A new terrorist organisation, Tehreek-e-Taliban Hindustan (TTH), has come under the scanner of Indian security agencies after it claimed responsibility for the killing of three police personnel in Punjab, two in February and one in May. In its latest poster, in which it claimed responsibility for the murder of Punjab Police ASI Joga Singh in Majitha, Amritsar, the organisation issued threats to police, army, RAW officials and government employees.
It is now being examined as a Pakistan backed proxy. According to the latest reports, Shahzad Bhatti, a gangster-turned-terrorist from Pakistan who has links to the ISI, is the mastermind behind TTH.
TTH claims responsibility for ASI Joga Singh’s killing
The most recent claim by TTH surfaced on 24th May 2026, when the terror outfit released a post claiming responsibility for the murder of ASI Joga Singh in Amritsar, Punjab. The poster, written in English and Punjabi, claimed that the “Al Burq Bde” of TTH had carried out the attack. TTH congratulated one “Commander Sangar Yar”, described as “Naib Sipah Salar”, for the “coordinated attack”.
Furthermore, the poster also issued open threats to government officials and warned them to resign from service if they wanted to live. It further called upon TTH commanders to carry out attacks against serving personnel of police, army and RAW. TTH added that it would release a video of the murder, which, according to The Indian Express, was later released.
The poster included images showing ASI Joga Singh in uniform, visuals purportedly from the attack, and a photograph appearing to show him riding a motorcycle. The authenticity of the poster is yet to be verified, and Punjab Police stated that the outfit might not even exist. However, security agencies are still looking into it, considering Shahzad Bhatti’s name has appeared as the mastermind behind it.
Video of the killing and pattern seen in earlier attacks
Two days after the attack, TTH reportedly released the video showing the attack on social media. According to media reports, the footage showed the officer travelling on his motorbike before being shot at close range. The attackers then allegedly filmed his body from close range.
The pattern followed by TTH in this case is significant because a similar public claim was made by TTH after the murder of two police personnel at the Dorangla police outpost in Gurdaspur district in February 2026. In that case too, a video was reportedly transmitted to Pakistan based handlers and later circulated online.
Punjab Police is probing whether TTH exists as an independent outfit or whether the name is being used as a proxy identity by Pakistan based handlers to create fear, claim terror attacks and maintain plausible deniability for the ISI.
What is Tehreek-e-Taliban Hindustan
Tehreek-e-Taliban Hindustan, or TTH, has appeared in recent months as a name attached to terror claims, graffiti, recruitment attempts, and threats against Indian security personnel. Investigation agencies quoted in multiple reports have described it not as a well established terror organisation with a conventional structure, but as a propaganda driven proxy identity allegedly backed by Pakistan’s ISI.
The name appears to echo Tehreek-e-Taliban Pakistan, which has repeatedly attacked Pakistani security forces. According to intelligence officials quoted in media reports, Pakistan’s larger plan appears to be to create a narrative that a Taliban style outfit exists inside India, and then link this imagined or manufactured ecosystem to the TTP.
This helps Pakistan in three ways. First, it gives Pakistan a deniability layer for attacks on Indian soil. Second, it helps Islamabad float the claim that India is somehow connected to the TTP, which has become a major internal security headache for Pakistan. Third, it allows Pakistan’s handlers to recruit disposable foot soldiers in India without publicly exposing the Pakistani command structure behind the operations.
The man behind TTH, Shahzad Bhatti
Shahzad Bhatti’s name appears repeatedly in investigations linked to TTH. Indian investigation agencies and police sources have described him as a Pakistan based gangster, terrorist operative and ISI proxy. He is believed to be a resident of Lahore and is suspected to be operating from Dubai while moving between Pakistan, Dubai and other Middle Eastern countries.
Bhatti has been named as a key figure in several investigations linked to terrorism, organised crime, narco terror financing, illegal arms movement, online radicalisation and target killings. Jammu and Kashmir Police DGP Nalin Prabhat directly named him while warning Pakistan sponsored narco terror networks. He called him an ISI associate involved in pumping narcotics into India.
According to Indian security officials, Bhatti functions as a bridge between criminal syndicates and extremist operatives. His network is suspected to use social media platforms, encrypted messaging apps and local criminal elements to identify vulnerable youth, assign small tasks, and then gradually push them towards violent operations.
