Terror Groups Forming Cyber Sleeper Cells in India: How the Network Operates

New Delhi: A sinister collaboration between Chinese crime syndicates and Pakistani operators is reportedly creating cyber sleeper cells in India, aimed at targeting the country through sophisticated cyberterrorism. Delhi Police have filed an FIR and launched an investigation into the matter.

Cyber Sleeper Cells Linked to Pakistan
The investigation revealed that a network operating as a cyber sleeper cell in India was directly receiving instructions from Pakistan. These cells are reportedly being trained to carry out digital attacks, including cyber fraud, ransomware, and espionage.

During a raid in Samaypur Badli, police arrested Ufe Bamb, a key operative of the Meogi gang. Forensic examination of his mobile revealed communication with Pakistani contacts, indicating coordinated cybercrime activities.

Modus Operandi: Crypto and Fraud Facilitation
The accused acted as intermediaries in cryptocurrency transactions. Using platforms like Binance, they facilitated the transfer of USDT cryptocurrency for Pakistani handlers. Indian crypto traders’ UPI IDs were used to receive payments, which were then converted into crypto for transfer abroad. Each transaction reportedly earned the facilitator a 5% commission.

Further investigation revealed connections with fake loan recovery call centers run from Pakistan, where victims were coerced into transferring money. These funds were funneled through mule accounts controlled by operatives in India, eventually reaching Pakistani handlers.

Recruitment and Operational Tactics
Pakistani syndicates reportedly recruit Indian operatives for cyber sleeper cells through:

• Opening mule accounts under inducements.
• Providing SIM cards with falsified documents from rural areas.
• Offering 5–10% commission for fraudulent transactions.
• Rapidly moving funds between accounts to evade detection.
• Reconnaissance of social media profiles for targeted cyber activities.

APT Groups Targeting India
Advanced Persistent Threat (APT) groups linked to Pakistan are targeting India’s defense systems and critical infrastructure using malware, ZIP files containing remote access trojans, and desktop launchers. At least nine such APT groups have been identified, coordinating multiple attacks over the past six months.

Pakistani Handlers and Local Operatives
Delhi Police arrested Tanveer Alam, alias Haider, who coordinated USDT transactions and cash transfers for Pakistani operators, receiving a 14% commission. Forensic analysis confirmed his connection with Pakistan-based hackers who use the dark web to direct Indian sleeper cells like Haider.

National Security Threat
By early 2026, cybercrime operations originating from Pakistan had intensified against India, extending beyond fraud to pose a significant national security risk. Investigations have uncovered nearly ₹100 crore in scams, over 20,000 SIM cards, 22 SIM boxes, and seven arrested suspects, including Chinese nationals.

Targeting Defense Institutions
Following ‘Operation Sindoor’ and the Pahalgam attacks, Pakistani hacker groups targeted Indian defense institutions, including the Military Engineering Services and MP-IDSA, with over 1.6 million attempted cyberattacks—most of which were successfully blocked by Indian agencies.

Sophisticated Communication Networks
The syndicates use VoIP call routing via Thailand and Cambodia to evade tracking. Digital fraud operations follow a three-line system: the first line poses as a TRAI officer, the second as a police officer, and the third as a DCP-level intermediary offering fake assistance.

Reporting Suspicious Activity
Citizens are urged to report cybercrime immediately through the official Cybercrime Portal or helpline number 1930. Complaints can also be lodged at the nearest police station.