The National Investigation Agency (NIA) has conducted coordinated raids across five states in India after uncovering a major cyberterrorism conspiracy involving Distributed Denial-of-Service (DDoS) attacks on 54 Government websites. The operation, linked to “Operation Sindoor,” highlights the growing threat to India’s Critical Information Infrastructure (CII) and digital sovereignty.

The NIA carried out searches in Junnar in Pune district of Maharashtra, Nadiad in Kheda district of Gujarat, Ramagundam in Karimnagar district of Telangana, Gopalganj in Bihar, and Delhi. These raids were part of case RC-01/2025/NIA/AMD, known as the Cyber Terrorism Gujarat Case, which was registered on 25 June 2025. The case originated with the Gujarat Anti-Terrorism Squad (ATS) before being handed over to the NIA.

Investigators revealed that the accused attempted sophisticated DDoS attacks against 54 websites belonging to various Government of India entities. These attacks were designed to overwhelm servers with illegitimate traffic, disrupt essential services, and undermine public confidence. The targeted systems included critical computer resources and CII, making the conspiracy a direct threat to national security and unity.

The cyberattacks were allegedly part of Operation Sindoor, which followed precision strikes by Indian armed forces against terrorist hideouts in Pakistan and Pakistan-occupied Kashmir in May 2025. The strikes were a response to the brutal Pahalgam terror attack in April 2025, where 25 tourists and a local Ponywallah were killed by Lashkar-e-Taiba terrorists. The cyber component of Operation Sindoor was intended to destabilise India digitally while physical attacks were carried out across the border.

Two suspects have already been arrested in connection with the case. Technical analysis by the NIA identified additional individuals believed to have supported the main accused by helping plan the attacks and enhancing their hacking skills. Search warrants were obtained from a competent court, and raids were conducted early Monday morning.

During the searches, investigators seized three laptops, five mobile phones, pen drives, and other digital storage devices. These items contained incriminating material related to hacking activities. The suspects present at the sites were questioned about their links to the arrested individuals and their role in the conspiracy. Authorities emphasised that all operations were conducted in accordance with legal procedures.

The seized devices will undergo forensic examination to uncover further evidence and identify additional conspirators.

The NIA is expected to trace the technical methods used in the DDoS attacks, including whether the accused received support from external actors. The investigation aims to establish the full extent of the network and bring those responsible to justice under provisions related to cyberterrorism and threats to CII.

This case underscores the increasing vulnerability of digital assets to cyberterrorism. DDoS attacks are not only disruptive but can cripple essential public services, erode trust in government systems, and compromise sovereignty.

The nationwide scope of the raids demonstrates that the alleged network had a wide presence across India, requiring coordinated action to dismantle.

The NIA’s actions form part of a broader effort to strengthen India’s cyber defence posture. By combining traditional investigative methods with advanced digital forensics, authorities aim to prevent future attempts to exploit India’s digital infrastructure. The investigation continues, and more arrests or legal action may follow depending on the forensic findings.

Agencies