Gujarat ATS uncovers ISIS flag, encrypted network in probe against 3 terror suspects

The Gujarat Anti-Terrorism Squad (ATS) has unearthed a trail of incriminating evidence, including an ISIS flag, encrypted digital communication manuals and CCTV footage of covert movements, during its probe into three suspected ISIS-linked operatives arrested on November 9. Senior officials said the findings indicate a “structured, clandestine module” attempting to rebuild its presence in western India.

ISIS flag, digital records seized from Suhail’s residence

Following the arrests, ATS teams searched the residence of accused Mohammad Suhail Mohammad Salim Khan, where investigators recovered a black ISIS flag, several mobile devices, hard drives and memory cards. Initial forensic examination, officials said, suggests the presence of propaganda material and communication logs.

ATS sources described the seizure as “significant”, stating that the agency is examining whether Suhail was receiving instructions from foreign handlers or disseminating radical material within the state.

Suspicious parcel sent to co-accused

The interrogation of Azad Suleman Sheikh, another arrested suspect, has revealed a startling element: Suhail allegedly sent him a parcel ahead of their arrest. The parcel’s contents have not been disclosed, but investigators have initiated a parallel inquiry to determine its nature and intended purpose.

Senior officers stated that the ATS is investigating whether the parcel contained components or literature related to the broader conspiracy.

Dr Ahmed Mohiyuddin Saiyed was planning ‘a major incident’, say investigators

According to the ATS, the third accused, Dr Ahmed Saiyed, was allegedly preparing to execute a major terror strike in India. His digital trail, investigators said, displays a deliberate and systematic attempt to evade surveillance.

From the devices recovered, the ATS claims to have found literature on maintaining digital secrecy, including modules on encrypted communication, masking IP addresses, accessing the dark web and using code-based messaging.

Officials said Ahmed operated almost entirely through encrypted channels, frequently shifting platforms and identities, and relied on the dark web to communicate with handlers abroad.

CCTV footage places Ahmed in the Ahmedabad hotel

Crucial CCTV footage has emerged from Hotel Grand Ambience, located opposite Lucky Hotel in the Laal Darwaza area of Ahmedabad. The clips reportedly show Dr Ahmed stepping out of the hotel on the evening of November 7, 2025.

The ATS confirmed that Dr Ahmed stayed at the hotel, allegedly under an assumed identity, and indicated that investigators are combing through hours of footage to trace visitors, delivery persons and possible accomplices who may have met him during his stay.

Encrypted communication trail uncovered

Investigators have further claimed that Dr Ahmed used code words in conversations and relied on dark-web communication channels to maintain contact with his handlers. The communications, officers said, were intentionally fragmented, routed through multiple layers of encryption and, in some instances, wiped soon after transmission.

Digital forensics teams are currently attempting to reconstruct deleted data and recover any hidden partitions or encrypted vaults from the seized devices.

Investigation widens; more arrests possible

A senior ATS officer said the agency is now mapping the trio’s network, funding sources, travel patterns and local contacts. “The material recovered so far suggests that these individuals were not acting in isolation. Multiple digital footprints and cross-border communication points are under analysis,” the officer said.

The ATS has not ruled out the possibility of further arrests as it continues to decode the conspiracy, examine the suspicious parcel, analyse hotel records and scrutinise terabytes of seized data.

With the recovery of an ISIS flag, encrypted communication manuals and evidence of covert movements within Ahmedabad, investigators believe they have only scratched the surface of a potentially larger network operating in the region.