasks.Officials said Uttar Pradesh has become increasingly vulnerable because of its large youth population, widespread smartphone access and the rapid spread of social media influence networks.In Rampur district, agencies are probing links connected to local youth, Ghayas Pasha, who allegedly came in contact with Bhatti through social media platforms. Investigators suspect several other youths from the district, mostly aged between 20 and 25 years, may also have interacted with the network online.The concern deepened after the UP ATS recently arrested two youths, Hizbullah Ali Khan alias Tushar Chauhan from Meerut and Sameer Khan from Delhi’s Seemapuri, both around 20 years old and allegedly in the early stages of online indoctrination.A senior ATS officer said the two were not hardened operatives but vulnerable recruits undergoing systematic digital grooming. Their alleged handlers, identified as Shahzad Bhatti and his associate Aabid Jatt, reportedly used Instagram and similar platforms to establish trust before introducing extremist content and operational guidance.UP director general of police (DGP) Rajeev Krishna said recent cases across the state and NCR point towards an emerging “hybrid threat” pattern where social media radicalisation, criminal activity and espionage are orchestrated by foreign handlers.“These are not isolated cases. Youth are first drawn in through minor criminal activities or financial inducements, and then gradually pushed towards more serious anti-national acts,” Krishna said.He added that decentralised modules operating through encrypted platforms and civilian spaces have made detection more difficult, though timely intervention by UP Police and ATS has helped avert possible incidents.Investigators said the evolving strategy marks a shift away from traditional structured terror modules towards fluid digital micro-networks capable of carrying out reconnaissance, propaganda dissemination, sabotage and low-intensity attacks.In Ghaziabad, agencies recently dismantled an alleged espionage network involving around 21 arrests, including that of a woman. Investigators alleged the accused shared videos and locations of sensitive installations with Pakistan-based handlers in exchange for money while using civilians with local access to avoid suspicion.In Bijnor, police uncovered another module accused of posting videos with firearms, engaging in arson and damaging railway signalling infrastructure. Investigators said the group had allegedly explored plans to target automobile showrooms in NCR and western UP while attempting to create panic through disruption of transport systems.Security agencies said railway infrastructure is increasingly being viewed as a vulnerable target because even limited sabotage of signalling systems can disrupt large sections of the transport network.Investigators also referred to earlier cases involving fugitive gangster Shariq Sattha, whose alleged links with Pakistan-based handlers surfaced during the Sambhal violence investigation of November 2024 in which four people were killed.Officials said agencies are now mapping digital footprints, financial transactions and interstate communication patterns to determine the full extent of the alleged ISI-backed ecosystem operating through dispersed networks across UP and northern India.Senior officers indicated that further raids, digital surveillance operations and arrests are likely as agencies intensify efforts to dismantle the wider cross-border recruitment and espionage infrastructure.