Security agencies have uncovered a new tactic used by terrorists and their handlers to communicate secretly, with pornography websites and niche encrypted applications now being used to pass on instructions, officials said on Sunday. The agencies said terror outfits and Pakistan's intelligence agency, ISI, are using these channels to reach recruits in Jammu and Kashmir while avoiding surveillance on mainstream social media platforms.

Officials said the covert network includes porn platforms with live chat features presented as tools to help users find dates nearby, as well as privacy-focused messaging applications that hide user identities. They said the shift marks a move away from commonly used platforms such as WhatsApp, Facebook Messenger and Signal.

According to officials, handlers are using Tor-based messaging applications such as Coatex and Conion, which route data through encrypted nodes to conceal the identity of users. Access to the APK file for Conion is reportedly restricted in India. Agencies are also tracking a France-based app that offers end-to-end encrypted messaging without requiring a SIM card or phone number, making it harder to identify users.

They are also monitoring Vietnam-based applications and anonymous platforms such as Moonchat, including PGP-encrypted versions suspected to have Chinese origins and which bypass traditional registration. Officials said Moonchat has several versions used for finding singles nearby. Although several of these porn applications are banned in India, they are being downloaded illegally through VPN services, which mask internet addresses and make online activity harder to trace.

Security experts said platforms that use the Tor network create major tracking difficulties because encrypted traffic is passed through multiple relay points around the world, hiding where the data comes from and where it is going. While Tor is maintained by the US-based non-profit The Tor Project for privacy and anti-censorship purposes, officials said its anonymity features are increasingly being exploited by clandestine networks, including terror groups.

Officials said the agencies are continuing to adapt their cyber-surveillance systems to map and intercept these off-grid communication channels. They said the ban on such applications was justified because terror groups were increasingly using the encrypted messaging features of porn sites to recruit and radicalise youths in Jammu and Kashmir.

In a break from conventional social media, handlers are approaching potential recruits through platforms that differ in their levels of security in order to avoid detection.

Officials said some of these applications offer basic encryption, while others provide end-to-end encryption, disappearing messages and RSA-2048-based protection that processes data on the user's device without third-party interference. They also observed that handlers and recruits from the Valley were relying on applications that work even on slower 2G or EDGE networks, and that some of them do not require a phone number or email address for registration.

The new tactic came to light as security forces stepped up efforts against the use of foreign-generated virtual SIM cards. Officials said these virtual SIM cards, developed by companies based abroad, allow computers to generate phone numbers for use on smartphones through specific applications while leaving very little digital trace.

The method was first exposed during the investigation into the 2019 Pulwama terror attack, in which 40 CRPF jawans were killed, when the NIA found that more than 40 virtual SIM cards had been used by the Jaish-e-Mohammed suicide bomber and his accomplices.

Officials said the latest findings show a wider shift by terror handlers towards harder-to-trace digital tools, ranging from porn sites with chat functions to encrypted apps and virtual SIM cards, as security agencies continue to track and counter these communication networks.

– Ends