Three Screens One Threat: Mapping Digital Terror Network in Maharashtra

Occasional Paper

By Lt Col Ujjual Abhishek Jha (Retd)

Introduction

Violent extremism in India has undergone a quiet but fundamental transformation, largely driven by technology. Encrypted messaging apps, VPNs, and easily accessible online propaganda have largely replaced traditional recruitment mechanisms. The reliance on foreign sanctuaries or physical training camps is giving way to newer threats that incubate within Indian cities, often operating behind the seemingly ordinary profiles of students, working professionals, or gig workers. This mirrors a broader strategic shift across South Asia, where groups such as AQIS and ISIS, which struggled to establish physical footprints in India, are increasingly pivoting to digital platforms. To understand this evolving landscape, this paper examines three case studies, analysing how these modules differ in structure, financing, communication tradecraft, and degree of external direction versus self-radicalization.

Brief Background of the Three Cases

 AQIS Cyber Radicalised Module in Pune (Zubair Hangargekar Case) - The detection and unearthing of an Al-Qaeda module by the Maharashtra ATS, on 27 October 2025 in Pune highlights the contemporary architecture of cyber-enabled radicalisation in India. The key individual, Zubair Hangargekar, a Pune-based software engineer, had been delivering aggressive religious discourses in Kondhwa, Pune. A search of his residence recovered mobile phones containing deleted PDF files, including one titled “Al-Qaeda in the Indian Subcontinent (AQIS) and All Its Manifestations”, an Urdu translation of an Eid sermon attributed to Al-Qaeda chief Osama bin Laden, and a copy of Inspire magazine (an English magazine of AQ). The AQIS Pune module, with Hangargekar as its central hub, highlights a new template of cyber-radicalisation cases whose primary aim is ideological building. In this process Hangargekar converted his role from an operative to an ideologue. As a central hub, Hangargekar functioned as a force multiplier, provided legitimacy and possessed the capability to handle finances, logistics and encrypted communication. The slow process of radicalisation provided a long gestation period and avoided early detection.

 Note: - The case is under further investigation by ATS, Maharashtra and is under trial. 

ISIS Sleeper Module, Kondhwa, Pune (Linked with Padgha ISIS Case) 

The Pune-based ISIS module (linked with the Padgha ISIS case) came to light with arrests that began in July 2023. The case was uncovered following the Maharashtra ATS registering a case on 22 July 2023, where an unrelated vehicle-theft arrest led the police to Kondhwa.  Three men had reportedly been living under cover as graphic designers. Over the following months, the NIA, to which the case was later transferred, arrested a total of ten individuals across Pune, Mumbai and Thane. It was alleged that the group formed an ISIS sleeper module and had rented a house in Kondhwa, identified the location of an IED training workshop and the test site. They conducted the test of at least one controlled IED explosion during 2022-2023. 

 Note: - A chargesheet against all 11 accused has been filed and the case is presently in trial stage.

An Alleged Case of Self-Radicalisation: Ayan Sheikh - On 05 March 2026, the Maharashtra ATS uncovered a case of a self-radicalised individual Ayan Sheikh,  an engineering student, arrested in Mumbai in connection with alleged links  to JeM and ISIS. Searches conducted in Kurla, Govandi and Shivaji Nagar led to the seizure of a laptop, a mobile phone and other electronic devices for forensic examination, describing the recovered material as showing a “digital roadmap” of sustained engagement with extremist content.

 Status: The case is under further investigation and the paper treats the case as an alleged self-radicalisation for analytical purposes only. 

Download the PDF to access the detailed paper.

Disclaimer: This paper is the author's individual scholastic contribution and does not necessarily reflect the organization's viewpoint.

Lt Col Ujjual Abhishek Jha (Retd) is an Intelligence veteran and Geopolitical Risk Analyst with over two decades of experience in Military Intelligence and National Security operations across sensitive theatres of the North East, Punjab and Gujarat borders. He is a Fellow at Usanas Foundation.