UP ATS Shatters Pakistan-Backed Terror Network Led by Saqib Alias Devil

Key Takeaways

• UP ATS arrests four individuals for plotting arson attacks on railway infrastructure and public assets.
• The terror module, led by Saqib alias Devil, received directives from Pakistan-based handlers via social media.
• Accused planned to target signal boxes, gas trucks, and religious establishments to spread fear and economic disruption.
• A container of inflammable material and digital evidence were seized, with forensic analysis ongoing.
• Legal proceedings are underway under the Bharatiya Nyaya Sanhita and the Unlawful Activities (Prevention) Act.

The Uttar Pradesh Anti-Terrorist Squad (ATS) has successfully dismantled a suspected terror module allegedly operating under the direction of Pakistani handlers, arresting four individuals for planning coordinated arson attacks on railway infrastructure. The group, which targeted key installations and public assets across multiple cities, was allegedly involved in anti-national activities designed to create panic and disrupt the economy. Intelligence inputs revealed that this gang maintained continuous contact with their handlers through social media platforms, executing a plan that involved reconnaissance of vital institutions and political figures.

Acting on a precise tip-off regarding an imminent attack near the Lucknow railway station on April 2, 2026, ATS teams moved quickly to intercept the conspirators. The arrest of the group comes just before they allegedly planned to execute a railway sabotage plot involving the destruction of signal boxes and the burning of gas cylinder-laden trucks. Police investigations have uncovered a sophisticated network where the accused, guided by provocative identities and extremist narratives online, were tasked with undermining India's sovereignty through coordinated acts of sabotage.

Detailed Investigation Uncover Digital Links and Local Operations

ATS investigations have revealed that the gang was led by Saqib, known as "Devil," a 25-year-old resident of Meerut. Saqib allegedly maintained direct links with handlers via platforms such as Telegram, Signal, and Instagram, while also reportedly connecting with radical groups and foreign numbers linked to Afghanistan. Alongside Saqib, the police have arrested Arbaab, a 20-year-old from Meerut, and Vikas Gehlawat, known as Raunak, and Lokesh alias Papla Pandit alias Sanju, both from Gautam Budh Nagar. The latter two were reportedly recruited through social media and conducted extensive reconnaissance in cities including Ghaziabad, Aligarh, and Lucknow.

The modus operandi of this group was methodical and digitally enabled. According to officials, the accused received Google location pins of specific targeted sites from their handlers. Based on these digital coordinates, they conducted surveillance and subsequently shared video footage of the locations. In some instances, the accused had already carried out minor arson incidents to test the waters, recording the events and sending the footage to their handlers in exchange for payments transferred through QR codes. This financial transaction mechanism highlights the financial infrastructure supporting the group's anti-national activities.

During the search operations following the arrests on April 2, 2026, the ATS recovered significant evidence, including a container filled with inflammable material, seven mobile phones, and 24 pamphlets containing extremist content. Identity documents were also seized from the accused. ATS officials confirmed that a detailed forensic analysis of the digital devices is currently underway. This analysis aims to trace the wider network and identify all funding channels involved in the operation. Preliminary interrogation data suggests that the group was actively working to undermine India's integrity by executing acts of terror that included targeting vehicles on religious lines and spreading terror aligned with broader propaganda narratives.

The UP ATS busts terror module operation marks a critical victory in counter-terrorism efforts, as the group was specifically tasked with damaging railway signal systems and vehicles to cause economic disruption. The police stated that the group planned to target prominent establishments to spread fear, with handlers using provocative online identities to incite the accused. The timing of the arrests is crucial; had the group executed their plan near the Lucknow railway station as intended, the consequences could have been catastrophic for public safety and transportation networks.

The legal framework supporting this operation is robust. A case has been registered at the ATS police station in Lucknow under relevant sections of the Bharatiya Nyaya Sanhita, 2023, and the Unlawful Activities (Prevention) Act, 1967. The accused have already been produced before a court, and legal proceedings are in motion. The involvement of the Bharatiya Nyaya Sanhita indicates the applicability of India's recent legal updates to this case, while the UAPA underscores the severe nature of the charges, which include terrorism and unlawful activities.

The role of social media in this conspiracy cannot be overstated. Handlers utilized platforms like Instagram and Telegram to maintain contact and issue commands. The accused were instructed to conduct reconnaissance on railway signal systems and vehicles, sharing inputs with handlers across the border. This digital coordination allowed the group to operate across multiple cities, leveraging the anonymity and reach of online platforms to plan attacks that were physically executed by members recruited locally. The use of QR codes for financial transactions further demonstrates the group's adaptability in utilizing modern technology for illicit purposes.

The Future Impact of the Dismantled Network

The successful interruption of the plan by Saqib alias Devil signals a potential shift in the operational tactics of cross-border terror cells. While the immediate threat of the specific arson attacks near Lucknow has been neutralized, the forensic analysis of seized devices suggests the presence of a wider network that may still contain sleeper cells. As the investigation expands to identify additional links, the authorities anticipate a need to strengthen digital surveillance on platforms like Telegram and Signal to prevent similar recruitment and coordination attempts. The ongoing legal proceedings will likely serve as a deterrent, but the long-term challenge remains in dismantling the ideological and financial pipelines that continue to fuel such anti-national activities aimed at India's infrastructure and sovereignty.