Red Fort Blast: Tracing The Origins, Spread And Structure Of A White-Collar Terror Network

Last Updated:November 13, 2025, 15:13 IST

The full scale of the conspiracy is still emerging, but for now, agencies believe they have prevented a far larger plot from unfolding

13 people were killed in the Red Fort blast. (PTI)

The evening blast near Delhi’s Red Fort on 10 November has exposed a radicalised white-collar terror module: a network of doctors, a cleric and associates operating across multiple Indian cities and linked to Jaish-e-Mohammed (JeM) and Ansar Ghazwat-ul-Hind (AGuH) terror groups.

The fidayeen attack that killed 13 and injured more than two dozen was not a sudden act of violence. It was the outcome of long-term ideological grooming, encrypted coordination, foreign travel, recruitment drives, and finally a race against time when members of the module began to be arrested.

The National Investigation Agency (NIA), now probing the case, is piecing together how the network formed and how its members were linked to one another.

Where Did The Network Begin And Who Was Behind The Radicalisation?

According to investigators, the earliest threads of the conspiracy can be traced to October this year, when Jaish-e-Mohammed posters surfaced across Nowgam in Srinagar.

CCTV footage identified three youths, Arif Nisar Dar alias Sahil, Yasir-ul-Ashraf and Maqsood Ahmed Dar, pasting the posters. Their interrogation pointed police towards a cleric whose name repeatedly emerged: Irfan Ahmad Wagah, a former paramedical worker at GMC Srinagar who had also served as an imam.

Officials say Wagah and his wife formed the ideological core of the module. They allegedly radicalised medical interns, junior doctors and educated youth through sermons, closed-door sessions and online channels like Telegram. Their messages reportedly promoted extremist narratives and encouraged the building of “open sleeper cells" using doctors and professionals with clean profiles.

This ideological base connected directly to two encrypted Telegram groups: Farzandan-e-Darul Uloom, Deoband, and another run by Umar bin Khattab, a JeM militant in Pakistan.

These groups, accessed through end-to-end encrypted chats, became the meeting place of the module’s operatives. Over time, the discussions shifted from grievance-laced rhetoric to instructions on movement, recruitment and reconnaissance.

How Did The Doctors Know Each Other?

Central to the “doctors’ module" is the link between three men: Dr Umar Un Nabi, Dr Muzammil Ganaie and Dr Adil Ahmad Rather. All three studied or worked at different points at Government Medical College (GMC) Srinagar and GMC Anantnag, forming early friendships and professional connections.

Investigators say Umar and Muzammil’s friendship at GMC Srinagar was the first interpersonal link. They graduated around the same period, later working as residents before moving to Al-Falah University’s medical college in Faridabad, Haryana.

By this time, they were also in touch with Adil, who had already come on the intelligence radar after a separate incident: he had taken sudden leave on 26 September, married a fellow doctor on 4 October, and returned to Saharanpur, only for pro-Jaish posters to appear in Srinagar’s Rainawari and Zadibal areas on 27 October. CCTV footage and mobile data later linked that poster act to Adil.

Over time, another critical member joined this circle — Dr Shaheen Sayeed, a doctor from Lucknow who investigators say was in a close personal relationship with Muzammil. Her role, according to agencies, was significant: she was allegedly central to the effort to build a women’s wing linked to JeM and was in regular contact with the cleric’s network in Kashmir.

Shaheen and another woman doctor from Kashmir had completed their MBBS at Dhaka Medical College. Both reportedly came into contact with the cleric during internships at Srinagar hospitals, with investigators now describing this period as the turning point in their ideological shift.

Foreign travel ties further cemented these relationships. Umar and Muzammil travelled to Turkey earlier this year on instructions sent through a Telegram handler. Their stay and movements were arranged abroad, strengthening suspicions among investigators of direct coordination with JeM-linked facilitators.

Why Was Al-Falah University At The Centre Of The Plot?

Faridabad’s Al-Falah University emerged as the physical command centre of the network. Building 17, Room 13, now sealed, was where planning discussions, meetings and data storage allegedly took place. According to investigating agencies, forensic teams recovered chemical residues, glassware and material suggesting that small batches of ammonium nitrate mixtures were tested in a laboratory inside the campus. Samples have been sent for detailed forensic examination.

The university’s medical college offered anonymity and resources: hostel rooms, laboratory access and a continuous flow of young professionals.

Muzammil lived in Faridabad’s Dhauj area, while his associate Haji Ishtiaq stored more than 2,500 kilograms of explosive-making chemicals at a house nearby. Investigators say this Al-Falah–Dhauj belt formed the operational and storage hub of the conspiracy.

From Muzammil’s room alone, officers recovered about 350 kilograms of ammonium nitrate, detonators, manuals, timers and two automatic pistols. Shaheen, after panicking over Muzammil’s arrest, allegedly discarded an AK-47 from her car behind the university campus, which was later recovered.

For agencies, this represents both the module’s physical footprint and its concealment strategy. The use of a legitimate medical university helped mask suspicious movements, frequent visitors and the storage of chemicals.

What Did Investigators Find In The Car’s Kashmir Trail?

