South Asia Intelligence Review
TTH – New Proxy
On June 18, 2026, Saif Ansari alias Rohit was arrested in Ranchi, Jharkhand, while Aman Ansari alias Golu and Sayam Sujan were arrested near Gajhandi Railway Station in the Koderma District of Jharkhand on June 17, 2026, for hurling petrol bombs at the Rashtriya Swayamsevak Sangh (RSS) office in Ranchi, Jharkhand, on June 17, 2026. All three arrestees were linked with Pakistan’s Inter-Services Intelligence (ISI)-funded Tehreek-e-Taliban Hindustan (TTH). Officials said all three were in constant touch with their handlers through encrypted messaging platforms, including Botim and WhatsApp. The Botim app is widely used in Dubai. It was reported that the accused recorded the entire incident involving the throwing of petrol bombs on their mobile phones and later shared the footage with their handlers. Investigators also said accused Saif Ansari and Aman Ansari had travelled to Dubai, where they came into contact with Shahbaz Rana alias Bhatti, a Pakistani national. They are believed to have been radicalised during this period and later agreed to carry out activities in support of TTH’s anti-India agenda.
On June 18, 2026, the Anti-Terrorist Squad (ATS) of the Uttar Pradesh Police arrested two men, Mohammad Umar, 19, and Faizan, 21, residents of Akbarpur Village in the Bulandshahr District of Uttar Pradesh (UP), for working for Pakistan’s Inter-Services Intelligence (ISI)-based operatives, engaging in activities aimed at creating fear, as well as espionage. The accused were entrusted with conducting surveillance of the Army Cantonment in Lucknow and the Indian Air Force (IAF) Station at Bamrauli in the Prayagraj District of Uttar Pradesh, and sharing information with their handlers. For this task, they were promised INR 10,000. Investigators added that the two accused came in contact with Pakistani gangsters Shahzad Bhatti, Abid Jatt, Hammad Barkati and Rana Hunain through WhatsApp and Instagram. According to ATS, the network was backed by ISI and was attempting to create sleeper cells in India through social media platforms.
On June 16, 2026, Delhi Police dismantled a Pakistan ISI-backed terrorism-crime module operating across the Delhi-NCR region and arrested seven operatives – Anas Tyagi, Mohit alias Yogi, Deepak Agrola, Arif alias Pradhan, Jatan, and Sabir, all residents of Ghaziabad in Uttar Pradesh, and Karanvir Singh from Punjab – accused of smuggling arms and narcotics from across the border. The module was being run by Pakistan-based gangster-turned-terrorists Shahzad Bhatti and Ajmal Gujjar, who are believed to be operating under the patronage of Pakistan’s Inter-Services Intelligence (ISI). The accused were involved in procuring and distributing illegal arms, ammunition and narcotic substances smuggled into India through drone drops along the Punjab border, before being supplied across Delhi-NCR.
On June 9, 2026, the National Investigation Agency (NIA) carried out operations at 18 locations in nine Districts of Haryana and Punjab in connection with three major cases linked to Pakistan-based narco-terrorist Shahzad Bhatti. NIA’s investigation in case RC-22/2025/NIA/DLI had traced the March 16, 2025, grenade attack at the residence of social media influencer Roger Sandhu in Jalandhar, Punjab, to Shahzad Bhatti. NIA further found that Bhatti was the mastermind behind the November 25, 2025, explosion at the Women’s Police Station, Sirsa, Haryana (case RC-24/2025/NIA/DLI), and the January 10, 2026, blast at Baldev Nagar Police Station in Ambala, Haryana (case RC03/2026/NIA/DLI). Operating from across the border, Bhatti is also behind narco-terrorism networks in Jammu and Kashmir (J&K) and has recently floated a new terrorist formation, the TTH, according to official sources.
On May 26, 2026, NIA disclosed that it had filed a charge sheet against nine people, including Pakistani nationals and handlers, Shahzad Bhatti (the ‘mastermind’ behind TTH) and Sohail Ahmad alias Sohail Baloch; and had arrested Indian nationals Dheeraj alias Dhiru, Vikas alias Vikky, Sandeep alias Daimar, Vikas, Sushil alias Sillu, Mohammad Sijaan alias Sijaan alias Ghazi, and Gurjant Singh, in connection with the November 25, 2025 grenade attack on a women’s Police Station in the Sirsa District of Haryana.
