WaterISAC Navigation
  • About
  • Report Incident
  • Contact Us
  • Become a Member
  • NRWA Signup
  • WaterISAC Champions
  • About
  • Report Incident
  • Contact Us
  • Become a Member
  • NRWA Signup
  • WaterISAC Champions
Home Community Partnerships (TLP:CLEAR) Authorities Disrupt Islamic State Ricin Plot in India that Planned to Poison Local Water Supplies
Become a Member

Log in

  • Upcoming Events
  • Resource Center
  • Tools
  • Webcasts
  • Contaminant Databases
  • Directory
  • About
  • Log in

  • My Account

  • Logout

  • Report Incident
  • Contact Us
  • NRWA Signup
  • WaterISAC Champions
More Resources

(TLP:CLEAR) Authorities Disrupt Islamic State Ricin Plot in India that Planned to Poison Local Water Supplies

TLP:CLEAR

Author: Alec Davison

Created: Thursday, November 20, 2025 - 17:21

Categories: Contamination, Physical Security, Security Preparedness

Summary: Last week, Indian authorities disrupted a terrorist plot to poison local water supplies, arresting three individuals with confirmed links to the Islamic State Khorasan Province, according to a report from Indago Solutions. This plot demonstrates the enduring appeal of foreign terrorist organizations (FTOs) targeting critical infrastructure services in furtherance of their ideological goals.  

Analyst Note: In the past, malicious threat actors have attempted to use biological and chemical agents to target the water and wastewater sector. In 2018, for example, a Wisconsin based woman was charged with supporting the Islamic State by encouraging online supporters of the group she was in contact with to poison local water reservoirs with ricin. Before that, in 2015, Islamic State operatives plotted to poison water supplies in the European country of Kosovo, underscoring the persisting desire of FTOs to target public drinking water to conduct mass-casualty attacks.

In this latest plot, the accused terrorists reportedly planned to manufacture the highly toxic biological agent ricin and target water supplies, religious sites, and public areas in major Indian urban centers. The plot involved a multi-national operation directed by an external Islamic State Khorasan Province handler, who provided instructions and logistical support. Tactical gear, including firearms and ammunition, were smuggled over the border from Pakistan via drone. One of the alleged terrorists converted his residence into a makeshift laboratory, acquiring precursor chemicals, castor beans, and an oil-press machine to manufacture the ricin.

Indian authorities reported that the individual responsible for manufacturing the ricin had not yet successfully isolated the toxin or determined a delivery mechanism at the time of his arrest. “This was not a case of lone-actor radicalization but a directed cell with a mature command-and-control structure. The presence of an external handler, transnational weapons smuggling, and a clear division of labor indicate a sophisticated network,” according to the Indago Solutions report. Indeed, the Islamic State-Khorasan Province remains one of the most lethal Islamic State affiliate groups with a network of transnational contacts and a persistent desire to conduct external operations in Western countries.

Original Source: Access the full report below.

Additional Reading:

  • (TLP:AMBER) Recent of Arrests of Alleged Islamic State Supporters Alongside the Continued Release of Foreign Terrorist Propaganda, Underscores the Heightened Terrorist Threat

Mitigation Recommendations:

  • Decontamination Resources for Water and Wastewater Utilities
  • (TLP:CLEAR) EPA Publishes New Incident Action Checklists on Responding to Contamination Events

Related WaterISAC PIRs: 1, 2, & 4

Attached Files:

Indago Assessment - Disrupted ISKP-Affiliated Ricin Plot in India

Related Resources

Members Only

(TLP:AMBER) CISA Shares Operational Technology Guide – OT Compromise Detection and Response

Apr 16, 2026 in Contamination, Federal & State Resources, OT-ICS Security

(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – April 2, 2026

Apr 2, 2026 in Contamination, Security Preparedness
Members Only

(TLP:GREEN) Incident Report – Vandalism at Electric Substation Leads to Oil Leak and a “Do Not Consume” Water Advisory

Jan 29, 2026 in Contamination, Physical Security, Security Preparedness

Become a Member
FAQs
About
Report Incident

Terms & Conditions
Privacy Policy
AI Policy
Contact Us

LinkedIn

1250 I Street NW, Suite 350
Washington, DC 20005
1-866-H2O-ISAC (1-866-426-4722)
© 2026 WaterISAC. All Rights Reserved.

Toggle the Widgetbar