Indian security agencies have linked the spurt in social media messages targeting India and Prime Minister Narendra Modi to a coordinated effort that has the “imprint” of Pakistani intelligence.

According to an assessment handed to the government on Wednesday, the effort was designed to flood social media with messages to fuel anti-India sentiment, particularly in the Gulf countries, “by spreading false propaganda on Islamophobia in India”.

The Pakistani deep state, the report said, was attempting to bring a schism between India and close allies in the Gulf by attacking PM Modi who has invested heavily to deepen India’s ties with the Middle-East.

The assessment by North Block includes a long list of troll handles based in Pakistan and in the Gulf countries that were being used to achieve this objective.

The spike in social media messages targeting New Delhi isn’t a first.

Security officials had noticed a similar pattern last year when Jammu and Kashmir was placed under a communication lockdown last August, hours before Parliament took up legislation to strip Jammu and Kashmir of its special status under the Constitution.

On social media and otherwise, Pakistan had made a concerted effort to embarrass India over nullification of Article 370 but didn’t get far, a government official said.

“What has been the novelty in the instant case is the use of prominent personalities in Gulf countries to scale up a systematic agenda of fake propaganda … This effort has clear imprints of the involvement of Pakistan ISI,” a top government official told Hindustan Times, citing the analysis of tweets that targeted New Delhi.

On Tuesday, the hashtag that was powered by entities in Pakistan was “ShameOnModi”. A day earlier, the hashtag was “ChaosInIndia”.

The campaign that targeted PM Modi was driven by systematically engineering circulation of video clips of isolated incidents of attacks or harassment of Muslim individuals in India to project as if the entire community was under attack.

The assessment classifies the Twitter handles into four categories: among the hundreds analysed by security agencies, the report classifies aggregators, feeders, spreaders and influencers.

Twitter handles classified as feeders collect the videos from aggregators, devise the appropriate messaging for the videos or photographs and then forward it to the spreaders. Officials said it was not a coincidence that the Twitter handles of most of these feeders were created recently – between January and April – and indicated there was a clear plan and organised effort to target New Delhi.

Many of the handles classified as spreaders are based in Pakistan as well.

Like the handle that has the picture of a 20-something. She (it could well be a male) had started her day on Twitter this Tuesday with a few posts remembering Iqbal, the pre-eminent poet revered on both sides of the border. Then, she got down to work. By the end of the day, she had posted 200-plus tweets and retweets; an average of one every three minutes with the same hashtag.

The report listed scores of Twitter handles, each echoing tweets posted by the others, and using graphic images and videos – many of them several years old – to provoke outrage.

This time, however, the report said, there were also spreaders located in different countries of Gulf Cooperation Countries: Bahrain, Kuwait, Oman, Qatar, Saudi Arabia, and the United Arab Emirates. These are all old but unverified Twitter handles, the report said.