Between two Punjabs, via Portugal and Brazil: How Shehzad Bhatti’s ‘low-cost’ terror network works
Meanwhile, his instructor, whom he identified as one Shehzad Bhatti, swiftly replaced him with another set of young men from Punjab to carry out the grenade attack that took place on 25 November last year.
This was just one of the attacks attributed to Shehzad Bhatti, an alleged operative of Pakistan’s intelligence agency, Inter-Services Intelligence (ISI), Bhatti has been accused of running a wider web of operatives who have targeted uniformed personnel as well as establishments of police and security agencies in recent months. The police and security agencies have busted hundreds of such modules run by Bhatti in states such as Punjab, Haryana, Delhi, Uttar Pradesh, Maharashtra, and recently in Jharkhand. A native of Pakistan’s Bahawalnagar, Bhatti has been on the payroll of ISI and was last located in Brazil by Indian intelligence and investigative agencies.
“The methods of Bhatti are different from any other accused or terror handler operating from abroad,” a source in the security establishment told ThePrint. “He is not indoctrinating or radicalising a handful of accused for huge operations or big attacks. Instead, he has created an army of hundreds of gullible youths with his online presence and allurement of visas for foreign countries and a few thousand rupees to carry out the acts, presumably to just keep challenging the law and order machinery to boost his propaganda,” the source further said.
The extensive nature of Bhatti’s module was on display on 12 August this year, when security agencies arrested more than 200 operatives linked to it. Union Home Minister Amit Shah said that raids conducted by agencies led to 253 detentions across 14 states — Uttar Pradesh (62), Haryana (52), Delhi (51), Punjab (44), Rajasthan (15), Maharashtra (8), Uttarakhand (5), Karnataka, Gujarat and Bihar (3 each), and Telangana, Himachal Pradesh, J&K and Kerala (2 each).
Also Read: Terror module behind Red Fort blast took shape in 2022 under codename ‘Op Heavenly Hind’, says NIA
Hitting the headlines
Amid the wave of grenade attacks on police stations and checkpoints in the border districts of Punjab, village Raipur Rasulpur in the Jalandhar Rural district woke up to sirens and a massive police presence on 16 March last year. The previous night, a local YouTuber whose popularity had soared among Punjabis, including the Punjabi diaspora abroad, had an unwanted, alien metallic object on the balcony of his house.
“I saw some round-type metal object lying on the balcony, so I got scared, and I called Maqsudan Police Station,” the YouTuber, named Navdeep Singh, also known as Roger Sandu, told the police.
Hours later, Bhatti took to social media to take responsibility for the attack—and since Sandu too was “sure” it was Bhatti’s doing, Punjab Police booked the Pakistani gangster, including under the Unlawful Activities (Prevention) Act. Bhatti had also claimed support from Zeeshan Akhtar, a gangster from the same district who fled India after allegedly plotting the murder of politician Baba Siddique in Mumbai.
In his statement to the police, Sandhu alleged that Bhatti wanted him to participate in a live-streamed game with him, which would have enabled Bhatti to gain promotion and receive more online gifts from various sources. On the other hand, Bhatti attributed his act of throwing a grenade at his residence to Sandhu speaking against Islam.
In its probe, the Punjab Police arrested nine accused, including the main accused, named Hardik Kamboj, from Haryana’s Yamunanagar district. The investigators found that Kamboj and one Amritpreet Singh had thrown the grenade at Sandhu’s residence.
In its chargesheet, the police alleged that Kamboj had received training on handling hand grenades from a serving army soldier named Sukhcharan Singh. He was arrested in Rajouri, Jammu and Kashmir, where he was posted in his official capacity. The grenade used in the case was arranged by an accused from Karnal, Dipender Pratap Singh alias Dipen Rana. Earlier this year, the National Investigation Agency (NIA) charged both Bhatti and Rana in the case.
