Counterintelligence & Tradecraft — 2026-04-21

Delhi Police Special Cell arrests two ISI-handled operatives recruited online; foil Delhi-NCR grenade plot, Zirakpur club attack

Delhi Police Special Cell arrested Vivek Banjara on 16 April in Gwalior and Rajveer on 18 April in Sarai Kale Khan on charges of conspiring to carry out grenade attacks and targeted killings in Delhi-NCR on the direction of Pakistan-based Shahzad Bhatti, according to The Tribune, The Sunday Guardian, and India TV coverage cited by Indian Defense News. Investigators said Bhatti, an ISI proxy coordinating with the Babbar Khalsa International network, recruited the pair through social media, routed arms via an Amritsar handoff on 9 April, and directed them to open fire on a Zirakpur club that had received extortion threats. On 11 April Rajveer allegedly attempted that firing but the pistol malfunctioned; police said he was then preparing a hotel target in Delhi-NCR when arrested. Both suspects are residents of Gwalior in Madhya Pradesh.

Analysis
The Bhatti handler network fits a medium-grade persistent tradecraft pattern, an ISI proxy using social-media recruitment to task minor-criminal youth inside India for grenade and firearms operations, that has dominated Indo-Pakistani counterintelligence for roughly 24 months, corroborated across three outlets. The Zirakpur pistol malfunction has not deterred the handler; another ISI-directed attempt in the Delhi-NCR or Punjab footprint is likely within 21 days, bracketed by the Pahalgam anniversary on 22 April and the fragile Iran ceasefire window. Delhi Police Special Cell visibility on the Amritsar arms-handoff chain is what enabled both intercepts, and additional arrests in Punjab are very likely within 14 days as that chain is rolled up. The ISI-BKI attribution may nonetheless be overstated: several of these recruitment cells operate as organized-crime extortion rings whose Pakistani handlers contract out targeting for criminal rather than strategic ends, making the intelligence-service framing more a jurisdictional signaling choice than evidence of genuine ISI operational direction.
4 sources
  1. Plot to attack Delhi-NCR hotels, Zirakpur club foiled, 2 ISI-backed operatives arrested - The Tribune
  2. Delhi Police bust ISI-BKI spy ring using Solar CCTVs, foil planned grenade attack - The Sunday Guardian
  3. Terror plot foiled as 11 suspects linked to ISI, Babbar Khalsa arrested in Delhi and Punjab - India TV
  4. Delhi Police Foil ISI-Linked Plot: Two Arrested In Grenade Attack In Delhi-NCR Conspiracy - Indian Defense News

View in full brief →

UNCLASSIFIED // OPEN SOURCE