The arrest of two men in Uttar Pradesh’s Hapur district on Wednesday (March 18) on charges of spying for Pakistan has set off a multi-agency investigation into what officials believe is a coordinated reconnaissance network operating via social media, with possible links to transnational organised crime.
Investigators from the state police, central intelligence units and cyber forensic teams are analysing a detailed digital and financial trail linked to the accused, Azeem Rana and Azad Rajput, whose activities extend beyond isolated instances of information sharing, officials said.
Forensic extraction of data from seized mobile phones has revealed sustained communication with their alleged handler, Shahzad Bhatti.
“There was continuity in contact, tasking and response, indicating coordination rather than random interaction,” said a senior officer requesting anonymity.
According to investigators, the accused used Instagram for initial contact before shifting to Telegram and WhatsApp for subsequent exchanges, including video calls and file transfers. Portions of these communications took place over end-to-end encrypted channels, complicating data retrieval. Chat patterns indicate “task-based reconnaissance,” with specific locations identified, documented and shared. Time-stamped files suggest that visual material was often transmitted along with precise GPS coordinates. The choice of targets — religious sites and public infrastructure such as metro stations — has raised concern among security agencies.
“These are high-footfall and relatively soft targets. Reconnaissance of such locations can be a precursor in multiple threat scenarios,” an official said.
{{/usCountry}}“These are high-footfall and relatively soft targets. Reconnaissance of such locations can be a precursor in multiple threat scenarios,” an official said.
{{/usCountry}}The financial angle is a key focus area, with investigators suspecting the accused were drawn into the network through small but regular monetary inducements.
Preliminary findings indicate staggered payments routed through informal channels, including suspected hawala networks, prepaid digital wallets and possibly cryptocurrency. Banking transactions are under forensic scrutiny, according to officials.
Officials say the case reflects a broader pattern of recruitment via social media. Rana’s alleged interaction with Bhatti began as casual engagement on Instagram in 2025 before escalating into sensitive information sharing after financial incentives were introduced.
“It follows a familiar trajectory—initial contact, trust-building, then gradual tasking,” an intelligence source said.
The probe has widened to identify potential local facilitators and additional recruits. Several digital profiles linked to the accused are under surveillance, and multiple individuals are being questioned. Officials said further arrests are likely.
“We are treating this as a network, not an isolated case. Every digital and financial lead is being pursued,” a senior police officer said.
Agencies are also mapping the international footprint of Bhatti, believed to be operating across multiple jurisdictions. Intelligence-sharing mechanisms have been activated to track his location and assess his operational reach.
Sources indicate suspected links to organised crime syndicates involved in arms trafficking and illicit financial flows, adding complexity to the investigation.
Following the arrests, security has been heightened across sensitive installations in Uttar Pradesh and the National Capital Region. Surveillance at religious sites, transport hubs and crowded public spaces has been intensified, particularly focusing on suspicious videography and online activity.
Officials also underscored the need for public vigilance against unsolicited online contacts and financial inducements. “The threat landscape is evolving with digital platforms being used for reconnaissance. Our response has to keep pace,” an officer said.
The investigation is ongoing, with agencies working to map the full extent of the network and assess potential risks arising from the information already shared.