‘Asset of ISI, wanted by Pakistani police
In its chargesheet, the NIA concluded that Amritpreet Singh was the principal node of the module that carried out the attack on Sandhu’s residence. The agency found that Amritpreet was contacted by his Canada-based school friend Gaurav Gill, who further brought Kamboj into the plan hatched by Bhatti.
Bhatti, originally a resident of Christian Quarter in Bahawal Nagar of Pakistan’s Punjab province, organised the entire plot from abroad and arranged the grenade with the help of Dipen Rana, which was later supplied to Kamboj and Amritpreet for the attack.
Sources in the Indian security establishment trace Bhatti’s journey to notoriety with the gang of Farrukh Khokhar in Punjab’s Rawalpindi town, where he was accused of street crimes in the city. After facing a crackdown from the Punjab Police in Pakistan, Bhatti is believed to have slipped away to the United Arab Emirates sometime in 2015, from where he started small-scale businesses.
“The story of Bhatti is a classic case of contradiction that flows in the Pakistani security system. Bhatti faced several cases, and he is still wanted by the police there, and hence he can’t return to Pakistan,” said another source in the security establishment. “However, he has transformed himself into an asset for the ISI to keep a low-cost, small-scale war going against India, at least in border states,” the source further said.
According to the official records, Bhatti faces at least 15 cases in Punjab alone, which include cases of targeted killings of Punjab Police personnel in the border districts of Gurdaspur and Amritsar Rural police districts earlier this year.
Over the years, Bhatti has changed the country of his residence to Portugal and Mexico, and, according to sources, he is in Brazil now. Earlier this year, a Bhatti video, claiming that jailed gangster Lawrence Bishnoi had organised an attack on him in Portugal, went viral.
Later, Bhatti had also issued threats to Bishnoi’s younger brother and jailed gangster Anmol Bishnoi shortly after his deportation and arrest by the NIA, prompting the agency to request the court to conduct a hearing at its headquarters only for security purposes.
‘ISI’s stooges’
The Punjab Police had in February this year found two of its personnel—Assistant Sub Inspector Gurnam Singh and Home Guard Ashok Kumar dead at a checkpost around a kilometre from the Pakistan border in Adhian village. Hours later, an obscure outfit named Tehreek-e-Taliban Hindustan (TTH) took responsibility for the killings in a series of videos showing the shooting of the police personnel, with the audio in Bhatti’s voice.
The same outfit had taken responsibility for the daylight killing of ASI Joga Singh at the highway under the Majitha Police Station limits of the Amritsar Rural police district.
ThePrint had earlier reported that the Punjab Police had claimed to have established that the accused who killed the personnel at the Dorangla police outpost in February were working on the directions of the PIOs (Pakistani Intelligence Operatives) based across the border.
Later on, the outfit’s name also surfaced in the incident of a petrol bomb hurled at the Rashtriya Swayamsevak Sangh (RSS) office at Ranchi in June this year. The NIA has taken over the case and taken custody of the three accused from the Jharkhand Police.
Similarly, one more name, Khalistan Liberation Army, surfaced in several such attacks that police and investigative agencies have identified as having been done on Bhatti’s behest. The first such instance was the grenade attack on Gurdaspur City Police station in November last year, when hours after the attack, social media posts appeared taking responsibility for the attack.
“Waheguru Ji Ka Khalsa Waheguru Ji Ki Fateh, Khalistan Liberation Army took responsibility for today’s i.e. 25-11- 2025 grenade attack on police station City Gurdaspur, and these kinds of attacks will continue till Hindu people will speak against the Khalistani people,” read the post along with “Khalistan # BKI Khalistan Liberation Army # Punjab Police, King shooters 302”, according to the court documents.
Later, the same outfit (KLA) name resurfaced after a low-intensity explosion near the Khasa Army cantonment boundary wall in Amritsar and a concurrent blast outside the Border Security Force (BSF) Frontier Headquarters in Jalandhar on May 5, 2026.
