After uncovering the misuse of online gaming platforms, security agencies have identified a new strategy allegedly being used by terrorists. According to officials, terrorist groups and their handlers are increasingly using pornography websites and encrypted apps for covert communication.
Through these channels, terrorist organisations and Pakistan’s intelligence agency, the ISI, are allegedly sending instructions to recruits in Jammu and Kashmir. The aim is to evade surveillance on conventional social media platforms.
Porn platforms used for secret communication
Officials said some pornography platforms offer real-time chat features, ostensibly designed to help users find dates nearby. However, handlers are allegedly using these chat tools to send messages and coordinate activities.
Security agencies monitor Tor-based apps
Security agencies have begun investigating several digital tools allegedly being used by terrorist handlers, including Tor-based messaging apps such as Cotex and Conion. These apps route data through encrypted nodes, making it difficult to trace users.
According to officials, access to the APK file of Conion is blocked in India. APK, or Android Package Kit, is the file format used by the Android operating system to distribute and install mobile applications.
Terrorist groups are also allegedly using France-based apps that offer end-to-end encrypted messaging without requiring a SIM card or phone number, making it harder for agencies to identify users.
Officials said agencies are also monitoring Vietnam-based apps and anonymous platforms such as MoonChat. Some versions of MoonChat reportedly use PGP encryption, are suspected to be of Chinese origin and do not require conventional registration.
Several versions of the app also reportedly allow users to find single people nearby.
Apps downloaded using VPNs
According to officials, several pornography apps are banned in India but are still being downloaded illegally using Virtual Private Networks (VPNs).
A VPN creates an encrypted connection over the internet, masks a user’s IP address and encrypts online traffic. This can make it more difficult to monitor online activity and identify users.
Security experts said monitoring platforms that use the Tor network presents an additional challenge. Tor routes encrypted traffic through multiple relay nodes operated by volunteers around the world, helping conceal the identities of both senders and recipients.
The Tor network is operated by The Tor Project, a US-based non-profit organisation. While Tor is used legitimately to protect privacy and circumvent censorship, its anonymity features can also be exploited by criminal and terrorist networks.
Officials said security agencies are continuously upgrading their cyber-surveillance systems to identify and monitor communication channels operating outside conventional platforms.
Encrypted apps used for recruitment, radicalisation
Officials said terrorist organisations are increasingly using encrypted instant messaging apps and pornographic websites to recruit young people in Jammu and Kashmir and facilitate their radicalisation.
Unlike traditional social media platforms, handlers are allegedly approaching potential recruits through these channels. The level of security varies across the apps, with some offering basic encryption, while others provide end-to-end encryption and self-destructing messages.
Some platforms reportedly use the RSA-2048 encryption algorithm to secure communications. RSA is a cryptographic system developed by Ron Rivest, Adi Shamir and Leonard Adleman, whose initials form the acronym RSA.
According to officials, terrorist groups are increasingly moving away from widely used platforms such as WhatsApp, Facebook Messenger and Signal.
Apps designed to work on 2G networks
Security officials have also found that handlers and recruits in the Valley were using specific apps that can function even on slow 2G or EDGE networks.
Some of these apps reportedly do not require users to provide a phone number or email address during registration, making them harder to trace.
The new strategy came to light as security forces investigated efforts to prevent the use of virtual SIMs created by foreign companies. Virtual SIM technology allows users to generate phone numbers digitally and use them on smartphones through dedicated applications, potentially leaving fewer conventional digital traces.
The use of virtual SIMs was first highlighted during the investigation into the 2019 Pulwama terror attack, in which 40 CRPF personnel were killed.
A detailed investigation by the National Investigation Agency (NIA) found that the Jaish-e-Mohammed suicide bomber and his associates had allegedly used more than 40 virtual SIM cards in connection with the attack.
