About six months ago, a team of officers in Andhra Pradesh’s Counter Intelligence Cell (CIC) noticed an unusual pattern of messaging across various social media platforms, including interactive messaging applications such as WhatsApp.
What intrigued the officers was an abnormal frequency of incoming and outgoing international communications. The communication pattern was immediately red-flagged. The CIC team alerted central intelligence agencies and leveraged the resources of NATGRID (National Intelligence Grid) and CMS (Central Monitoring System) ֪— core components of India’s security infrastructure designed to combat terrorism, espionage, and cross-border threats — to trace Internet Protocol (IP) logs and WhatsApp One-Time Password (OTP) sharing patterns.
This initial anomaly marked the beginning of unearthing a far larger conspiracy and espionage racket involving the leaks of sensitive defence details — specifically naval intelligence — by Indian conduits to their handlers in Pakistan’s Inter-Services Intelligence (ISI).
After placing the subjects under close surveillance using a combination of technical intelligence (TechInt) and human intelligence (HumInt) for several months, a dedicated team of officers and personnel from Andhra Pradesh’s CIC, in close coordination with Naval Intelligence and Anti-Terrorist Squads (ATS) across 10 States, busted a major Pakistan-sponsored espionage network. The network reportedly focused on gathering field intelligence on the Indian Navy, with particular emphasis on the Eastern Naval Command (ENC).
Code-naming the crackdown as ‘Operation Firewall-2026’, law enforcement agencies moved in to execute arrests. In the process, investigators identified 18 key suspects, including 13 naval personnel spread across 10 States — Andhra Pradesh, Kerala, Maharashtra, Karnataka, Goa, Delhi, Gujarat, Tamil Nadu, Bihar, and Chhattisgarh.
The operation has so far led to the arrest of two individuals. Among them is Pradeep Mukherjee, a sailor in the Indian Navy posted at the ENC, who was taken into custody from INS Agrani in Coimbatore, Tamil Nadu, where he was undergoing training. The second arrested individual is Annam Sai Varaprasad, a civilian contract driver engaged for naval officers at the Visakhapatnam naval base.
Although the coordinated operation was formally launched on October 1, the Andhra Pradesh CIC announced the arrests on October 5 and 6. The CIC stated that cases were registered under multiple provisions, including Section 61(2) (criminal conspiracy) of the Bharatiya Nyaya Sanhita (BNS), Sections 17 and 18 of the Unlawful Activities (Prevention) Act (UAPA), 1967, Section 3 of the Official Secrets Act (OSA), 1923, along with other relevant sections of the BNS.
Mechanics of the espionage network
According to sources within Counter Intelligence, the operation followed a pattern typical of cross-border espionage. Pakistani Intelligence Operatives (PIOs) from the ISI identified vulnerabilities among potential targets, cultivating them to serve as assets within India.
The handlers deployed time-tested Vulnerability Mapping and the classic MICE (Money, Ideology, Coercion, and Extortion) framework to initiate contact, cultivate trust, and extract actionable information through digital honey-trapping combined with financial inducements.
“That is precisely why they consistently target sailors or lower-ranking personnel in the Navy — individuals who may be facing financial distress and need money,” noted a senior intelligence official.
In this instance, the operatives relied heavily on Social Engineering and open-source intelligence (OSINT) techniques. Handlers systematically scanned social media platforms to identify vulnerable defence personnel, government contractors, or civil servants before setting their traps.
According to a senior intelligence officer, digital honey-trapping served as the primary hook.
In such operations, fake female personas are engineered to initiate casual contact. Over time, these interactions graduate into romantic conversations, eventually leading to the exchange of sexually explicit content. While the investigation remains ongoing, preliminary findings confirm that explicit material was exchanged. However, investigators are still verifying whether these materials were subsequently used as leverage for blackmail to extract classified operational information.
Thus far, the investigation revealed that two trained female PIOs operating under the pseudonyms Joshita Pall and Anvi Mehta were in direct contact with the two arrested persons.
