54 govt sites, Telegram group and young minds: Inside the cyber threat during Op Sindoor

Ahmedabad, Aug 31 (AHN) Even as Indian forces launched Operation Sindoor on May 7, 2025, the Pahalgam terror attack and its fallout was unfolding not only across the border but also in cyberspace, as Indian government websites were being targeted in a separate campaign that investigators later described as an attempted act of "cyber terrorism".

More than a year after the Gujarat Anti-Terrorist Squad (ATS) first busted the case, the National Investigation Agency (NIA) has now widened the probe, conducting searches at five locations across Maharashtra, Gujarat, Telangana, Bihar and Delhi last week.

The searches have brought renewed attention to a largely less visible dimension of the security challenge during Operation Sindoor: Attempts to disrupt India's digital infrastructure at the same time that the country was confronting a conventional terror threat.

The NIA searches on August 24 were carried out in Junnar in Pune district of Maharashtra, Nadiad in Kheda district of Gujarat, Ramagundam in Karimnagar district of Telangana, Gopalganj in Bihar and Delhi.

The agency said the case, registered by the NIA on June 25 last year, concerns attempted sophisticated Distributed Denial-of-Service (DDoS) attacks against 54 websites belonging to Central government entities during the period of Operation Sindoor.

The agency said the targeted websites included critical computer resources and Critical Information Infrastructure (CII), and that the alleged attacks were intended to compromise national sovereignty, security and unity and incite public fear.

Three laptops, five mobile phones and other digital devices, including pen drives, along with documents containing allegedly incriminating material related to hacking activities, were seized during the searches.

Suspects identified through technical analysis for allegedly providing support and assistance to the accused were also examined about their links to the case.

The investigation goes back to the immediate aftermath of the April 22 terror attack in Pahalgam, Jammu and Kashmir, in which 26 people, including a Nepali citizen, were killed.

The attack triggered a series of security and diplomatic measures by India and culminated in the operation. On the intervening night of May 6 and 7, the Indian Armed Forces struck nine terrorist infrastructure sites in Pakistan and Pakistan-occupied-Kashmir.

The Ministry of Defence said the targets were linked to infrastructure from which terrorist attacks against India had been planned and directed.

The strikes were described by the government as "focussed and non-escalatory", with Pakistani military facilities initially not targeted.

The military operation was followed by several days of escalation, including Pakistani drone and missile attempts against Indian military targets and heavy firing along the Line of Control.

India said its air defence and counter-drone systems intercepted the incoming threats. On May 10, the two sides agreed to halt military actions on land, air and sea.

It was against this backdrop that the cyber activity under investigation intensified.

According to the Gujarat ATS investigation, 18-year-old Jasim Shahnawaz Ansari of Nadiad and a juvenile were involved in attempts to carry out DDoS attacks on Indian government websites.

The ATS had been monitoring anti-national activity on social media and the Dark Web when it received Intelligence about Ansari and other juveniles allegedly associated with a Telegram group called Anonsec.

The investigation found that the group had earlier operated through channels called EXPLOITXSEC and ELITEXPLOIT, using Telegram identities including @BYTEXPLOIT and @YourMindFvcker.

According to the ATS, the participants used programming knowledge and applications including Termux and Pydroid3, while obtaining DDoS scripts from GitHub.

They would then attempt to overwhelm targeted websites and use CheckHost.net to verify whether the sites were accessible, before posting screenshots and messages on their Telegram channel.

The ATS said more than 50 government and state government websites were targeted between April and May 2025.

On May 7 alone, the day Operation Sindoor was launched, the group allegedly planned attacks against 20 Indian government and state government websites.

Its Telegram channel carried messages claiming that Indian websites and servers had been taken down.

The messages were: "Several Government sites of India has been touch by AnonSec..!", "Hi, India we just took down your financial shield and servers", "Hi, India we just took down your shield and servers", and "India may have started it, but we will be the ones to finish it".

The subsequent investigation, however, established an important distinction between what the group claimed and what it was technically capable of achieving.

In an interview with AHN following the latest NIA searches, Gujarat ATS SP, K. Siddharth, said the accused had attempted to take down websites but did not have sufficient computing or server capacity to cause a sustained disruption to the targeted systems.

“They were not breaching per se, it was an attempt to take down the websites,” Siddharth said, explaining that breaching would involve obtaining access to data, whereas a DDoS attack attempts to make a service unavailable to legitimate users.

He said the accused had run scripts that generated traffic towards the targeted websites and then checked their status on CheckHost.net.

A website becoming temporarily inaccessible was treated by the accused as evidence of a successful attack.

However, according to Siddharth, their mobile phone-based set-up did not possess enough computational power to sustain an attack capable of overpowering the government infrastructure. Yet investigators did not treat the limited technical success of the attacks as eliminating the security concern.

"The material recovered from the accused's phones, including chats, screenshots and communications, established their intention to target Indian websites," Siddharth told AHN.

The case was initially registered by the Gujarat ATS under Sections 43 and 66(F) of the Information Technology Act. The investigation was subsequently taken over by the NIA.

On August 14 last year, the NIA filed a charge sheet against Ansari, claiming that he had conspired with a juvenile to launch multiple DDoS attacks on central and state government websites between March and May 2025.

The NIA said its investigation had also found the use of anonymising technologies and encrypted platforms. The investigation also found that the online network was broader than the two individuals from Nadiad.

Siddharth told AHN that the Telegram group had members from several nationalities, including Bangladesh and Palestine, although he said the Gujarat ATS investigation did not establish a specific conspiracy linking Pakistan to the attacks.

“There was no specific conspiracy which we could figure out that Pakistan was behind this,” Siddharth said. That distinction is significant.

Instead, the evidence pointed towards an attempted disruption of government websites, accompanied by the "public celebration" of the attacks on Telegram.

Siddharth also said the accused were not found to have been traditionally radicalised in the sense of possessing material that would have led investigators to invoke the Unlawful Activities (Prevention) Act.

“That is why we did not register under UAPA or anything,” he said. The accused were young and had acquired their knowledge largely through material available online.

Siddharth said they were not necessarily highly technically skilled but were willing to learn how to run scripts and tools. "The activity was carried out primarily through mobile phones, making it difficult for their families to detect what they were doing," he recalled.

The case, therefore, showcases a different form of vulnerability that emerged during one of India's most consequential security episodes of 2025.

The NIA's latest searches indicate that the investigation has not ended with the arrest and prosecution of the original accused.

Technical analysis has since led investigators to people suspected of providing assistance to them, leading to searches across five states and the seizure of additional digital evidence.

The attacks may not have succeeded in bringing down the targeted government infrastructure for any sustained period, but investigators' focus has remained on the intent, coordination, tools and network behind the attempts.