How Punjab Police Dismantled a Malaysia-Based Khalistan Terror Finance Network

In a major counter-terrorism breakthrough, Punjab Police has struck at the heart of a transnational Khalistani terror ecosystem by securing the deportation of two alleged Khalistan Zindabad Force (KZF) operatives from Malaysia. Far from being a routine extradition, the operation represents a significant intelligence success that exposed the financial and logistical backbone of a network accused of plotting attacks on India's critical infrastructure.

The intelligence-led operation, conducted jointly by Punjab Police, Central agencies and the Royal Malaysia Police (RMP), culminated in the arrest of Gurwinder Singh of Ambala and Manjeet Singh of Patiala immediately after they landed at New Delhi's Indira Gandhi International Airport. Both were subsequently produced before a Patiala court and remanded to police custody for further interrogation.

According to investigators, the two men were not ordinary fugitives. They allegedly served as key Malaysia-based operatives of a KZF-backed terror module that financed, coordinated and facilitated attacks on Punjab's Dedicated Freight Corridor (DFC), one of India's most strategically important rail infrastructure projects.

The Railway Attacks That Sparked the Investigation

The investigation traces its origins to two carefully planned attacks on the Dedicated Freight Corridor earlier this year.

On 23 January 2026, an Improvised Explosive Device (IED) blast damaged a freight railway corridor near Sirhind in Fatehgarh Sahib district. The explosion disrupted rail infrastructure and immediately raised concerns that terrorist groups were shifting their focus towards India's economic assets rather than conventional civilian targets. Barely three months later, on 27 April 2026, another attempt was made to target the same freight corridor near Shambhu in Patiala district. Punjab Police foiled the conspiracy after a suspected operative was killed while allegedly planting another explosive device, leading investigators to uncover what they described as a much larger terror network.

Subsequent raids resulted in the arrest of four accused and the recovery of a substantial cache of militant hardware, including an RPG launcher, an IED, RDX, hand grenades and sophisticated pistols with ammunition. The recoveries indicated that the module possessed both the capability and intent to conduct high-impact attacks capable of disrupting critical infrastructure and public order.

Why the Dedicated Freight Corridor Was the Target

The choice of target was significant. The Dedicated Freight Corridor is a strategic national asset that carries large volumes of freight, strengthens industrial supply chains and improves logistics efficiency across northern India. Any disruption to this network can have cascading economic consequences while simultaneously generating public anxiety over the security of critical infrastructure.

Security experts increasingly view attacks on transport infrastructure as part of a broader strategy adopted by terrorist organisations seeking to inflict economic costs alongside psychological impact. The repeated targeting of the same corridor suggested planning, reconnaissance and external guidance rather than isolated acts of violence.

Following the Money Trail

While the explosives attracted immediate attention, investigators soon realised that the real story lay elsewhere. Digital evidence, financial records and intelligence inputs gradually revealed a sophisticated transnational network operating beyond India's borders. Punjab Police alleges that Malaysia had emerged as an important operational and financial hub for elements linked to the banned Khalistan Zindabad Force.

Investigators believe Gurwinder Singh and Manjeet Singh acted as financial facilitators responsible for routing terror funds through offshore accounts to operatives inside Punjab. These funds allegedly financed recruitment, logistics, procurement of explosives and operational planning for attacks intended to disturb peace and public order.

Unlike ground-level operatives who execute attacks, financial coordinators often remain insulated from direct operational exposure. Yet they form the backbone of modern terror networks by ensuring a continuous flow of resources across jurisdictions. The arrests therefore represent far more than the detention of two suspects, they strike at the enabling architecture that sustains extremist violence.

International Cooperation Delivers Results

One of the defining features of the operation was the level of international coordination involved. Following requests from Indian authorities, Malaysian law enforcement agencies located the two fugitives after they allegedly entered Malaysia following the April railway sabotage attempt. Through intelligence sharing, surveillance and coordination involving the Royal Malaysia Police and Interpol channels, both suspects were traced, detained and deported to India. Malaysian authorities publicly stated that the country would not serve as a safe haven for fugitives attempting to evade criminal prosecution, underscoring growing bilateral cooperation against transnational crime and terrorism.

For Indian security agencies, the operation highlights the increasing importance of partnerships with foreign law enforcement agencies as terror financing networks become more internationalised.

A Shift in India's Counter-Terror Strategy

The operation also reflects an evolution in India's counter-terrorism approach. Rather than focusing solely on arresting individuals who physically execute attacks, investigative agencies are increasingly targeting the financiers, handlers and overseas facilitators who enable extremist violence from abroad. This strategy mirrors global counter-terrorism best practices, which recognise that dismantling financial networks often produces more enduring operational disruption than isolated arrests of foot soldiers.

By targeting offshore funding channels, investigators seek not only to solve individual cases but also to prevent future attacks before operational cells can acquire weapons, recruit members or execute plans.

What Comes Next

Both accused remain in police custody as investigators continue examining financial transactions, encrypted communications and overseas contacts that may reveal additional operatives, facilitators and handlers connected to the conspiracy.

Officials believe the investigation could uncover a wider cross-border network involved in financing, coordinating and sustaining Khalistani extremist activities directed at Punjab. For Punjab Police, however, the significance of the operation extends beyond two arrests. The dismantling of a Malaysia-based financial node demonstrates that the battle against terrorism is no longer confined to crime scenes or state borders. Today's terror networks operate across multiple jurisdictions, relying on offshore financing, digital communications and foreign facilitators to execute local attacks.

The June 2026 operation is therefore more than a successful deportation. It is a reminder that counter-terrorism increasingly depends on following the money, disrupting international support structures and strengthening intelligence cooperation beyond national boundaries.

As investigations continue, the Malaysia operation is likely to be remembered as one of Punjab Police's most consequential counter-terror successes in recent years, not simply because two operatives were brought back to India, but because the operation exposed the global network that allegedly enabled them.