Graffiti as the first step of terror branding
One of the early projects assigned by TTH to an Indian operative was graffiti. According to media reports, Delhi Police Special Cell arrested a man named Sohail from Delhi. He reportedly had a prior criminal record. During the investigation, it was found that Bhatti had assigned him the task of painting “TTH” across prominent walls and locations in Delhi and Faridabad.
Reportedly, he was instructed to paint the letter “S” below the TTH acronym, which was meant to act as Bhatti’s personal signature. Agencies also found that money was sent to him from Pakistan for this “test task”.
This graffiti strategy was not limited to Delhi and Faridabad. In separate investigations, accused persons linked to Bhatti were allegedly asked to paint TTH graffiti in Punjab, Uttarakhand and other places.
Recruitment of Indian youth through social media
Investigators have found that handlers allegedly scan social media profiles to identify unemployed or vulnerable youth, lure them with money, and begin with small assignments.
The initial tasks assigned to them reportedly included painting graffiti, filming police stations, conducting reconnaissance of public places, recording videos with firearms, or tracking security personnel. Once the recruit is trapped inside the network, the tasks become more serious, including firing at clubs, throwing grenades, targeting police personnel, and filming terror acts.
Delhi Special Cell arrests and failed attempt to shoot a policeman
Recently, Delhi Police Special Cell arrested three youths who were reportedly in direct contact with Bhatti, Adib Jatt and Ajmal Gujjar. Reports suggest that they were ordered by Bhatti to record videos displaying firearms and film themselves shooting a policeman. Bhatti had promised them large sums of money on completion of the task.
The accused reportedly tracked a police personnel from Uttar Pradesh and filmed the pursuit. They attempted to open fire. However, the country made pistol got jammed at the last moment. When the policeman turned around, the suspects fled. They were later tracked down and arrested by the Special Cell.
A senior officer told the media that the two connected cases helped police conclude that TTH was being used as a front by Bhatti, with alleged strategic backing from the ISI.
Sirsa women police station grenade attack and NIA chargesheet
In November 2025, a grenade attack took place on the Sirsa Women Police Station in Haryana. The incident is being investigated by the National Investigation Agency (NIA), which linked it to Shahzad Bhatti. On 26th May 2026, NIA said it had filed a chargesheet against nine accused, including two Pakistani nationals, in connection with the case.
Nine accused, including two Pakistan nationals, have been chargesheeted in connection with the November 2025 grenade attack on the Sirsa women police station in Haryana. The attack was carried out by Indian operatives on directions of Pak-based handlers. pic.twitter.com/VL8NLbmX1V
— NIA India (@NIA_India) May 26, 2026
The chargesheet named Pakistani nationals and handlers Shahzad Bhatti and Sohail Ahmad alias Sohail Baloch. The arrested Indian nationals named were Dheeraj alias Dhiru, Vikas alias Vikky, Sandeep alias Daimar, Vikas, Sushil alias Sillu, Mohammad Sijaan alias Sijaan alias Ghazi, and Gurjant Singh.
NIA said in a press release that the accused were charged under relevant sections of the UAPA, BNS and the Explosive Substances Act. The agency said the attack was part of a conspiracy orchestrated by Pakistani gangster and terrorist Shahzad Bhatti to create terror by targeting police establishments and personnel in India.
NIA said Bhatti and Sohail Baloch recruited and radicalised Indian accused through social media platforms and encrypted communication channels. Operational modules were established in India, local operatives were assigned to carry out grenade attacks, and Dheeraj was identified as the principal India based operative responsible for coordinating attacks with local modules.
After reconnaissance, the accused chose the women police station in Sirsa as the target. They travelled to Amritsar to procure the grenade from Gurjant Singh. The attack was carried out on 25th November 2025, and it was also recorded on a mobile phone for dissemination and publicity.
The NIA said its investigation established a chain of recruitment, financing, operational coordination, procurement of explosives and execution of the terror act under directions from Pakistan based handlers.
Delhi NCR terror plot and the Bhatti module
In April 2026, Delhi Police Special Cell uncovered another plot involving shootings, grenade attacks and planned murders in Delhi NCR. Two men, Rajveer and Vivek Banjara from Madhya Pradesh, were arrested.