On May 24, 2026, an outfit identifying itself as TTH claimed responsibility for the killing of Punjab Police Assistant Sub-Inspector (ASI) Joga Singh in the Majitha area of Amritsar District in Punjab. A poster circulated on social media by the group’s ‘Al-Burak squad’ claimed involvement in the attack and threatened further assaults against Police, Army, and intelligence personnel.
On May 24, 2026, Intelligence and law enforcement agencies uncovered that gangster-turned-terrorist Shahzad Bhatti, operating from Pakistan, was the ‘mastermind’ behind the propaganda and operations of TTH.
On April 9, 2026, the Uttarakhand Special Task Force (STF) arrested a 29-year-old man, Vikrant Kashyap, a resident of the Jhajhra area of Premnagar in Uttarakhand, for suspected involvement in anti-national activities and conspiring to establish a foothold for TTH in the state. According to the Police, Kashyap had come under the influence of Pakistani handlers, specifically identified as Shahzad Bhatti and an associate known as ‘Rana’.
On March 23, 2026, an 18-year-old key TTH operative, Harmandeep Singh alias Harman, linked to Shehzad Bhatti, was arrested by the special cell of the Delhi Police. The arrestee was being groomed to carry out grenade attacks and to paint pro-TTH graffiti across Delhi, Punjab and Uttar Pradesh.
On February 22, 2026, two Policemen, Assistant Sub-Inspector (ASI) Gurnam Singh and Home Guard Ashok Kumar, were killed at Adhian village under Dorangla PS limits in the Gurdaspur District of Punjab near the International Border (IB). Initial findings suggested that the officers were shot while asleep, pointing to a targeted attack rather than a coordinated strike. TTH posters were circulated on social media, claiming responsibility.
According to partial data collated by the Institute for Conflict Management (ICM), at least three persons have been killed, and nine persons have been arrested linked to the TTH in the current year (data till June 21, 2026). 13 persons linked with Shahzad Bhatti were arrested in 2025 and another 40 in 2026.
Shahzad Bhatti, originally from the Punjab Province of Pakistan, is identified as a Pakistan-based underworld figure who operates an advanced criminal network with deep ties to Pakistan’s intelligence agency, the Inter-Services Intelligence (ISI). According to Indian officials, he is described as a key ISI proxy, tasked with managing cross-border terrorist modules and recruiting Indian youth through social media platforms to carry out high-profile strikes. Beyond terrorism, Bhatti commands an extensive arms and narcotics smuggling syndicate, especially in J&K, using his international reach to challenge rival factions like the Bishnoi gang, and was at one time known to have friendly ties with gangster Lawrence Bishnoi. Bhatti first came under the radar of Pakistan’s Police in 2013, when cases involving theft and robbery were registered against him. Around 2015, Bhatti is believed to have moved to the UAE, where he claimed to own an agricultural and dairy business. His current location remains unclear, but investigators believe he moves between Pakistan and Gulf countries. Bhatti is not only linked to ISI but also receives support from Pakistan-based ISI handlers such as Abid Jatt, Ajmal Gujjar, his close aides, and Yawar Khan, a Dubai-based ISI handler, linked to the Dawood network. Authorities have further stated that Bhatti’s network operates through social media platforms such as Facebook, Instagram and YouTube. The network identifies vulnerable youth in India, initiates conversations through private messaging and then connects them to Bhatti via video calls.
After it was reported by Indian agencies that Bhatti was the mastermind behind TTH, the deeper conspiracy unravelled following two operations by the agencies and the Delhi Police Special Cell in May 2026. In the first operation, the cell arrested Sohail, who had a prior criminal record, from Delhi. Investigations revealed that Bhatti had assigned Sohail the task of painting ‘TTH’ graffiti across prominent walls and locations in Delhi and Faridabad. Sohail was specifically instructed to paint the letter ‘S’ beneath the TTH acronym to signal Bhatti’s personal signature behind the outfit. Financial mobilisation from Pakistan was also established, as Bhatti had paid Sohail for executing this “test task”. Further investigations exposed the involvement of the targeted killing of Police personnel, driven by Bhatti and backed by ISI. In the second operation, the Delhi Police Special Cell arrested three youths who were found to be in direct contact with Bhatti, Jatt, and Ajmal Gujjar. Bhatti had ordered the trio to record videos displaying firearms and to film themselves shooting a policeman, promising financial rewards in return.
