A Pakistan-linked espionage network that allegedly used Hindu identities, religious symbols and suspected love jihad tactics to evade detection and expand its reach has been exposed in Ghaziabad, Uttar Pradesh, triggering a multi-agency probe into one of the most sophisticated spy modules busted in recent years.​

Spy ring busted in Ghaziabad

Ghaziabad Police and Uttar Pradesh agencies began probing the network after suspicious activities by a group of youths were reported near Kaushambi police station on 14 March 2026. What initially looked like a localised case has since expanded into a sprawling espionage module allegedly run on the instructions of handlers in Pakistan and linked to the ISI.​

Investigators say the group conducted systematic reconnaissance of military and strategic locations in Delhi-NCR and beyond, sending videos, photos and location details across the border for cash payments per assignment. The module reportedly operated for many months before the first arrests, with local tip-offs finally triggering sustained surveillance and raids.​

Scale of arrests and evolving numbers

Different phases of the operation have produced a rising arrest tally as more links are uncovered. Ghaziabad Police’s first major crackdown around 14–15 March led to the arrest of six suspects, including alleged masterminds Suhail Malik and Sane Iram alias Mahak, along with four other local operatives. Subsequent action by UP Police and specialised units has taken the total number of arrested suspects to at least 18, with several minors among those detained for participation in the network.​

Separate national media reports, citing official sources, indicate that as the probe widened across Uttar Pradesh and adjoining regions, as many as 22 people have been picked up so far in connection with the same or closely connected modules. The arrests span Ghaziabad, Meerut, Faridabad and other locations, underlining that the network was neither local nor amateur but part of a structured, multi-city grid.

Key accused, aliases and Hindu names

Police and intelligence agencies have identified several individuals as central players in the module, often operating under multiple names. Among those named are Suhail Malik alias Romeo, Naushad Ali alias Lalu, Sameer alias Shooter and Sane Iram alias Mahak, alongside local associates such as Praveen, Raj Valmiki, Shiva Valmiki, Ritik Gangwar, Ganesh, Vivek, Gagan Kumar Prajapati, Durgesh and Meera Thakur. Investigators say that Pakistani handlers themselves were Muslims but routinely adopted Hindu-sounding names while coordinating with Bharatiya recruits to avoid easy detection and suspicion.​

The Jagran report notes that several accused not only used Hindu aliases but also adopted outward markers of Sanatan practice such as wearing kalawa (sacred thread), sporting a tilak and donning rudraksh beads, especially in the case of Suhail alias Romeo. Naushad and Sameer are also reported to have worn kalawa, with security agencies emphasising that these cosmetic symbols were part of a deliberate strategy to blend in with Hindu-majority surroundings and bypass local scrutiny.​

Modus operandi: CCTVs, live feeds and recon

At the operational level, the network appears to have combined low-cost technology, local knowledge and financial inducements. According to police and media reports, the accused are suspected of installing CCTV cameras and IP-based solar cameras at carefully chosen spots to capture live video feeds of Army movement, troop deployment routes, weapon transport and movements around cantonments and other sensitive locations. In several cases, the cameras and mobile phones were placed or carried near Delhi Cantt railway station, military bases, BSF and CRPF establishments and other high-value sites in Delhi-NCR.​

Sources cited in national reports state that youths in the network were typically paid between ₹5,000 and ₹20,000 per task, depending on the sensitivity and difficulty of the assignment. One line of investigation suggests that mastermind Suhail Malik received around ₹10,000 for each video clip he supplied to Pakistani handlers, while he and Mahak were tasked with redistributing funds to lower-level operatives and new recruits. Encrypted applications, WhatsApp and multiple SIM cards—allegedly taken on different IDs—were used to send videos, photos and precise coordinates to handlers across the border.​

Recruitment of vulnerable Hindu youth

A particularly disturbing aspect of the case is the alleged targeting and recruitment of economically weak and less-educated Hindu youth. Ghaziabad-based reports and follow-up coverage indicate that Pakistani handlers instructed local coordinators such as Suhail and Sane Iram to bring “as many Hindu youths and women” as possible into the network. Investigators say these youths were lured by promises of quick money, often in small but attractive sums of a few thousand rupees for short recon tasks, camera installations or information gathering.

Local families of some of the arrested youths have claimed their sons were drawn in without understanding the full implications, with at least one parent telling the media that his son was pressured just to procure three SIM cards, which he then handed over to a man named Ritik. However, agencies stress that the pattern of recruitment, layered tasks and repeated assignments points to systematic exploitation rather than isolated, one-time misuse of personal documents.

Hindu disguise and suspected love jihad angle

Beyond operational espionage, the Jagran report highlights an emerging line of probe: whether the fake Hindu identities used by Pakistan-based handlers and their local agents were intended not only to facilitate spying but also to further alleged love jihad designs. Agencies are examining whether some of the accused adopted Hindu names and Sanatan symbols purely as a cover for recon, or whether this also enabled them to build intimate or emotional relationships with Hindu women to expand their networks.