Police said both were working at the behest of Shahzad Bhatti, described as a Pakistan based gangster and ISI proxy. The Special Cell had received inputs that Bhatti and his men were planning major criminal acts in Delhi NCR. A case was registered on 31st March, after which the police tracked the accused through technical and human intelligence.
Vivek Banjara was arrested on 16th April from Dabra in Gwalior, while Rajveer was arrested on 18th April from Sarai Kale Khan in Delhi. A pistol and six live cartridges were recovered from Rajveer. Their phones reportedly contained incriminating videos and voice notes exposing the network.
In a statement, police said that Rajveer was preparing to target a major hotel in Delhi NCR. He was receiving instructions from Pakistan. Reportedly, he was inducted through social media by “Rana Bhai”, believed to be a close associate of Bhatti. Later, Rajveer recruited Vivek.
In March, Bhatti instructed Rajveer to procure weapons from Ahmedabad, but the delivery failed. On 9th April, both accused travelled to Amritsar, where they were given a pistol, around 20 cartridges and Rs 20,000 in cash. They were told to open fire at a club in Zirakpur that was already receiving threats from Bhatti. On 11th April, Rajveer attempted the shooting, but the pistol malfunctioned. Vivek recorded the attempt, apparently to send it to the handler.
Later, Rajveer hid the weapon and sent its location to the Pakistani handlers. He went to Faridkot, received another pistol and cartridges, and returned to Delhi with the intention of targeting a major hotel before being arrested.
Dehradun sleeper cell and TTH graffiti
The Bhatti network has also been probed in Uttarakhand. In April this year, Uttarakhand STF and Dehradun Police arrested a man named Vikrant Kashyap from the Jhajhra area under Premnagar police station limits during “Operation Prahar”.
Media reports suggest that Kashyap was in contact with Bhatti and his associates through Instagram and WhatsApp. Security agencies recovered a .32 bore pistol, seven live cartridges, a spray paint can and a mobile phone from him.
Investigators reportedly found that Kashyap had conducted reconnaissance of sensitive and important places in Dehradun, including the police headquarters and ISBT. He was also involved in painting Tehreek-e-Taliban Hindustan graffiti in different parts of Dehradun to create fear and confusion. He was reportedly promised a Dubai visa via Nepal after completing the assigned tasks.
Reports further said that he had been asked to throw grenades at a lawyer known for making anti Muslim speeches, while another operative named Gurjar was supposed to supply bombs to him.
Punjab and Gurdaspur killings
TTH first came into the public glare in February 2026 when it claimed responsibility for an attack on a police post in Gurdaspur, close to the international border. ASI Gurnam Singh and Home Guard jawan Ashok Kumar were killed in that attack.
Hours after the attack, a social media statement attributed to TTH claimed responsibility. Soon after, Pakistani gangster and ISI operative Shahzad Bhatti issued a video, with a purported voiceover, showing the two police personnel being shot from close range.
Punjab Police sources have reportedly said there is enough evidence to show that the Gurdaspur attack was carried out on the direct instructions of Pakistani intelligence operatives across the border. At the same time, they have also cautioned that there is no conclusive evidence that TTH exists as an independent structured outfit. The more likely scenario, according to security sources, is that the name is being used as an ISI proxy brand.
Jammu resident arrested for links with Shahzad Bhatti
Ahead of Republic Day celebrations on 26th January, Punjab Police arrested a Jammu resident, Raman Kumar alias Golu, for his links with Pakistan based terrorist Shahzad Bhatti. The arrest was made by the State Special Operation Cell, SAS Nagar. Punjab DGP Gaurav Yadav confirmed the development in a post on X and said that a .30 bore pistol was recovered from the accused.
According to the police, Raman Kumar was a key associate of Shahzad Bhatti and was in direct contact with the Pakistan based gangster through Instagram and WhatsApp. DGP Yadav said Raman was also involved in the Ambala Police Station blast case and had provided financial support to the perpetrators. His arrest further strengthens the pattern of Bhatti using social media and local operatives in India to build modules, arrange logistics and support terror linked activities.
Why Pakistan may be pushing the TTH narrative
The creation or projection of TTH appears to have a strategic narrative purpose for Pakistan. The ISI has long attempted to run terror operations in India through proxy names, local modules and criminal networks.
