In a disturbing new twist to the Uttar Pradesh ATS crackdown on a terror module, a brazen display on social media has exposed how fragments of the network may still be active, even after key arrests.
Instagram Live raises serious questions
Days after the Uttar Pradesh Anti-Terrorism Squad (ATS) busted a terror module plotting a blast at Lucknow railway station, a purported member identified as Aqib surfaced on Instagram Live. What followed was even more alarming: terrorists based in Uttarakhand were seen openly brandishing drugs on camera. At the same time, the module’s so-called kingpin is believed to be operating from Dubai and continuing to engage online.
लखनऊ रेलवेस्टेशन पर ब्लास्ट की साजिश रचने और कई आगजनी की घटनाओं को अंजाम देने वाले जिस टेरर माॅड्यूल को UPATS ने bust किया था उसके तथाकथित सदस्य आकिब ने एक इंस्टाग्राम लाईव किया जिसमें उत्तराखंड में बैठे उसके साथियों द्वारा खुलेआम ड्रग्स लहराई@narcoticsbureau @uttarakhandcops pic.twitter.com/RFkZnFE0MF
— Adv. Kartik Baliyan (@KartikBaliyanUP) April 7, 2026
The episode underscores a dangerous shift, where terror operatives are not just coordinating covertly but are also leveraging social media to signal presence, intimidate, and possibly sustain their networks.
The foiled plot and arrests
The ATS operation had uncovered a module allegedly working under the direction of a Pakistani handler. The group’s objective was clear: create panic through targeted arson and a planned blast near Lucknow railway station.
The main accused, Saqib alias “Devil,” was arrested along with three others, Vikas Gehlawat alias Raunak (27), Lokesh alias Papla Pandit alias Babu alias Sanju (19), both from Gautam Buddh Nagar, and Arbaab (20) from Meerut.
Investigations revealed that the group conducted reconnaissance across multiple cities, including Ghaziabad, Aligarh, and Lucknow. They allegedly mapped sensitive locations, including railway signal systems and vehicles carrying gas cylinders, aiming to trigger large-scale disruption.
A planned attack around April 2 targeting infrastructure near Lucknow railway station was foiled before execution.
A digital-first terror modus operandi
The probe has revealed a hybrid model of operations, combining on-ground acts with digital amplification. The accused allegedly carried out minor arson incidents, recorded them, and sent videos to handlers in Pakistan. These clips were then used to solicit funds, transferred through QR codes.
Recruitment and coordination reportedly took place through platforms like Telegram, Signal, and Instagram, pointing to a decentralised but tech-enabled network.
During the arrests, authorities recovered inflammable materials, seven mobile phones, pamphlets, and identity documents.
Terror and drugs: A convergence
The Instagram Live incident has also revived focus on a long-established nexus: terrorism and narcotics. Terror networks have historically used drug trafficking both as a funding mechanism and as a tool for destabilisation.
The visual of associates openly displaying drugs is not incidental; it suggests overlap between criminal syndicates and extremist modules, with social media acting as a force multiplier.
Legal action and ongoing probe
A case has been registered at the ATS police station in Lucknow under multiple sections of the Bharatiya Nyaya Sanhita (BNS) and the Unlawful Activities (Prevention) Act (UAPA). Authorities are now working to identify remaining operatives and trace the full extent of cross-border linkages.
