'Cloud Terror' Exposed: AP Police Bust Massive Multi-State ISIS/AQIS Module Across 8 States

In a massive victory for national security, the Andhra Pradesh police, operating in close coordination with central intelligence agencies, have just dismantled a sprawling, multi-state terror module linked to the Islamic State (ISIS) and Al-Qaeda in the Indian Subcontinent (AQIS).

Over the weekend of April 4–5, 2026, authorities carried out synchronized raids across eight states, apprehending covert operatives who were actively radicalizing youth and planning coordinated "jihadi" operations across India.

The Nationwide Dragnet and Foreign Handlers

What began in late March with the initial arrest of three youths in Vijayawada—identified as Mohammed Rahmatullah Sharif, Mohammed Danish, and Mirza Sohail Baig—rapidly expanded into a nationwide dragnet.

By early April, the AP Police Counter-Intelligence Cell had deployed special tactical teams to Telangana, Karnataka, Maharashtra, Rajasthan, Delhi, Bihar, and West Bengal, ultimately detaining around a dozen key suspects.

Investigators quickly discovered that the network was not acting alone. The operatives were in direct, encrypted contact with foreign handlers based in Pakistan, Afghanistan, Syria, and Bangladesh through over 40 social media accounts. Handlers operating under aliases such as Al-Hakeem Shukoor, Mohammed Huzaifa, and "Ninja" were allegedly guiding the Indian group on militant training, the procurement of sniper rifles, and the facilitation of 'Hijrat' (migration for jihad) to establish a 'Khilafat' (Islamic State) in India.

The 'Khawateen' Wing and Cyber Terror

The module's recruitment and operational tactics represent a highly sophisticated evolution in domestic terrorism.

• Digital Radicalization: The network heavily utilized online propaganda, circulating incendiary videos and speeches of extremists like Osama Bin Laden, Anwar al-Awlaki, and Zakir Naik to brainwash vulnerable Muslim youth.
• The Women's Wing: In a notable and alarming shift in terror recruitment strategy, the group was actively attempting to establish a separate 'Khawateen' (women's) wing. Sayeeda Begum, a key figure arrested in Hyderabad, was allegedly coordinating these female recruitment efforts and maintaining contact with operatives in Pakistan and Jammu & Kashmir.
• Explosives and Cyber Warfare: The module wasn't just ideological. Police recovered chilling evidence of the group sharing detailed tutorials on preparing black powder and Improvised Explosive Devices (IEDs). Furthermore, the operatives shared plans to launch sophisticated cyber-attacks aimed at hacking official government websites to sow administrative chaos.

The BIGSTORY Reframe — The Shift to "Cloud" Terror

While the media focus is heavily trained on the physical arrests, the true "Missed Angle" here is how this entire module operated as a decentralized, digital-first terror network.

Foreign handlers are increasingly testing new recruits by making them "admins" of radical WhatsApp and Telegram groups—such as one named 'BENX', run by a 19-year-old arrested in Jodhpur—long before assigning them actual militant tasks.

The integration of cyber-terrorism tactics alongside traditional bomb-making tutorials proves that foreign terror groups are pivoting toward "DIY Jihad." Instead of deploying physical, highly trained sleeper cells across borders, handlers are uploading the ideology, the blueprints, and the targets directly to the cloud. This decentralized approach makes these domestic networks incredibly difficult for state police to track until an attack is virtually imminent, representing a terrifying new frontier in India's internal security matrix.

What This Means for India

• A New Security Matrix: The intelligence community must rapidly pivot from simply tracking physical movement to aggressively monitoring encrypted digital footprints. The frontlines of national security are no longer just the physical borders; they are the chat rooms.
• The 'DIY' Lone Wolf Threat: The "DIY Jihad" model means the timeline between radicalization and execution is drastically shrinking. When a recruit already has the explosive tutorials and the target coordinates saved on their phone, the window for police intervention becomes razor-thin.
• The Vulnerability of Youth: The successful targeting of 19-year-olds to act as module "admins" highlights an urgent need for community-level digital literacy and counter-radicalization programs.

If foreign handlers can build a terror network without ever setting foot in India, the government's entire counter-terrorism playbook will need a massive digital overhaul.

Sources

News & Wire Coverage:

• The Times of India: 'Jihadi module with links to foreign handlers': Andhra Pradesh Police busts suspected ISIS-linked network with multi-state links
• NDTV: 'Khawateen' Group, Zakir Naik Speeches: Pak-Linked Module's India Ops
• The Hindu: Three youths, radicalised by ISIS, AQIS terror groups, arrested in Vijayawada
• The Economic Times: Delhi police arrest two for links with ISIS and Jaish-e-Mohammad amid AP multi-state raids