The formation of TTH is still in process, with the group’s identity coming into the spotlight with the arrests in 2026. There were no records relating to the group prior to this. Bhatti, however, has been known to be active in India at least since early 2025.
Bhatti’s name first surfaced in connection with the grenade attack at YouTuber Roger Sandhu’s house in Jalandhar’s Raipur Rasulpur Village on March 16, 2025. His name again came into the spotlight during investigations by the Uttarakhand STF following the arrest of suspected TTH operative Vikrant Kashyap on April 9, 2026. Investigators found multiple suspicious contacts across Maharashtra, Rajasthan, Jammu & Kashmir, Punjab and Uttar Pradesh, suggesting the existence of a wider ISI-linked recruitment and communication network. According to the Uttarakhand STF, ISI and Pakistan-based handlers, including Bhatti and Abid Jatt, were targeting Indian youth through social media platforms. Recruits were tasked with activities such as installing CCTV cameras at strategically important locations, enabling handlers in Pakistan to remotely monitor movements and local activities. On June 3, 2026, the Uttarakhand Police stated that the state’s youth were being influenced by the ISI network. According to Uttarakhand STF Senior Superintendent of Police (SSP) Ajay Singh, cyber commandos had been deployed for continuous surveillance in certain places in the state capital to monitor these activities.
After the Bhatti network came to light, agencies launched a major nationwide operation in the first week of May 2026. The 48-hour operation covered multiple states, including Delhi, Punjab, Haryana, Rajasthan, Uttar Pradesh, Madhya Pradesh and Maharashtra. Security agencies were tracking more than 500 mobile numbers and social media accounts. 40 suspects were rounded up in the border districts of Punjab. Around 90 youths were detained and questioned by the Haryana STF. More than 20 people were called in for questioning in Delhi, where some were counselled and asked to delete their social media accounts. In total, 481 suspects and criminals were detained as part of the operation. Later, on May 13, 2026, the Maharashtra Anti-Terrorism Squad (ATS) questioned 57 persons across Maharashtra over suspected links with Shahzad Bhatti and the Dogra gang, another Pakistan-based gangster network. Coordinated operations were conducted at more than 40 locations, including Mumbai, Pune, Nagpur, Nashik, Nanded, Jalgaon, Mira Road, Nalasopara and Akola. According to ATS officials, the operation targeted individuals connected to Bhatti’s networks through social media or suspected of acting as sympathisers and local operatives. The latest operations were conducted by the NIA in Haryana and Punjab on June 9, 2026, identifying the Bhatti network as a substantial threat.
A media report on May 25, 2026, indicated that Indian Intelligence agencies believe that Bhatti’s criminal networks provide the logistical infrastructure through which the ISI seeks to expand TTH’s influence inside India. Agencies have concluded that social media has become the principal recruitment and radicalisation weapon for the group and, with Bhatti’s network and ISI backing, the agenda is to link the Tehreek-e-Taliban Pakistan (TTP) and TTH in India and Afghanistan. A second objective is to spread a narrative suggesting that India is actively backing groups such as TTP to target the Pakistani Security Forces (SFs). Intelligence officials claim that TTH’s primary purpose is to create the impression of a homegrown Indian extremist group, providing Pakistan with another plausibly deniable proxy in the event of future terrorist attacks. ISI is attempting to portray TTH as an offshoot of TTP, even as Pakistan advances the narrative that both India and Afghanistan are supporting TTP, which has carried out numerous attacks against Pakistani SFs. Another element of the agenda behind floating TTH is to target the Indian Police and carry out terrorist attacks across India to create fear.
The broad strategic objective behind the Bhatti network is visible. ISI is combining online propaganda, proxy operations and support to on-ground recruitment, an instrument of hybrid warfare. However small it may seem now, TTH has the potential to become a dangerous challenge for Indian security and intelligence.
