New Delhi [India], June 20 : For decades, counter-terrorism operations largely revolved around the immediate aftermath of an attack - recovering explosives, identifying perpetrators and arresting those directly involved. Today, however, the battlefield has expanded far beyond the scene of the crime. Modern terror networks often rely on encrypted communication, cross-border financial channels and overseas facilitators who rarely handle weapons but play an equally critical role in enabling violence.
Punjab Police’s recent operation to secure the deportation of two alleged Khalistan Zindabad Force (KZF) operatives from Malaysia reflects this changing reality. While the arrests themselves represent a significant operational achievement, the larger story lies in how investigators followed a financial trail that allegedly stretched from Punjab to Malaysia, exposing the international support structure behind a terror module accused of targeting India’s critical infrastructure.
The investigation underscores an increasingly important principle in contemporary counter-terrorism: dismantling the financiers and facilitators behind a terror network can be as consequential as apprehending those who carry out attacks on the ground.
When the Target Is the Nation’s Economy
The investigation was triggered by two incidents that immediately raised concern within India’s security establishment.
On 23 January 2026, an Improvised Explosive Device (IED) exploded near Sirhind in Punjab’s Fatehgarh Sahib district, damaging a section of the Dedicated Freight Corridor (DFC). Barely three months later, on 27 April, another attempt was allegedly made to sabotage the same corridor near Shambhu in Patiala district. Punjab Police foiled the second plot after a suspected operative was killed while allegedly planting another explosive device.
These were not random acts of violence.
The Dedicated Freight Corridor is among India’s most ambitious infrastructure projects, designed to streamline freight movement, reduce logistics costs and strengthen industrial supply chains. An attack on such an asset carries implications far beyond physical damage. It threatens economic activity, disrupts transportation networks and seeks to undermine public confidence in the state’s ability to protect strategic infrastructure.
Security analysts have increasingly warned that extremist organisations are broadening their target profile, focusing not only on civilian casualties but also on assets whose disruption can produce wider economic and psychological consequences.
A Bigger Conspiracy Emerges
As investigators expanded the probe, the railway attacks appeared to be only one component of a larger conspiracy.
Raids conducted across Punjab resulted in the arrest of multiple accused and the seizure of an RPG launcher, RDX, IEDs, hand grenades, sophisticated pistols and ammunition. The recoveries suggested that the module possessed the capability to carry out multiple coordinated attacks rather than a single act of sabotage.
Digital evidence, forensic analysis and intelligence inputs gradually shifted investigators’ attention away from the explosives themselves and towards those allegedly financing and coordinating the operation from overseas.
That shift would eventually lead investigators beyond India’s borders.
Following the Financial Trail
According to Punjab Police, the investigation identified Malaysia as an important operational and financial hub for individuals allegedly linked to the banned Khalistan Zindabad Force.
Investigators allege that Gurwinder Singh of Ambala and Manjeet Singh of Patiala, both based in Malaysia, acted as financial facilitators for the terror module. Their alleged role extended beyond transferring money. Authorities believe they helped channel funds for recruitment, procurement of explosives, logistics and operational planning while maintaining links between overseas handlers and operatives inside Punjab.
Unlike ground-level operatives, financial coordinators often remain insulated from direct operational exposure. Yet they form the backbone of transnational terror networks by ensuring that money, equipment and instructions continue to flow across jurisdictions.
Modern counter-terrorism investigations increasingly recognise that following financial transactions can reveal the organisational architecture behind an attack far more effectively than focusing solely on those who execute it.
The Malaysia Connection
The investigation soon evolved into an exercise in international law enforcement cooperation.
Following intelligence shared by Indian agencies, Malaysian authorities reportedly located the two suspects after they had entered the country following the April railway sabotage attempt. Through coordination involving the Royal Malaysia Police and Interpol’s National Central Bureau, investigators traced the suspects to the Klang Valley region before detaining them.
Their subsequent deportation to India enabled Punjab Police to arrest both men immediately upon their arrival at New Delhi’s Indira Gandhi International Airport before producing them before a Patiala court for custodial interrogation.
Equally significant was Malaysia’s public position following the operation. Malaysian authorities stated that the country would not become a refuge for individuals attempting to evade criminal prosecution, reflecting the growing importance of bilateral cooperation against transnational terrorism and organised crime.
In an era where extremist organisations operate across continents, such cooperation is becoming indispensable.
Financing Terror Across Borders
The Punjab investigation illustrates a broader challenge confronting security agencies worldwide.
Contemporary extremist organisations increasingly function as decentralised networks. Recruitment may occur in one country, funding in another, digital communication through encrypted platforms hosted elsewhere, and operational execution in an entirely different jurisdiction.
This fragmentation complicates investigations while simultaneously highlighting the importance of financial intelligence.
Every terror conspiracy depends upon funding for recruitment, travel, safe houses, procurement of weapons, digital infrastructure and operational logistics. Disrupting those financial lifelines weakens networks long before attacks can be executed.
Consequently, counter-terrorism agencies are placing growing emphasis on identifying financiers, money couriers, overseas facilitators and logistical coordinators rather than limiting investigations to local operatives.
Protecting Critical Infrastructure
The repeated targeting of the Dedicated Freight Corridor also reflects a wider global security trend.
Critical infrastructure, including railways, ports, power grids, airports and communication networks has emerged as an attractive target for extremist organisations seeking to maximise disruption without necessarily causing mass casualties.
Such attacks are designed to impose economic costs, interrupt essential services and generate public anxiety disproportionate to the scale of physical damage.
As India’s infrastructure network expands through investments in freight corridors, industrial corridors and high-speed transport systems, securing these assets has become an increasingly important component of national security.
The Punjab investigation serves as a reminder that protecting critical infrastructure requires more than physical security. It also demands robust intelligence gathering, cyber monitoring, financial surveillance and international cooperation.
A Changing Counter-Terror Strategy
The operation reflects an important evolution in India’s counter-terrorism doctrine.
Rather than focusing exclusively on those who physically execute attacks, investigative agencies are increasingly seeking to dismantle the broader ecosystem that sustains extremist organisations. Financial investigations, cyber forensics, intelligence sharing and international policing have become central components of modern counter-terror operations.
By targeting overseas facilitators and disrupting funding channels, agencies aim not only to solve individual cases but also to prevent future attacks by denying extremist organisations the resources they depend upon.
This approach mirrors global best practices, where long-term success is measured not merely by arrests but by the ability to dismantle networks before they can regenerate.
Beyond Two Arrests
The deportation of two alleged KZF operatives from Malaysia is therefore significant for reasons extending beyond the immediate investigation.
It demonstrates the value of intelligence-led policing, the effectiveness of international law-enforcement cooperation and the growing emphasis on financial investigations in combating terrorism.
More importantly, it highlights a changing security landscape in which the architects of violence often operate thousands of kilometres away from the eventual target, relying on digital technology, international finance and cross-border logistics to sustain local cells.
As investigators continue examining financial transactions, encrypted communications and overseas contacts connected to the case, further details about the network may emerge.
Regardless of the investigation’s eventual outcome, the Punjab Police operation offers an important lesson for contemporary counter-terrorism. The most decisive victories are no longer achieved solely by recovering explosives or arresting attackers after an incident. They are achieved by identifying the hidden networks that finance, coordinate and sustain extremist violence and dismantling them before the next attack can take shape.
Ends.
Comments (0)
Be the first to comment!