Teen hacker arrested for cyber strikes on India: How a Telegram group became a digital weapon

Ahmedabad: The Gujarat Anti-Terrorism Squad (ATS) has arrested Jasim Shahnawaz Ansari, an 18-year-old resident of Nadiad, for allegedly orchestrating over 50 coordinated cyberattacks on Indian government domains during the month of May 2025. The attacks coincided with India’s military Operation Sindoor, a retaliatory action following a terror strike in Pahalgam.

Officials revealed that Ansari and other juveniles operated through a Telegram group named AnonSec, where they planned and executed Distributed Denial of Service (DDoS) attacks. They used open-source tools and free software, including Python programming frameworks accessible via GitHub and mobile apps like PyDroid, to overwhelm government servers with traffic. The targets were critical sectors including defence, aviation, finance, and urban development.

In addition to disrupting websites, some defaced pages displayed anti-national slogans such as “India may have started it, but we will be the ones to finish it,” escalating concerns over the attacks' political motivations. Investigators traced the group’s methodology to online tutorials and social platforms, noting the juveniles’ bragging about their exploits in encrypted chat rooms.

While the technical complexity of the attacks was limited, the volume, coordination, and timing triggered alarm bells within Indian intelligence agencies. The Gujarat ATS began surveillance after intercepting chatter on cyber-forums discussing India’s military operations. This led to the identification of the AnonSec Telegram channels used to coordinate attacks and share step-by-step blueprints.

The arrest has spotlighted the emerging threat of juvenile involvement in cyber subversion. Ansari, reportedly a class-12 science student who recently failed exams, reflects a troubling trend of radicalised youth turning to digital means of disruption. Authorities are investigating whether foreign hostile entities influenced or directed these cyberattacks. At least one other juvenile, aged 17, is also under investigation.

FIRs have been registered under Sections 43 and 66F of the Information Technology Act, which deal with damage to computer systems and cyber terrorism. The incident raises urgent questions about India’s cyber resilience, the vulnerability of critical infrastructure, and the growing risk posed by online radicalization of minors in an increasingly digital conflict landscape.