BLF: Emerging threat
On June 13, 2026, 33 Security Force (SF) personnel were killed in a coordinated guerrilla operation orchestrated by the Balochistan Liberation Front (BLF) at Naal town in the Khuzdar District of Balochistan. According to BLF ‘spokesperson’ ‘major’ Gwahram Baloch, the operation involved simultaneous attacks on multiple targets, including military positions, as well as Police and Levies establishments. The outfit further claimed that BLF cadres established blockades on key roads, including the China-Pakistan Economic Corridor (CPEC) route, isolating the area during the assault.
On June 12, 2026, two Frontier Corps (FC) personnel were killed while several others sustained injuries when BLF cadres attacked an FC vehicle with an improvised explosive device (IED) in the Mall area of Nushki District. The BLF claimed responsibility for the attack.
On June 10, 2026, BLF cadres killed two persons and injured a third in the Sari Koran area of Panjgur District, describing them as informants working for military intelligence. BLF claimed responsibility for the attack. According to the BLF ‘spokesperson’, ‘major’ Gwahram Baloch, all three were targeted while traveling through a bazaar toward an FC camp, and it was alleged they were working under Commandant FC South (Panjgur), Brigadier Zafar Iqbal.
On June 3, 2026, four SF personnel were killed when their convoy was targeted with an IED in the Mainaz area of Buleda in Kech District. BLF ‘spokesperson’ ‘major’ Gwahram Baloch claimed responsibility.
On June 2, 2026, two Policemen were killed and another two were injured when BLF attacked a SF vehicle protecting mineral transport trucks linked to the Reko Diq project, in Nushki District. The BLF ‘spokesperson’ ‘major’ Gwahram Baloch claimed the responsibility for the IED attack.
According to partial data compiled by the South Asia Terrorism Portal (SATP), at least 59 BLF-linked incidents have already been recorded in 2026, so far (data till June 21, 2026), in which at least 233 people, including 21 civilians, 203 SF personnel and nine militants, have been killed. During the corresponding period of 2025, 43 such incidents were recorded, resulting in 104 fatalities, including 10 civilians, 90 SF personnel and four militants. The whole of 2025 recorded 93 such incidents in which 273 persons were killed, including 30 civilians, 226 SF personnel and 17 militants.
While releasing its annual operational report on January 4, 2026, for the period January to December 2025, BLF characterized 2025 as a decisive and exceptional year for what it termed the ongoing “national resistance struggle” in Balochistan, adding that operations were conducted across coastal regions, urban centres, highways, and remote areas, targeting SFs, surveillance infrastructure, and state-linked economic interests under an ‘organized and multidimensional strategy’.
In its annual report, BLF claimed it carried out 581-armed actions across Balochistan, resulting in 929 casualties, including 647 killed and 282 injured. According to the report, 282 Army and FC personnel were injured, along with eight intelligence operatives, four Police personnel, 30 “death squad” members, and 10 Coast Guard personnel. Providing a further breakdown of the operations, BLF claimed that it carried out 36 ambushes, 33 hand-grenade attacks, 13 IED blasts, and 33 sniper attacks, in addition to seven intelligence-based operations, while 163 attacks involved heavy weapons, rockets, and light machine guns. Small arms were used in multiple engagements, including 28 grenade launcher attacks. The group also claimed responsibility for targeting a bank and a bridge. Further, it claimed that 17 military vehicles, including two armored vehicles, were destroyed or disabled, more than 15 bulldozers and construction machines were set on fire, and over 67 vehicles allegedly used for transporting gas, minerals, and military supplies were destroyed, while three Police vehicles, six trucks, and four tractor-trolleys were also damaged. The report added that 26 “spy towers” were destroyed, 15 surveillance cameras were rendered inoperative, and 10 quadcopters were targeted.
Since May 3, 2004, when the first BLF-linked incident was recorded by SATP, at least 872 persons, including 96 civilians, 667 SF personnel, and 109 militants, have been killed (data till June 21, 2026). On May 3, 2004, a BLF bombing near the Gwadar port killed three Chinese engineers and injured another eleven persons, including nine Chinese nationals. The attack reportedly occurred early in the morning as a bus carrying at least 12 Chinese workers was proceeding to the Gwadar port when a car parked near the port exploded as the bus approached.