While Joshita claimed to be an employee at a shipbuilding firm in Mumbai, Anvi posed as a Delhi-based psychologist. The operatives initially established contact through Facebook before coaxing the targets to transition their conversations to WhatsApp.
Technical intelligence gathered by investigators indicates that the operatives approached defence personnel using fictitious social media profiles. Once rapport and trust were established, conversations rapidly shifted to text messaging, encrypted voice calls, and video calls. The broader strategy relied on fabricated professional identities, promises of romantic relationships, explicit adult content (including compromising video recordings), and monetary incentives paid via cryptocurrency channels.
According to a serving commander-rank officer, he had once received such unsolicited e-mail from a “very attractive-looking woman”, who posed as an executive in a communication company. But after a very mundane conversation, I could understand that it was a honey trap, as she sounded very keen to know about my rank, my postings and other confidential details. I broke the contact immediately. Later, I realised that she had picked up my profile from a matrimonial site, as at that time my parents and I were browsing through such sites. They look for vulnerabilities and target their needs and aspirations, he said.
A CIC official explained that initial conversations are typically mundane and centre on trivial matters. However, trained operatives gradually steer discussions toward sensitive operational domains, extracting fragments of information. They then connect these disparate data points to reconstruct operational theories or draft comprehensive intelligence briefs. In the current case, investigators allege that the ultimate objective was to persuade personnel to share classified defence intelligence.
The operatives reportedly sought intelligence regarding: movements and schedules of naval vessels and submarines. Photographs and video footage of naval assets and sensitive installations. The identities, routines, and movements of Commanding Officers. Live operational tours during video calls, where personnel were urged to show sensitive areas of naval bases, ships, and submarines.
It is now established that the names and profiles of these PIOs were completely fraudulent, with strong indicators suggesting they may have been generated using Artificial Intelligence (AI). It is a recognised reality in modern counter-espionage that foreign intelligence agencies, including Pakistan’s ISI, rely heavily on generative AI and deepfake technologies to conduct digital honey-trap operations.
The traditional “Romeo spy” methodology has evolved into AI-driven automation, primarily because synthetic profiles leave virtually no real-world human digital footprints for investigators to trace. Handlers use generative AI models to construct hyper-realistic human faces, photo galleries, and video clips that do not exist anywhere else on the open web, frequently leaving cyber-investigators without initial reference points.
Profile cloning, deepfakes, and real-time AI voice-swapping calibrated to match local accents are the latest weapons in the intelligence arena. Generative AI models can mimic regional dialects and cultural nuances, making conversations feel remarkably natural. Intelligence sources confirm that this specific technological dimension of the case remains under active investigation.
Why the focus remains on Vizag?
Pakistani intelligence has long maintained a focused interest in the Eastern Naval Command based in Visakhapatnam. Historically, during the 1971 Indo-Pakistani War, Pakistan deployed its most advanced submarine, the PNS Ghazi, to the waters off Visakhapatnam with the specific objective of tracking and sinking India’s aircraft carrier, INS Vikrant.
Visakhapatnam is not merely home to one of India’s largest naval bases; it serves as the home port for the Arihant-class nuclear-powered ballistic missile submarines (SSBNs). These assets operate under the Strategic Forces Command (SFC) and represent a vital leg of India’s nuclear triad. Furthermore, the highly classified Ship Building Centre (SBC), where these nuclear submarines are constructed and fitted out, is located within this naval enclave.
Ever since India commissioned its first indigenous SSBN INS Arihant, foreign intelligence agencies have intensified efforts to gather granular details regarding the facility and its assets.
This operation is far from the first cross-border espionage case targeting the ENC.
In December 2019, Operation Dolphin’s Nose exposed an extensive spying network targeting the ENC. That investigation uncovered a network of Pakistani Intelligence Operatives who utilised digital honey-traps, hawala money channels, and local conduits to compromise junior naval personnel.
Initially detected and investigated by the Andhra Pradesh CIC, the 2019 case was subsequently handed over to the National Investigation Agency (NIA). Approximately 15 people, including seven naval personnel, were arrested, establishing direct links to the ISI. The NIA has since secured formal convictions against several of the key accused.
