The three men accused of opening fire at actor Tiger Shroff in Mumbai allegedly received real-time updates about the police investigation from their handlers, who monitored television news coverage and relayed developments to help them evade arrest, according to police sources.
The alleged communication is a key focus of the Mumbai Police Crime Branch investigation, which is examining whether encrypted messaging applications such as Signal and Zangi were used to coordinate the attack and guide the accused during their escape.
The three suspects were arrested aboard a train in Rajasthan’s Kota on October 19, a day after the shooting in Mumbai’s Juhu area. They have been remanded to police custody until October 31.
According to Crime Branch sources cited by news agency PTI, one of the main suspects received an urgent message after television channels broadcast visuals of the attack. The message allegedly read: “Tumhare chehre aa gaye hain, nikal jao waha se” (Your faces are out, get out of there).
Investigators suspect that someone monitoring news reports was passing information to the accused as details of the police investigation emerged. However, police have yet to establish who was relaying the updates.
Accused repeatedly changed their escape routes
The firing took place on the evening of October 18, when two shooters allegedly fired several rounds at Shroff’s car in Juhu. The actor escaped relatively unhurt, while his driver and a vlogger sustained injuries.
The incident triggered a multi-state investigation, resulting in the arrest of 10 people from Rajasthan, Uttar Pradesh and Haryana.
The three key accused have been identified as Phool Singh, 18, Rehan Rahisuddin Ansari, 18, and Rithik Mahto, 22. They were intercepted by Kota Police on October 19 after Mumbai Police alerted their counterparts in Rajasthan.
According to investigators, news reports about the recovery of the attackers’ motorcycle in Andheri and information about their subsequent train journey were allegedly relayed to them by their handlers. The updates are believed to have influenced the trio’s decisions as they attempted to escape.
“The constant feed prompted the trio to frequently shift modes of transport, moving from a motorcycle to a train, followed by a cab, before planning to board a bus from Surat,” police sources said.
The accused reportedly encountered a delay at the Surat bus terminal, prompting them to board another train. Acting on information from Mumbai Police, Kota Police subsequently apprehended them aboard the train.
Investigators believe the repeated changes in transport were an attempt to stay ahead of the police as information about their movements emerged in the media.
Signal and Zangi communications under scrutiny
The Crime Branch is examining digital evidence to determine how the accused communicated with their alleged handlers during and after the attack.
Sources told PTI that Rehan was in frequent contact with others through Voice over Internet Protocol (VoIP) services. Investigators are examining internet-based applications such as Signal and Zangi, which can be used for calls and messages without requiring a mobile number for registration.
According to a report by The Indian Express, CCTV footage showed Rehan frequently using his phone, while investigators have accessed some communications between the accused and their alleged handlers.
The police suspect that the person relaying updates was monitoring television coverage and alerting Rehan whenever developments threatened to expose the suspects’ identities or movements. Investigators are yet to conclusively identify the person behind the communications.
The probe is also examining the wider network allegedly involved in planning the attack, including the procurement of firearms and the provision of logistical support.
Gangster Anil Pandit named as wanted accused
Mumbai Police have named gangster Anil Pandit as a wanted accused in the case. Pandit, an alleged associate of the Lawrence Bishnoi gang who is believed to be operating from the United States, claimed responsibility for the October 18 firing in a social media post.
Investigators are examining possible links between the accused and individuals suspected of coordinating the attack. The role of the alleged handlers, the use of encrypted communications and the chain through which the firearms were obtained remain important aspects of the investigation.
The Crime Branch is continuing to question the arrested men to establish who planned the shooting, who supplied the weapons and how information about the police investigation was allegedly passed on to the suspects as they attempted to flee.