Balochistan’s protracted history of alleged enforced disappearances and extrajudicial killings by State agencies has contributed significantly to the persistence of the insurgency, deepening local grievances and fueling cycles of violence. In response, Baloch insurgent groups have frequently carried out retaliatory attacks against SFs, Government installations, and other State-linked targets. Civilians accused of cooperating with the State, including members of pro-government militias commonly referred to as “death squads,” have also been repeatedly targeted. Prominent insurgent organizations operating in the province include BLF, BLA, Balochistan Liberation Tigers (BLT), Baloch Republican Guards (BRG), Baloch Republican Army (BRA), Baloch National Army (BNA), and United Baloch Army (UBA). Among these groups, the BLA emerged as the most active and lethal insurgent outfit in recent years, while BLF remained the second most prominent organisation in terms of operational activity and influence.
Founded on January 1, 1964, in Damascus city, Syria, by Jumma Khan Marri, BLF emerged as one of the principal Baloch insurgent organizations advocating an independent Baloch state. The group played a notable role in Baloch insurgencies in Iran (1968-1973) and Pakistan (1973-1978) before being largely dismantled by 1980, after which Marri relocated to Afghanistan. Following nearly two decades of inactivity, BLF was revived in 2004 under the leadership of Dr. Allah Nazar Baloch, who had assumed command in 2003. Born on October 2, 1968, in the Mashkay area of Awaran District, Dr. Allah Nazar restructured the organization under a centralized command system, with ‘major’ Gwahram Baloch serving as its spokesperson.
BLF was reconstituted as a sister organization of BLA, reportedly with BLA support to expand the insurgency into middle-class Baloch regions, particularly Makran and Rakhshan. Over time, the group developed several specialized units, including the Sniper Tactical Team (STT), which has recently been rebranded, the Qurban Unit – a fight-to-the-death formation primarily deployed against military convoys, installations, and bases – and an Intelligence Wing. Operationally, BLF employs guerrilla warfare tactics such as ambushes, improvised explosive device (IED) attacks, targeted assassinations, and coordinated assaults on military targets. Alongside its armed campaign, the group seeks to mobilize support around claims of economic exploitation and political marginalization of the Baloch population.
Reflecting its growing influence and operational reach, the Government of Pakistan formally banned BLF on July 26, 2010. The Federal Government designated BLF as a proscribed organization under the Anti-Terrorism Act (ATA), citing its involvement in armed militancy and violent separatist activities directed against the Pakistani State.
Despite the ban, BLF has continued to demonstrate operational capability, orchestrating several major attacks, including:
On May 4, 2026: Nine “death squad” (State-backed armed militia) members were killed, one military informant ‘arrested’, while one BLF cadre was killed in a clash between BLF cadres and SFs in the Rakhni area of Barkhan District.
On April 18, 2026: At least 10 SF personnel were killed while several sustained injuries when BLF cadres ambushed a military convoy in the Sedh area of Jhao tehsil (revenue unit) in Awaran District.
On January 14, 2026: At least 12 SF personnel were killed when BLF cadres targeted a military pickup vehicle belonging to a military convoy near Ghulam Muhammad Bazaar in the Pirandar area of Awaran District.
On November 3, 2025: At least eleven soldiers were killed while another six, including an officer identified as Captain Artaza, sustained injuries, when BLF cadres carried out an ambush on a military convoy in the Jhaoo area of Awaran District.
On July 11, 2025: At least 12 people, hailing from Punjab, were killed after being abducted from a passenger bus travelling from Quetta to Lahore, on the national highway between Loralai and Musakhel, near the Sarha Dakai area of Zhob District.
On February 17, 2025: BLF cadres carried out three coordinated attacks on SFs in the Mashkay District, killing 13 soldiers – including an officer – and injuring seven.
On September 23, 2024: At least 11 members of a ‘death squad’ were killed during a clash with BLF cadres in the Uchri area of Barkhan District.