According to intelligence officials, Pakistan wants to link TTH with TTP to build a false narrative that India and Afghanistan are nurturing terror groups targeting Pakistani security forces. This comes at a time when relations between Pakistan and the Afghan Taliban have worsened, while India has reopened diplomatic engagement with the Taliban regime in Afghanistan.
Pakistan has accused the Afghan Taliban of sheltering or enabling TTP. By projecting TTH as a supposedly India based offshoot or ideological cousin of TTP, Islamabad may be attempting to claim that India is also involved in sustaining the TTP ecosystem. This would allow Pakistan to deflect attention from its own long history of using jihadist and criminal proxies for strategic goals.
The apparent aim is to keep the cost low and the fear high, with Indian recruits carrying out attacks while Pakistan based handlers remain hidden.
Shahzad Bhatti’s wider criminal and terror network
Bhatti’s name has appeared in several cases beyond TTH. In March 2024, he was reportedly involved in orchestrating a grenade attack near the residence of YouTuber Rozer Sandhu in Jalandhar. He has also been linked in reports to the murder case of NCP leader Baba Siddique in Mumbai, with allegations that he helped key conspirator Zeeshan Akhtar flee India.
Over the last few months, more than a dozen FIRs have reportedly been registered against Bhatti in Delhi, Uttar Pradesh, Punjab, Haryana, Rajasthan and Uttarakhand for recruiting youth to carry out terror activities. The NIA has also reportedly registered two FIRs against him. Many of these cases include BNS Section 152, dealing with acts endangering the sovereignty, unity and integrity of India.
Investigators suspect that Bhatti has never visited India and is not an Indian citizen. This makes extradition and prosecution dependent on diplomatic coordination with countries where he may be operating, including Dubai and Pakistan.
Security agencies have also been trying to take down his social media accounts and accounts linked to him. However, officials say new accounts keep appearing, continuing the cycle of propaganda and recruitment.
Social media as weapon and recruitment pipeline
Bhatti’s alleged network seems to depend heavily on social media. Reports say he claims to have a gang of 200 to 300 youths spread across 16 to 17 countries. Whether this claim is true or propaganda, it serves the purpose of projecting power. The videos, posters, graffiti tasks and attack recordings appear designed to create visibility and fear.
The same pattern was seen in the Sirsa grenade attack, which NIA said was recorded for dissemination and publicity. It was also seen in the Gurdaspur and Amritsar cases, where videos of attacks were allegedly circulated after the killings.
Links to narco terror, arms and foreign networks
Jammu and Kashmir Police have accused Bhatti of being part of Pakistan sponsored narco terrorism aimed at reviving terrorism in J&K and other parts of India. Agencies have alleged that he is linked to narcotics smuggling and arms trafficking networks connected to Pakistan’s ISI, with operational links extending to Pakistan and Dubai.
Security officials also claim Bhatti has been involved in criminal activities such as bomb making and the supply of illegal arms and ammunition to India, Dubai, the US and Canada. His alleged links with Rawalpindi based politician and businessman Farukh Khokhar have also come under scrutiny.
A purported video from 2024 showed Lawrence Bishnoi speaking to Bhatti on Eid. However, reports suggest that the relationship later soured after the Pahalgam terror attack, with Bhatti reportedly daring Lawrence and his gang to come to Pakistan. In February, Bishnoi’s gang claimed an attack on Bhatti in Portugal.
The emerging picture
From the cases reported so far, TTH looks less like a conventional outfit and more like a name being used for propaganda, fear and deniability. Shahzad Bhatti appears to be the man operating the machinery from Pakistan and Dubai. Indian recruits are being lured through social media, given money, weapons and instructions, and then pushed towards attacks on police personnel, public places and security targets.
Graffiti is used to create visibility. Videos are used to create fear. Small crimes are used as recruitment tests. Bigger attacks are assigned once handlers establish control. Police personnel are being deliberately targeted because such attacks generate panic, challenge the state and provide propaganda value.
From Sirsa to Gurdaspur, from Delhi to Dehradun, from Amritsar to Zirakpur, the same name has repeatedly surfaced, Shahzad Bhatti. Tehreek-e-Taliban Hindustan may or may not exist as a conventional terror organisation, but the network operating under its name is now a major counter terrorism concern for Indian agencies.