The operational methodology and the nature of intelligence sought in the current case bear striking similarities to the 2019 enterprise: detailed data on ship and submarine deployments, dockyard layouts, and base logistics.
In both instances, suspects were charged under stringent legislation, including the Unlawful Activities (Prevention) Act (UAPA), Section 3 of the Official Secrets Act (OSA), and Section 120B of the Indian Penal Code (IPC) for criminal conspiracy.
In both cases, the primary objective of the PIOs was to obtain ground-level field intelligence regarding:
Operational deployments and departure schedules of surface ships and submarines. Official names, personnel files, and movements of Commanding Officers. Logistics, supply replenishment patterns, and base support protocols.
“There are various sophisticated avenues of intelligence gathering today, including high-resolution satellite imagery. Yet, field-level human intelligence remains one of the oldest and most reliable methods, and honey-trapping is the oldest trick in the operational handbook. It happened decades ago, and it will continue to occur,” observed a senior naval officer.
Every detail concerning a warship or submarine – no matter how minor – holds strategic value for an adversary. Photographs reveal structural contours, dimensions, radar cross-sections, and stealth modifications. Furthermore, acquiring advance knowledge of a naval vessel’s movement schedule makes it significantly easier for an adversary to pre-position intelligence-gathering ships or submarine-snooping units.
Such specialised units can collect critical operational signatures, including radar emissions, acoustic signatures, and electronic transmission patterns, enabling foreign militaries to fingerprint and track naval assets during conflict.
Even mundane administrative details such as, the exact volume of fuel, fresh water, and dry rations loaded onto a vessel prior to departure, provide vital clues regarding its intended operational range and sailing duration. This forms the core of tactical field intelligence, and the PIOs were tasked with systematically extracting these details from cultivated assets.
“PIOs engage targets in prolonged communications—alternating between casual banter and sexually explicit dialogue—to gradually harvest relevant data points and piece together a comprehensive operational picture,” the officer added.
Why field intelligence still matters?
Military history demonstrates that low-tech field intelligence has repeatedly neutralised or outmanoeuvred high-tech military capabilities.
During the 1971 Indo-Pakistani War, Indian Army field agents intercepted a logistics communication sent by the Pakistan Navy to local naval authorities in Chittagong (then East Pakistan). The message requested specialised diesel engine lubricants and heavy submarine-grade maintenance oils at Chittagong Port. This critical signal intelligence was corroborated by local Indian field intelligence agents and immediately passed to the Naval Intelligence.
By collating these reports, analysts confirmed the operational presence of Pakistan’s only long-range, U.S.-built diesel-electric submarine capable of extended operations in the Bay of Bengal – the PNS Ghazi. Intelligence analysts deduced that the Ghazi had been deployed specifically to locate and strike India’s aircraft carrier, INS Vikrant.
In response, Vice Admiral N. Krishnan, then Commander-in-Chief of the Eastern Naval Command, executed a classic deception operation. He ordered the INS Vikrant to sail to a secure, undisclosed anchorage near the Andaman and Nicobar Islands. Concurrently, he intentionally leaked a false logistics requirement for massive ration procurements at Visakhapatnam, signalling to Pakistani intelligence that the Vikrant was still docked there.
Vice Admiral Krishnan arranged for a naval officer stationed aboard the Vikrant to send personal mail to his family from Visakhapatnam, ensuring the letters passed through local Pakistani intelligence channels.
The PNS Ghazi sailed directly into the strategic trap. The operation culminated in the destruction and sinking of the PNS Ghazi off the coast of Visakhapatnam on the intervening night of December 3-4, 1971, following targeted engagements by INS Rajput.
Similarly, decades later, intelligence monitoring revealed Pakistan’s bulk procurement of specialised extreme-cold-weather gear and high-altitude snow boots from European suppliers. This classic field-intelligence indicator exposed operational preparations prior to the 1984 Siachen conflict, allowing Indian forces to execute “Operation Meghdoot” and secure the strategic heights of the Siachen Glacier first.