The most lethal and coordinated BLF attack in recent time was under its Operation Baam (Dawn), conducted between July 9 and 11, 2025, during which BLF orchestrated 84 attacks across Balochistan, resulting in the death of at least 50 SF personnel, over 51 injured, and the execution of nine persons labelled as intelligence operatives reportedly intercepted at a checkpoint set up in Musakhel District. BLF claimed its cadres carried out over 30 direct attacks on military personnel, four ambush-style assaults, and targeted a range of institutions, including Police, Levies, Customs, Military Intelligence (MI), and the Inter-Services Intelligence (ISI). During the operation, BLF said it had destroyed or disabled 25 vehicles, including gas tankers and trucks involved in mineral transportation and that seven mobile towers were set on fire, five surveillance drones were shot down, and a bank and a government secretariat bus were damaged. The group also claimed to have established 22 temporary checkpoints across key regions of Balochistan, including Makuran, Rakhshan, Sarawan, Jhalawan, Koh-e-Sulaiman, Bela, and Kachhi. In several locations, BLF fighters reportedly seized weapons.
Demonstrating an escalation in its operational capabilities, BLF carried out it’s first-ever fidayeen (suicide) attack on November 30, 2025. The operation involved Zareena Rafiq, a female suicide bomber affiliated with the BLF’s newly established Sado Operational Battalion (SOB), during a 36-hour assault on the Frontier Corps (FC) Brigade Headquarters at Nokundi in Chagai District. The high-security compound targeted in the attack was reportedly associated with foreign engineers working on the strategically important Reko Diq and Saindak mining projects. The BLF claimed that the assault killed 76 security personnel and several foreign hostages, while six fidayeen militants died during the operation; however, Pakistani authorities did not verify these casualty figures. The attack highlighted the group’s growing tactical sophistication and its determination to challenge both state security structures and foreign-backed resource extraction projects, underscoring the increasing security risks facing international investments in Balochistan.
Unable to decisively curb the activities of BLF through direct security measures, the Pakistani State increasingly sought to exert pressure on the group’s support networks. On February 1, 2026, the Balochistan Government reiterated its previously announced policy regarding individuals affiliated with proscribed organizations, including BLA, BLF, and their associated factions. According to official statements, families of persons who joined such organizations and failed to report their involvement or formally disassociate themselves from them would face a range of legal and administrative sanctions. These measures included the blocking of passports, freezing of bank accounts, suspension of mobile SIM cards, restrictions on the purchase and sale of property, termination of government employment, cancellation of contracts with public institutions, and disqualification from Government tenders and official engagements. The authorities further stated that families who voluntarily informed the Government about the involvement of their relatives and publicly dissociated themselves from militant groups would be exempt from these restrictions.
However, such Government action has failed to deter BLF, as it continues to launch major attacks, including two in recent times:
On April 6, BLF carried out a large-scale Operation Kardigap in the Kardigap tehsil of Mastung District, along the Quetta-Taftan Highway, involving blockades, armed clashes and destruction of military assets. In a statement issued by BLF ‘spokesperson’ ‘major’ Gwahram Baloch, the group said that its cadres launched coordinated attacks at around 7 AM, blocking the highway at four strategic locations as part of a broader strategy to disrupt movement and assert control over key routes in Balochistan. According to the statement, BLF divided its cadres into four specialized units for the operation.
On June 8, BLF cadres launched a major attack on Naal town in Khuzdar District and established complete control. According to a BLF statement, the cadres seized control of the city’s Police Station along with all major government buildings and installations. During the operation, BLF targeted and set ablaze a factory that, they alleged, was ‘looting’ Balochistan’s resources and minerals. The group asserted that this factory operated under the patronage of the ‘occupying state’ and served as a means to exploit Baloch national resources. BLF fighters claimed to have destroyed and burned the factory to the ground. Following the takeover of the city, intense clashes between BLF cadres and advancing SFs continued at various locations. On June 13, BLF released a statement claiming that its cadres killed 33 SF personnel during the coordinated guerrilla operation in Naal town.
The BLF’s enduring operational resilience, expanding territorial footprint, and evolving tactical capabilities underscore its continued significance within the Baloch insurgency. Its persistence reflects unresolved political and security grievances, suggesting that a predominantly coercive State response is unlikely to achieve lasting stability in Balochistan.
Weekly Fatalities: Major Conflicts in South Asia
June 15-21, 2026
Provisional data compiled from English language media sources.