Recce, help from locals, final lunch: How terrorists executed Pahalgam carnage

The chargesheet accessed by India Today TV has revealed chilling details of the Pahalgam terror attack last year in which 26 innocent tourists were killed and several others injured. Officials said the victims had come to Pahalgam merely as tourists when they were targeted in a coordinated terror strike allegedly carried out by The Resistance Front (TRF), an offshoot of Lashkar-e-Taiba (LeT).

Soon after the attack, TRF claimed responsibility, but later retracted its statement, calling it part of a "false narrative".

The investigation was initially handed over by Jammu and Kashmir Police to Anantnag Additional SP Ghulam Hassan. During the probe, police identified three attackers: Faisal Jatt alias Suleman, Habeeb Tahir alias Chottu and Hamza Afghani. As the investigation widened, another name emerged as the alleged mastermind of the attack: Sajid Jatt alias Ali Bhai.

The injured were rushed to hospitals while police and forensic teams reached the crime scene soon after the attack. Statements of victims' families and eyewitnesses were also recorded.

NIA TAKES OVER PROBE

Seven days later, the probe was transferred from Jammu and Kashmir Police to the National Investigation Agency (NIA). After taking over the case, the NIA examined the entire investigation file in detail, including postmortem reports, medical records of the injured, seized evidence, sketch maps and findings gathered so far.

The investigating officer also held discussions with the SHO of Pahalgam police station and officers involved in the initial probe to reconstruct every aspect of the attack.

The NIA team later visited Baisaran Park. Vehicles could travel only up to the tourist huts, after which the route continued through muddy mountain tracks because of recent rainfall. Officials found fresh tyre marks, horse hoof impressions and footprints in the area.

The agency examined the crime scene and compared it with the existing sketch map. Officials also inspected the route through which the terrorists were believed to have entered. According to the chargesheet, the structure of the park allowed clear visibility of the central ground from all directions.

The NIA observed that Baisaran Park was located in a remote area without CCTV cameras and with no direct road connectivity. A large-scale grid search operation was conducted there on April 30 involving the NIA, forensic teams, security forces and anti-sabotage squads.

The Central Bureau of Investigation (CBI) later carried out 3D mapping of the location and submitted its report on May 7.

Officials also questioned as many as 1,113 people, including shopkeepers, pony operators, residents living in dhoks and taxi drivers.

WITNESS LEADS OFFICIALS TO HUT

The questioning led investigators to a hut linked to the attackers. An unidentified witness told the NIA that a day before the attack, while returning home, he saw Bashir Ahmad Jothat with three armed men. Bashir allegedly took them to Parvaiz's hut.

The witness further stated that on the morning of May 22, he saw Bashir and Parvaiz again at Baisaran Park. Hours later, news of the terror attack emerged.

The witness also told officials that the three terrorists had stopped him and asked him to recite the kalma. He was allowed to go only after he successfully recited it.

Following this testimony, the NIA conducted multiple raids and recovered additional evidence. Based on witness statements and other materials gathered during the probe, pony operators Bashir Ahmad and Parvaiz Ahmad were arrested on June 22.

WHAT PARVAIZ & BASHIR REVEALED

During interrogation, Parvaiz Ahmad narrated the events of April 21. He told officials that around 5 pm, he was preparing tea with his wife and young son at his dhok when his maternal uncle Bashir Ahmad Jothat arrived suddenly and asked the family to remain silent.

Soon after, Bashir returned with three armed men carrying guns. The men sat inside the hut and asked for water, saying they were exhausted after a long journey.

According to Parvaiz, the terrorists told him that helping those "fighting in the path of Allah" would earn him 'sawab' (reward). He said the men repeatedly spoke about jihad and Kashmir's freedom.

The attackers later drank tea and Parvaiz's wife cooked dinner for them. During the meal, one of the terrorists questioned Parvaiz about the Amarnath Yatra, movement of security forces and deployment patterns in the area.

Parvaiz told officials that the men spoke Urdu with a noticeable Punjabi accent and also conversed among themselves in Punjabi. His wife Tahira reportedly corroborated the same account before investigators.

Bashir Ahmad later told officials that he had encountered the three armed men while heading into the forest to check on his horse a day before the attack. He said the men emerged from behind trees carrying weapons and asked him to take them to a safe place and arrange food.

Bashir said he immediately realised they were 'mujahideen'. The terrorists handed over bags and pouches to be hidden, which Parvaiz concealed beneath blankets. The three men reportedly stayed at the hut for nearly five hours before leaving one by one around 10 pm. Before leaving, the shortest among them allegedly gave Parvaiz Rs 3,000.

Following disclosures made by the two accused, search operations were carried out on June 28 at Bashir Ahmad's dhok, Parvaiz Ahmad's hut and Baisaran Marguza.