The Jalandhar Police arrested two accused in the BSF’s case—Umar Deen, a taxi driver from Zirakpur town, and Anil Kumar from Uttar Pradesh as part of the probe.
In its probe, the Punjab Police found that Umar Deen came into contact with Bhatti on Instagram and was lured by an offer of up to Rs 10,000 to place an explosive device outside the BSF headquarters in Jalandhar. Anil was allegedly asked to shoot the video of IED placement, and he successfully carried out the task, sources in the Punjab Police said.
Hours after the twin explosions in Jalandhar and Amritsar, Punjab DGP Gaurav Yadav said that outfits such as KLA were “non-existent entities” and were nothing but “stooges of the ISI”.
Similarly, responsibility for carrying out an attack inside a police station at Ambala was claimed by the “Khalistan Army”. The NIA however found that Bhatti personally overseen and managed the entire chain of events leading up to the attack.
Told ‘not to kill’
A BA third-year student, Sandeep Singh alias Billa from Fazilka, had attended a wedding in his maternal aunt’s village in Faridkot. At the wedding, he later told investigators that he met one Sukhjit Singh alias Seetu, who further introduced him to one Harjinder Singh alias Tinda.
Over time, they began discussing several plans and issues among themselves, and eventually Tinda told Billa that he and his brother were in contact with Shahzad Bhatti and that they used to get money from him whenever they needed it.
After taking Bhatti’s number, Billa allegedly sent a “Hello” message, to which Bhatti replied after some weeks, saying he had a task for him. Over the course of their WhatsApp conversation, Bhatti allegedly enquired about the distance between the RSS and BJP offices from his native village. Additionally, he further instructed Billa to collect a consignment of sophisticated weapons from Amritsar.
In no time, Billa also brought along his “close friends,” Gurvinder Singh and Nakul Kumar, from his village, and waited for instructions from Bhatti, who asked him for the nearest major city in Punjab to his village among Jalandhar, Ludhiana, Patiala, and Bathinda. Billa said Bathinda, and Bhatti deposited a sum of Rs 5,000 in his accomplice’s bank account.
The overall promise was for something between Rs 1 and Rs 10 lakh, Billa later told the police after his arrest. He was arrested by the Bathinda Police as part of a probe into the petrol bomb attack on the clinic of local BJP leader Tarsem Garg in the city. The police first arrested Nakul and Gurwinder, then Billa.
During the investigation, Billa allegedly told the police that Bhatti had explained the process to manufacture a petrol bomb and assured them that “the work was neither very risky nor difficult and would be completed quickly and safely”.
Based on Bhatti’s instructions, Billa, along with Gurvinder and Nakul, assembled in their village, bought petrol for Rs 200, filled it into two glass bottles, packed them in a bag, and travelled to Bathinda by bus. Upon arrival, they further informed Bhatti about their location. Then, the trio allegedly hired an auto-rickshaw to conduct a recce of the location suggested by Bhatti and sent two pictures of the location to the Brazil-based terror operative.
The trio tried to throw the petrol bomb early in the evening but could not succeed due to the rush at the clinic and the area nearby. Then, Gurvinder allegedly threw the bomb into the clinic, and Billa allegedly recorded the act on his phone, which he later sent to Bhatti over WhatsApp.
While Bhatti had meticulously planned the entire attack, he had one specific instruction to his operatives too. “Billa said during the probe that they had specific instructions not to cause loss of life and that the act was only intended to create fear,” a police officer privy to the probe told ThePrint.
A similar pattern was observed in the attack outside BSF’s frontier headquarters in May this year. “There was a big explosion carried out by the IED, but there were no sharp nails recovered from the site of the explosion,” a police officer said. “The absence of sharp nails and such loud explosions only meant that the act was done to create fear and a semblance of disturbance in the city,” the officer said.
The NIA has also taken over the probe into the BSF headquarters explosion case.
(Edited by Nardeep Singh Dahiya)