Uttar Pradesh Anti-Terrorist Squad (ATS) has foiled a major terror plot by arresting four individuals working for a Pakistan-operated network. The arrests were made near Lucknow Railway Station just before the accused could execute their plan to damage railway signals and critical infrastructure, potentially triggering large-scale disruption and panic.
The accused have been identified as Saqib alias ‘Devil’ (25) from Meerut, Arbab (20) also from Meerut, Vikas Pehlawat alias ‘Raunak’ (27) from Gautam Buddha Nagar, and Lokesh alias ‘Papla Pandit’ (19). According to officials, the group was actively coordinating with foreign handlers and had already begun groundwork for targeted attacks.
Preliminary investigations suggest that the terror module was tasked with targeting key national institutions, railway assets, and even political figures. The plan involved acts of arson, sabotage, and possibly explosions aimed at causing economic damage and widespread fear.
Officials revealed that the accused had conducted reconnaissance missions across multiple cities, including Ghaziabad, Aligarh, and Lucknow. They reportedly recorded videos and gathered sensitive information, which was then transmitted to their handlers abroad.
The investigation has uncovered a sophisticated communication network, with the accused using encrypted and social media platforms such as Telegram, Instagram, and Signal to stay in touch with handlers based in Pakistan and Afghanistan.
Authorities stated that the handlers used these platforms not only to assign targets but also to share precise Google location coordinates. The accused were allegedly incited through religious propaganda and motivated by financial incentives to carry out anti-national activities.
One of the most alarming aspects of the case is the financial mechanism used to fund the operations. Investigators revealed that the accused received payments through QR codes after carrying out tasks assigned by their handlers.
Shockingly, the group had already executed minor arson attacks at certain locations. These incidents were filmed and sent back as proof of execution, following which payments were made. Officials believe this pattern indicates a structured and incentivised terror module operating at the local level.
During the arrest operation, the ATS recovered a canister filled with inflammable material, seven smartphones, 24 pamphlets, and Aadhaar cards from the accused. These materials are now being analysed for further leads and potential links to a broader network.
An FIR has been registered at the ATS Police Station in Lucknow under relevant sections of the Bharatiya Nyaya Sanhita, 2023, and the Unlawful Activities (Prevention) Act. The accused have been produced before a court, and further investigation is underway to identify additional operatives and handlers.
According to officials, the accused were on the verge of executing their plan on April 2, 2026, which involved damaging railway signals and infrastructure near Lucknow Railway Station. The timely intervention by ATS teams ensured that the plot was neutralised before any damage could occur.
Authorities believe that the attack, if carried out, could have led to severe disruption of railway operations and posed a risk to public safety.
The case has exposed a wider cross-border terror network that relies on local recruits to carry out low-cost, high-impact attacks. By leveraging digital platforms, financial incentives, and ideological manipulation, such networks attempt to destabilise internal security.
Officials are now probing whether the arrested individuals were part of a larger module operating across multiple states. Intelligence agencies are also examining possible links to other incidents of sabotage and arson reported in recent months.
The successful foiling of this terror plot highlights both the evolving nature of threats and the critical role of intelligence-led policing. The use of social media, encrypted communication, and micro-financing methods reflects a shift towards decentralised and technologically enabled terror operations.
At the same time, the operation shows the preparedness of security agencies in detecting and neutralising such threats before they materialise. As investigations continue, the focus remains on dismantling the entire network and preventing future attempts to compromise national security.