The painstaking probe
Narrowing down the suspects in “Operation Firewall, 2026” required months of painstaking investigation. Once anomalous international messaging traffic was flagged, the AP CIC and central intelligence agencies deployed technical surveillance frameworks like NATGRID and CMS to intercept incoming and outgoing international communications, trace IP logs, monitor WhatsApp OTP sharing patterns, and isolate digital channels used to exfiltrate classified naval data. High-end decryption tools were used to decipher end-to-end encrypted messages.
Investigative sources confirmed that financial transactions and the real-world identities of the suspects were mapped using NATGRID databases. Money trails involving suspicious bank transfers, local hawala networks, and cryptocurrency micro-payments were traced across 10 Indian states.
A critical breakthrough occurred when investigators uncovered a local support architecture that utilised Indian SIM cards registered under fictitious or stolen local names. These local conduits shared One-Time Passwords (OTPs) with foreign handlers overseas. Indian intermediaries were enticed with monetary incentives—paid either in cryptocurrency or through local cash transfers—to supply the OTPs required to activate fresh WhatsApp accounts. Once activated, these messaging accounts were operated remotely from Pakistan by ISI handlers.
However, capturing digital footprints was insufficient to secure convictions.
“After conducting extensive digital surveillance, we immediately moved to gather simultaneous human intelligence (HumInt). It required months of synthesising both TechInt and HumInt before we possessed sufficient operational proof to execute the raids,” explained a CIC official.
A senior IPS officer involved in the operation detailed the complexity of counter-espionage investigations:
“Because this is an active national security investigation, full operational details cannot be disclosed. However, in cases of this magnitude, putting targets under surveillance and compiling actionable counter-intelligence takes months or even years. We utilise specialised methodologies, including launching proxy sites to entrap rogue actors.
While our technical capabilities operate within specific framework constraints compared to agencies in the US, Israel, or Russia, we routinely collaborate with partner nations to verify cross-border intelligence. The most challenging aspect remains retrieving encrypted message logs from foreign application developers and service providers, as they operate under strict user privacy contracts. Recovering data from platforms using end-to-end encryption requires demonstrating explicit national security threats to obtain high-level judicial and administrative authorisation, a process that can take weeks or months.”
Safeguards and Operational Security
In light of evolving cyber threats and cross-border espionage networks, the Ministry of Defence has instituted stringent operational security (OPSEC) frameworks across all service branches to safeguard classified assets.
Despite these protocols, the key question remains: How do foreign operatives continue to breach security perimeters, and how do compromised assets successfully transmit classified operational data?
The Armed Forces, including the Indian Navy, have banned a wide array of high-risk commercial applications and imposed strict regulations on Virtual Private Networks (VPNs). Personnel are explicitly prohibited from using social networking platforms, online gaming chat servers, or commercial VPN applications on both official and personal devices while stationed at sensitive bases or operational commands.
Despite these prohibitions, preliminary findings indicate that photographs and video recordings of sensitive military installations were successfully transmitted by the accused to their overseas handlers.
Military regulations mandate a strict “zero-tolerance” policy regarding unreported contact with unknown or suspicious foreign social media profiles. Service personnel undergo continuous training to identify and report suspected “honey-pot” solicitation attempts immediately.
Prompt reporting allows counter-intelligence units to initiate immediate “trap-and-trace” operations or feed coordinated disinformation back to foreign intelligence handlers.
While the CIC and collaborating intelligence agencies have conducted digital forensic audits on seized mobile phones, hard drives, and communication hardware confiscated from naval bases and private residences, officials have not yet disclosed the full extent of the classified material that was exfiltrated.
“We have initiated deep digital forensic recovery procedures to retrieve deleted chat histories, transmitted image files, and underlying metadata,” stated a CIC official.
Investigative agencies emphasise that the current arrests represent only the initial phase of a broader network breakdown. While 18 primary suspects have been formally identified and two individuals are currently in custody, additional arrests and detailed disclosures are anticipated in the coming days as forensic analysis proceeds.