Pakistan influencer Shahzad Bhatti linked to ISI‑run terror network

Shahzad Bhatti, a Pakistani social‑media personality known as “333,” is now identified by Indian security agencies as the alleged leader of a cross‑border terror recruitment network tied to the ISI [1]. In a coordinated crackdown during May‑June 2026, Indian police detained over 480 suspects across several states, accusing them of plotting attacks on police, public venues and a historic Delhi temple [1].

Key takeaways

• Indian authorities say Bhatti uses social platforms to lure unemployed Indian youth with promises of money and fame [2].
• Eight suspects were arrested in Delhi with hand grenades, Glock pistols and live cartridges recovered from them [1].
• The network is alleged to have links to the banned group Tehreek‑e‑Taliban Hindustan and to coordinate attacks via encrypted channels [1].
• Bhatti is claimed to operate from Dubai, traveling between the Middle East and Pakistan, while maintaining contacts with ISI handlers [2].
• The crackdown involved more than 500 mobile numbers, with arrests in Delhi, Punjab, Haryana, Rajasthan, Uttar Pradesh, Madhya Pradesh and Maharashtra [1].

From influencer to alleged terror recruiter

Bhatti, a native of Pakistan’s Punjab province, built a large following by posting videos on India‑Pakistan relations, religious topics and influencer disputes under the handle “333” [1]. Indian investigators contend that this online popularity was a façade for a broader recruitment operation. They allege that Bhatti’s network contacts vulnerable youths through private messages on Facebook, Instagram and YouTube, offering financial rewards, promises of overseas settlement and exposure to weapons [1]. Recruits are said to start with minor tasks such as sharing photos of specific locations before being drawn into more serious plots [1].

The Delhi Police’s Special Cell disclosed that eight arrested suspects in a May 2026 raid possessed four Pakistan‑made hand grenades, two Glock pistols, 24 live cartridges, a stolen motorcycle and a stolen scooter [1]. The accused included individuals from Uttar Pradesh, Jharkhand, Maharashtra, Punjab and a Nepali national, reflecting the network’s geographic spread [1]. Earlier, the Uttar Pradesh Anti‑Terrorism Squad and Special Task Force had detained four operatives linked to the same module [1]. In total, the nationwide operation detained 481 suspects, with authorities tracking more than 500 mobile numbers and social‑media accounts [1].

Alleged ISI links and planned attacks

Indian agencies assert that Bhatti receives direction from ISI handlers identified as Abid Jatt, Ajmal Gujjar and Yawar Khan [1]. The investigation also uncovered alleged connections to the outlawed Tehreek‑e‑Taliban Hindustan (TTH), with arrested men reporting instructions to graffiti “TTH” and an “S” on walls in Delhi and Faridabad [1]. Investigators claim the network collected GPS coordinates and videos of crowded hospitals, a major political party office, a historic Delhi temple, a popular dhaba on the Delhi‑Sonipat highway, and a military installation in Hisar, Haryana, to facilitate potential bomb or grenade attacks [1].

Sources say Bhatti operates from Dubai, shuttling between the Middle East and Pakistan, and has never set foot in India, complicating extradition efforts [2]. He reportedly claims a gang of 200‑300 youths spread across 16‑17 countries, though Indian officials note that new social‑media accounts continue to appear despite takedowns [2]. Recent arrests include two men from Madhya Pradesh accused of planning grenade attacks on Delhi‑NCR venues, and nine individuals from multiple states linked to plots against the historic temple and a military camp [2].

Why it matters

The allegations against Bhatti illustrate a growing concern for Indian security agencies: the use of social media to radicalise and recruit young Indians for low‑intensity terror operations, allegedly under ISI patronage. The large‑scale arrests demonstrate coordinated inter‑state policing, but also highlight challenges in tracking a decentralized network that operates across borders and constantly renews its online presence. As Indian authorities continue to pursue Bhatti—who they say remains in Dubai—the case underscores the need for diplomatic cooperation to address cross‑border terrorism and the digital tactics employed by such actors.