You think you know how modern proxy warfare works. You picture dark-web hackers sitting in hidden rooms or highly trained operatives slipping across borders with fake passports.
But things changed. The threat isn't just coming from the shadows anymore. It's playing out in plain sight on your smartphone, masked by catchy soundtracks, viral content, and algorithms designed to keep you scrolling.
Enter Shahzad Bhatti. To his millions of followers, he's a charismatic Pakistani social media personality, a self-made scrap trading businessman in the UAE, and a loud, nationalistic defender of religion. He posts videos under a distinct "333" personal branding banner, arguing about influencer drama and religious controversies.
But Indian intelligence agencies see a completely different man. Security probes by the National Investigation Agency (NIA), Delhi Police Special Cell, and the Maharashtra Anti-Terrorism Squad (ATS) tell a wild story. They claim Bhatti isn't just an influencer. They call him the Inter-Services Intelligence (ISI) agency's newest, highly effective tool for recruiting, radicalizing, and deploying a new generation of cross-border criminals.
If you think this is just another overhyped internet conspiracy, you're missing the bigger picture. The recent explosion of arrests across half a dozen Indian states reveals a dangerous pivot in how intelligence agencies weaponize civilian clout.
The Perfect Cover of the 333 Brand
Let's look at how a guy with a criminal record in Lahore wound up running multi-state terror modules.
Bhatti didn't start out as a strategic mastermind. Back in 2013, police in Pakistan’s Punjab province booked him for straightforward crimes like theft and robbery. Over the years, the allegations grew uglier, including rape charges that he firmly denies. He operated on the edges of the Lahore criminal underworld, building ties with known figures like Farrukh Khokhar. Bhatti describes these connections as casual "friendships" rather than syndicate ties, but the pattern was set early.
Around 2015, he relocated to the UAE, setting up agricultural, dairy, and scrap trading operations. Then came the real breakthrough: TikTok's explosive rise in Pakistan around 2018.
Bhatti jumped on the wave. He understood what the internet wanted. He started pushing highly charged nationalist content, diving headfirst into touchy blasphemy controversies, and inserting himself into high-profile beefs with other influencers. He stamped everything with his "333" logo. It looked like a personal brand, but investigators argue it functioned exactly like a gang identifier.
This public clout gave him something a traditional intelligence asset never has: a direct, trusted, and fully legal communication channel to millions of young minds.
How the Digital Trap Snares Vulnerable Youth
Traditional recruitment takes months of physical grooming, secret meetings, and massive risks. The digital pipeline bypasses all of that.
The strategy is simple but deadly effective. Bhatti's accounts post content tailored to trigger intense emotional reactions—often centered around religious grievances or nationalist pride. When young, impressionable users interact with these posts, comment, or send direct messages, they flag themselves.
The Maharashtra ATS recently dropped a massive data point that shows the scale of this operation. They raided 40 locations and rounded up 53 people just for interacting with social media accounts tied to Bhatti’s network.
Once a user shows interest, the conversation shifts to encrypted messaging platforms. The bait isn't just ideological. It's financial. Bhatti targets unemployed or struggling youth in small-town India, promising fast cash for doing seemingly minor tasks.
Take the case of a criminal named Sohail, arrested by the Delhi Police Special Cell. Bhatti didn't ask him to blow up a building right away. He paid him to do a "test task": spray-painting graffiti across walls in Delhi and Faridabad. The graffiti read "TTH," standing for a newly manufactured front group called Tehreek-e-Taliban Hindustan. To make sure it was authentic, Bhatti told Sohail to paint a specific letter "S" beneath the acronym as his personal signature.
It's a textbook corporate onboarding process, modified for terrorism. You start with small, low-risk assignments, build financial dependency, and then ramp up the stakes.
The Shocking Lawrence Bishnoi and Baba Siddique Connection
The web gets weirder when you look at Bhatti’s self-proclaimed network. This isn't just an isolated ISI operation; it intersects with major organized crime syndicates.
Bhatti has publicly bragged about his bizarre cross-border friendship with jailed Indian gangster Lawrence Bishnoi. According to Bhatti, he originally reached out to Bishnoi to ask for help shutting down accounts posting anti-Islam content online.
While a partnership between a Pakistani nationalist influencer and an Indian gang boss sounds impossible on paper, the real-world connections are hard to ignore. Indian investigators linked Bhatti directly to Zeeshan Akhtar, a known Bishnoi associate who was heavily implicated in the high-profile October 2024 assassination of former Maharashtra minister Baba Siddique.
This mix of state-sponsored intelligence backing, localized criminal networks, and internet fame makes the threat incredibly difficult to counter. The lines between a regular street gang, a political hit squad, and a foreign intelligence op have completely blurred.
From Internet Clout to Real World Violence
The most terrifying part of this evolution is how fast digital conversations turn into real-world violence. In May 2026, the Uttar Pradesh ATS and the Special Task Force busted a major sleeper cell in Saharanpur, arresting four young men: Mehkab, Shahrukh, Gagandeep Singh, and Musharraf.
The details of their plot show exactly what the ISI is trying to achieve through these digital proxies:
- Targeted Reconnaissance: The operatives used their phones to film detailed footage of crowded hospitals, political party offices, and schools in Delhi, Uttar Pradesh, and Punjab.
- Data Exfiltration: They sent exact latitude and longitude coordinates directly to Bhatti over encrypted apps.
- The Blueprint: The plan was to launch coordinated hospital blasts and targeted assassinations once Bhatti arranged the delivery of weapons through his smuggling networks.
In another chilling operation, Bhatti ordered a trio of youth to film themselves shooting an Indian police officer on camera, promising a massive cash payout. The suspects successfully tracked a Uttar Pradesh police officer and tried to shoot him, but their crude, country-made pistol jammed. They fled the scene, only to be caught later by the Delhi Police Special Cell.
The ISI wants these videos recorded for propaganda purposes. A video of an attack on an officer, stamped with a social media star's branding, creates instant viral terror.
Changing the Playbook Against Digital Proxies
If you're tracking security trends, the lesson here is clear: the old counter-terrorism playbooks are obsolete. Border security and physical surveillance aren't enough when the handler lives in Dubai or Lahore and the recruit is a bored teenager scrolling through their phone in Uttar Pradesh.
We have to completely rethink digital footprints. If you want to spot these networks before they strike, you need to understand the practical indicators of digital grooming:
- The Shift in Communication Platforms: Recruitment never stays on mainstream apps. Watch for immediate demands to move the conversation to encrypted apps like Signal, Telegram, or custom gaming chat servers.
- The Escalating Task Model: It almost always begins with small, non-violent digital favors—sharing specific propaganda, tracking a local individual's routine, or taking photos of a public building for "market research."
- Unexplained Foreign Money Trails: Look for micro-payments arriving through complex digital wallets or hawala networks, often masked as payment for freelance online work or digital services.
The reality of 2026 is that internet clout is a weapon of war. Security agencies have to stop treating social media radicalization as a secondary concern and start treating viral influencers with underworld ties as legitimate national security threats. The Bhatti case isn't an anomaly. It's the new standard for how proxy wars are fought.
