The National Investigation Agency has uncovered what investigators describe as a “Three-App Model” allegedly used by terror networks to recruit, radicalise and finance operatives in India. According to the agency, the model relies on Instagram for initial contact, Telegram for ideological indoctrination and operational communication, and cryptocurrency for funding terror-related activities. The findings emerged during recent investigations and coordinated searches conducted at more than 20 locations across the country.
How the Recruitment Pipeline Allegedly Works
According to investigators, the process typically begins on mainstream social media, where suspected handlers identify and contact potential recruits, particularly young users. After gaining their confidence, handlers allegedly persuade them to shift conversations to Telegram, where communication becomes considerably harder for law enforcement to monitor. Once individuals join private or closed Telegram groups, they are gradually exposed to ideological material that investigators say progressively escalates toward extremist propaganda, with some groups also allegedly circulating instructions relating to weapons procurement and travel abroad for training. Security agencies allege that foreign-based handlers, layered virtual networks and AI tools have all been used to facilitate these operations, alongside digital security measures including auto-deleting chats, coded language, fake identities and VPNs to conceal activity.
Three Modules Exposed Across South India
The agency’s investigations have identified evidence relating to three alleged terror modules operating in Tamil Nadu, Vijayawada and Mangaluru. In the Tamil Nadu module, accused individuals allegedly created messaging groups referencing banned extremist organisations to circulate radical material, with attempts made as recently as June to recruit young people under the guise of teaching Arabic.
In the Vijayawada module, part of an Andhra Pradesh Counter-Intelligence investigation later handed to the NIA, accused individuals reportedly came into contact with a foreign handler, identified as Al-Hakim Shukur, through Instagram and Telegram, and were allegedly working to cultivate ties with Al-Qaeda in the Indian Subcontinent and ISIS, forming a group to expand recruitment within India. Arrests in that specific module were made by Andhra Pradesh authorities after the state’s Counter-Intelligence unit first detected suspicious activity through social media monitoring. In a separate module, investigators allege encrypted applications were used to share instructions on assembling explosive devices, with cryptocurrency transactions and mule bank accounts used to move associated funds.
Who Is Being Targeted, and the Scale of the Problem
Investigators say the primary objective of these alleged networks is to recruit young people, radicalise them, mobilise financial resources and expand extremist activity through digital platforms. Officials expressed particular concern that recruitment efforts are not confined to unemployed youth, but also target engineering and medical students, drivers and other educated individuals, primarily those between 18 and 30 years old, a demographic spread that complicates the profile law enforcement has traditionally used to flag at-risk individuals.
The agency’s own data shows the scale of this trend has grown substantially in recent years. Cases involving digital recruitment and online radicalisation have risen sharply since 2021, with the NIA registering 55 new cases in 2025 alone, resulting in 276 arrests, while a July 2026 operation reportedly led to 11 further arrests, including one juvenile. That trajectory suggests digital-first recruitment has now become the primary channel for terror networks operating in India, displacing older models built around physical training camps or direct cross-border contact.
Expert Perspective and What Comes Next
Yashovardhan Jha Azad, former Union Security Secretary and former Intelligence Bureau Special Director, said cyber-enabled terrorism and organised criminal networks are increasingly converging around the same technologies, encrypted communication, cryptocurrency and digital infrastructure, exploited both for extremist recruitment and by criminal groups engaged in transnational illegal activity. That overlap, he suggested, means counter-terrorism and organised financial crime investigations are likely to increasingly share tools, intelligence and methodology going forward rather than operating as entirely separate domains.
The NIA’s investigation remains ongoing, with authorities continuing to examine digital evidence, financial transactions and online communication networks to identify additional suspects and determine the full extent of the alleged ecosystem. Investigators have indicated further legal action will depend on evidence gathered as the probe continues.