The early detentions in the case involved three men: Tariq Ahmad, Amir Rashid and Umar Rashid. Amir and Umar (brothers) work locally as a plumber and an electrician. Their names surfaced after investigators began tracking the movement of the Hyundai i20 eventually used in the Red Fort blast.

Sources told CNN-News18 that the car, originally registered in Gurugram under HR26 and owned by Mohammad Salman, was sold to a buyer in Delhi’s Okhla area last year. Investigators have since traced the vehicle to Kashmir, where it was purchased by Amir Rashid.

A key detail flagged by investigators is that when Amir bought the car, he provided a mobile number registered in the name of Tariq, a driver who is known to him. Amir had been using Tariq’s number, leading both identities to appear in call records and tower dumps linked to the vehicle. This overlap initially caused confusion, including the widely circulated image of Amir holding a car key being incorrectly tagged as “Tariq".

Police detained Amir, his brother Umar, and Tariq to clarify the circumstances of the purchase, verify why Tariq’s number was used, and determine whether any of them had knowingly facilitated the vehicle’s transfer before it reached Dr Umar Un Nabi, the alleged fidayeen attacker. Officers also questioned Dr Umar’s mother and two brothers to map his final movements.

How Did The Network Spread Across States?

Officials believe the spread was deliberate and planned. After returning from Turkey, Umar and Muzammil were instructed to disperse to different locations. Muzammil moved to Faridabad; Adil left for Saharanpur to work at a private hospital; Shaheen relocated to Faridabad; and the cleric remained active in Kashmir.

Each location served a purpose: Faridabad for logistics and material assembly; parts of Kashmir for recruitment and movement; Saharanpur for creating an additional operational node; Lucknow for expanding the women’s network; and the Mewat region for storing bulk explosives through Haji Ishtiaq.

The network’s design was decentralised. Each member had a role — logistics, recruitment, reconnaissance, firearms, finance or propagation. One of the doctors reportedly received multiple foreign remittances via digital wallets from Istanbul and Doha between 2023 and 2024, believed to be funding for their activities.

How Did The Plot Move From Preparation To Execution?

The first break in the case came from Srinagar, where JeM posters surfaced. CCTV footage led police to three overground workers — Arif Nisar Dar, Yasir-ul-Ashraf and Maqsood Ahmad Dar — all from Nowgam. Their interrogation pointed investigators to Maulvi Irfan Ahmad in Shopian, whose questioning became the turning point of the probe.

From Irfan, the chain moved to Dr Adil Ahmad Rather, who had recently shifted from GMC Anantnag to Saharanpur. Police recovered an AK-series rifle from his locker. His sustained interrogation exposed the existence of a larger network and led to the detention of Zameer Ahangar from Ganderbal, who was also linked to the cleric.

These leads finally took investigators to Dr Muzammil Ganaie in Faridabad. His two rented rooms, properties originally owned by the cleric, yielded the biggest haul: around 350 kg of ammonium nitrate, detonators, timers and weapons from one room, and 2,563 kg of suspected explosives from another hideout in Fatehpur Taga. The recovery triggered a sweeping crackdown in Faridabad, including searches at Al-Falah University, where Muzammil had been working for the past three-and-a-half years.

By this stage, Dr Umar Un Nabi had already gone underground. J&K Police searched for him in Pulwama but found he had fled. Investigators believe that, knowing Muzammil, Adil and Shaheen were all in custody and that the Faridabad cache had been discovered, Umar concluded that his arrest was imminent.

On 10 November, he left Faridabad at 7 AM, entered Delhi via the Badarpur toll at 8:13 AM, refuelled shortly after, and parked near the Red Fort around 3 PM. He waited there for over three hours. At 6:52 PM, the explosion tore through the area.

Investigators believe this was a panic-driven fidayeen detonation, an attack executed after Umar realised the module had collapsed and the window for carrying out a larger, coordinated operation had closed.

What Do Investigators Believe Was The Larger Plan?

The network, sources say, had aimed to create a series of coordinated attacks resembling the 26/11 model. Material recovered in Faridabad suggests preparation for multiple blasts. Recce images of Delhi landmarks, foreign funding trails and instructions from Telegram channels strengthen the suspicion of a larger conspiracy.

The module’s defining characteristic, investigators argue, was its composition: young doctors, university associates and professionals — people with no traditional markers of extremist activity. This “white-collar terrorism" was designed to avoid detection and embed high-trust networks within professional spaces.

What Happens Next?

With the case handed over to the NIA, investigators are examining further links, including foreign travel, digital money trails and additional handlers. More doctors may be questioned.

The full scale of the conspiracy is still emerging, but for now, agencies believe they have prevented a far larger plot from unfolding.

Karishma Jain

Karishma Jain, Chief Sub Editor at News18.com, writes and edits opinion pieces on a variety of subjects, including Indian politics and policy, culture and the arts, technology and social change. Follow her @kar...Read More

Karishma Jain, Chief Sub Editor at News18.com, writes and edits opinion pieces on a variety of subjects, including Indian politics and policy, culture and the arts, technology and social change. Follow her @kar...

Read More

News explainers Red Fort Blast: Tracing The Origins, Spread And Structure Of A White-Collar Terror Network

Read More