Investigators suspect that the strategy of donning Hindu attire, kalawa, tilak and rudraksh was doubly useful—first, to gain easy access and trust in Hindu neighbourhoods and religious spaces, and second, to potentially cultivate romantic or friendship ties under a false religious identity. At this stage, officials have not publicly confirmed specific love jihad cases tied directly to this module, but they acknowledge that this is now a formal point of inquiry for both UP Police and central agencies.

Alleged ideological links and radical content

Parallel to the Ghaziabad espionage case, Hindu advocacy outlets have reported on an Islamic module in the region allegedly inspired by Jaish‑e‑Mohammed (JeM) and the radical Ghazwa‑e‑Hind narrative that calls for annihilating “Hindu kafirs” and establishing an Islamic state in Bharat by 2047. According to such accounts, suspects were reportedly consuming and sharing content related to JeM figures such as Masood Azhar and propagandists like Farhatullah Ghori via social media platforms, online sermons and closed groups.

While these ideological claims are still being pieced together with hard evidence, investigators say the combination of espionage activity, radical messaging and cross-border funding fits a familiar template in which spy modules also act as potential logistics or reconnaissance arms for future terror operations. Officials have not announced recovery of arms or explosives directly linked to this Ghaziabad ring so far, but they underline that pre-attack recon and detailed mapping of military routes are critical components in any large-scale plot.

Geography of operations: from Ghaziabad to the Himalayas

Initial arrests were concentrated in Ghaziabad’s Kaushambi and Indirapuram areas, but further questioning has revealed a wider geographic footprint. Suhail, Naushad and Sameer are reported to have received instructions to conduct reconnaissance in Jammu & Kashmir and Leh‑Ladakh, with Pakistan-based handlers sending them specific lists of locations for surveillance. Investigators say these plans were interrupted when Suhail travelled to Himachal Pradesh’s Baddi for his girlfriend’s birthday, delaying or derailing an intended recon tour in the Himalayan region.

Within Delhi‑NCR, the network’s focus included railway lines used by defence forces, cantonment-adjacent zones, industrial peripheries and religious sites, all of which offered vantage points for cameras and mobile recording. The scattered arrests in Meerut and Faridabad, along with Ghaziabad’s urban pockets, suggest that the module was building a corridor of operatives capable of moving quickly between states while maintaining local cover through jobs such as tyre-repair shops or casual labour.​

Use of minors and layered structure

One of the more alarming features of the case is the documented involvement of minors. Reports from Ghaziabad and national outlets confirm that several under‑18s were part of the network, used for tasks ranging from basic surveillance to handling phones or installing devices. Agencies believe minors were preferred in some situations because they drew less suspicion, could be paid lower sums and were easier to manipulate with quick cash and online radical content.

The structure appears to have been layered: at the top, Pakistan-based handlers using Hindu aliases; below them, coordinators like Suhail and Sane Iram managing funds, tasks and ideological messaging; under them, local adults handling logistics and recruitment; and at the base, minors and vulnerable youth performing field assignments. This hierarchy allowed the core masterminds to stay insulated while still maintaining tight control over what investigators describe as a “task-and-payment” chain.

Community reactions and claims of innocence

As news of the espionage case has spread, families of some of the arrested have publicly protested their innocence, claiming that the youths were either unaware of the true purpose of their activities or were forced into limited roles such as taking SIM cards. In several interviews, parents have pointed to their sons’ financial struggles, lack of stable employment and low education levels, arguing that they were easy prey for manipulation by better-organised actors.

Police, however, maintain that they have recovered substantial digital evidence, including CCTV footage, chat logs, transaction trails and decoded instructions that demonstrate a level of awareness going beyond casual or accidental involvement. Officials emphasise that every arrest is being scrutinised individually, but assert that the overall picture is one of a coordinated, cross-border espionage apparatus using deception, religion and financial bait to operate from within Bharatiya society.​

Ongoing investigation and national security implications

A special investigation team (SIT) combining personnel from Indirapuram Police, Crime Branch, cyber units, intelligence agencies and SWAT has been tasked with unraveling the full extent of the network. The SIT is tracing money flows from Pakistan, examining multiple bank accounts and digital wallets, and working to identify the encrypted communication channels and “virtual safe houses” used by handlers and local operatives.

Security experts warn that the Ghaziabad case exposes three converging threats: cross-border espionage targeting critical military infrastructure, ideological radicalisation linked to anti-Bharat jihadist narratives, and the tactical use of Hindu names, symbols and suspected romantic relationships to deepen penetration into Hindu communities. With at least 18–22 arrests so far and the possibility of more suspects still at large, agencies are expanding their sweep beyond Uttar Pradesh, looking for similar patterns of camera installations, unexplained cash transfers and sudden changes in religious identity or attire among at‑risk youth.