The National Investigation Agency (NIA) on Monday conducted searches at five locations across Maharashtra, Gujarat, Telangana, Bihar and Delhi as part of its probe into an alleged cyber-terrorism conspiracy involving attempted attacks on 54 Indian government websites during Operation Sindoor. 

The searches are linked to a case involving sophisticated Distributed Denial-of-Service (DDoS) attacks that allegedly targeted government websites, critical computer resources and Critical Information Infrastructure (CII) during the military operation last year. The case was initially registered by Gujarat Police in June 2025 before the investigation was taken up by the NIA. 

Searches Across Five States

According to the NIA, its teams searched premises in Junnar in Pune district, Maharashtra; Nadiad in Kheda district, Gujarat; Ramagundam in Karimnagar district, Telangana; Gopalganj in Bihar; and Delhi. The agency carried out the searches after obtaining the necessary legal authorisations.

Investigators reportedly seized digital devices and documents during the operation. The material recovered is expected to undergo forensic examination as the agency attempts to establish links between the suspects and those already arrested in the case. 

What Is the Cyberattack Case?

The investigation centres on alleged attempts to launch DDoS attacks against 54 government websites. Such attacks generally involve overwhelming an online service with large volumes of traffic or requests, potentially making websites inaccessible to legitimate users.

The NIA has classified the case as one involving cyber terrorism, with investigators examining whether the alleged attacks were intended to compromise government digital infrastructure, threaten national security and create public fear. 

Two accused persons have already been arrested in connection with the case, while the latest searches are aimed at identifying additional individuals who may have assisted or supported the alleged cyberattack operation. 

Case Linked to Operation Sindoor

The alleged cyberattacks took place in the backdrop of Operation Sindoor, launched by Indian armed forces following the April 22, 2025, terror attack in Pahalgam, Jammu and Kashmir, in which 26 people were killed.

Indian forces launched strikes against terror targets in Pakistan and Pakistan-occupied Kashmir on May 7, 2025. The military action was followed by several days of cross-border hostilities before fighting was halted on May 10.

The cyberattack investigation therefore examines activity targeting Indian government digital infrastructure during a particularly sensitive period.

Digital Evidence Under Scanner

The latest searches are significant because investigators are now examining the wider network allegedly connected with the cyberattacks. Digital devices recovered from the searched locations could help investigators establish communication links, identify attack infrastructure and determine whether other people were involved.

Officials are also expected to examine whether the suspects had any connection with the two people already arrested in the case and what role each individual may have played.

NIA Probe Continues

The NIA's investigation is continuing, with forensic examination of seized electronic devices expected to provide further leads. The agency's searches across five states indicate that the probe has expanded beyond the original location of the Gujarat case.

The investigation will also seek to establish the extent of the alleged attacks and whether the attempted disruption of government websites was part of a coordinated cyber operation.

The latest action highlights the growing focus on cyber threats to government systems and critical digital infrastructure, particularly during periods of heightened national security concerns.