However, officials later concluded that both men were withholding information. On July 9, the NIA approached the special court seeking permission for narco-analysis and polygraph tests on the two accused. The plea was, however, rejected on August 29.

HOW THE ATTACK UNFOLDED

According to witness statements cited in the chargesheet, the three terrorists entered Baisaran Park from the Bredangan side carrying weapons. Before entering the park, they sat beneath a tree, ate food and removed blankets from their bags to cover themselves.

Two of them then moved towards the attack site and conducted surveillance of the park from a distance before returning to the third attacker waiting with the bags. They later left their luggage behind and moved towards the park.

Two terrorists headed towards the main gate and nearby dhabas, while the third, described as shorter in height, moved towards the zipline section.

Officials said that the attackers strategically positioned themselves to trap people gathered in the central field from multiple directions. Habeeb Tahir and Hamza Afghani sat near the dhabas pretending to be civilians, while one stayed hidden with a weapon to maintain surveillance.

Suleman positioned himself near the zipline area, where cartridge cases were later recovered.

Witnesses told investigators that the terrorists first questioned people about their religion. Victims were allegedly asked whether they were Hindu or Muslim and several were ordered to recite the kalma. Those unable to recite it, or who identified themselves as non-Muslims, were allegedly shot at close range.

During the attack, the terrorists repeatedly shouted "Modi ko bolo" [tell Modi], which officials described as a message directed at the government.

At 2.23 pm, investigators said, Suleman fired the first shot from the zipline section using an M-4 carbine. Moments later, the other two attackers opened fire with AK-47 rifles. Gunfire from both sides turned the central ground into what the chargesheet described as a "death zone" as tourists ran for cover amid continuous firing.

The terrorists later intercepted the same witness while fleeing and again forced him to recite the kalma before letting him go.

Officials later recovered four additional empty cartridges from the route used by the terrorists while escaping the park. According to agencies, the firing appeared to have been celebratory in nature, indicating the attackers showed no remorse after the killings.

DIGITAL TRAIL REACHES PAKISTAN

Hours after the Pahalgam attack, a social media post appeared from a handle called "Kashmir Fight", containing messages about targetting non-locals. During digital tracking, officials found several leads pointing towards Pakistan.

The probe also uncovered a Telegram channel named "Justice League of India", where Khalistani, extremist and violence-inciting content was allegedly being circulated. Officials said the accounts operating the channel were linked to the same online ecosystem connected to "Kashmir Fight".

Immediately after the attack, TRF claimed responsibility. However, the narrative changed after the United Nations Security Council condemned the Pahalgam killings.

On the same day, TRF issued another statement through its Telegram channel "The Resistance Front Official", distancing itself from the attack and calling it a "false flag" operation. The group claimed its Telegram channel had been hacked and the earlier message was fake.

The statement also questioned the FIR timing, police action and the investigation. TRF additionally referred to earlier terror incidents such as Chittisinghpora 2000, the 2001 Parliament attack and the 26/11 Mumbai attacks.

However, officials said that digital evidence told a different story. Both the original claim and the later denial were allegedly posted through Pakistan-linked digital networks.

Agencies traced the IP address used during the operation to Pakistan's Punjab region. Investigators also found that online activity linked to "Kashmir Fight" led to IP addresses associated with CMPak Limited in Khyber Pakhtunkhwa.

According to the chargesheet, Pakistan attempted to shape an international narrative by projecting the attack as a "false flag" operation.

Phone data recovered from the slain terrorists, eyewitness accounts and technical evidence suggested that the operation involved not only ground attackers but also an organised online propaganda network.

The evidence also helped investigators identify Sajid Saifullah Jatt alias Ali Bhai, believed to be based in Pakistan, as the alleged mastermind of the attack.

OPERATION MAHADEV

On July 28, security forces engaged in an encounter with terrorists in the Mahadev Hills area of Srinagar. A case was registered at Harwan police station after information was received that three unidentified armed terrorists had attacked security personnel.

All three terrorists were killed in the encounter.

Since three attackers had also been involved in the earlier Baisaran massacre, intelligence agencies began cross-verifying identities. The NIA conducted identification exercises using eyewitnesses as well as statements from Bashir and Parvaiz.

Officials confirmed that the slain terrorists were indeed Faisal Jatt alias Suleman, Habeeb Tahir alias Chottu and Hamza Afghani — the same men accused of carrying out the Pahalgam attack.

Security forces recovered two AK-47 rifles and one M-4 carbine from the terrorists. Officials said these were the same weapons used in the Pahalgam killings.

The NIA further found that the trio had also been linked to multiple earlier terror attacks.

On December 21, 2023, terrorists attacked an Army convoy in Poonch district, killing five soldiers. On May 4, 2024, an Air Force convoy was ambushed in the Shahsitar-Sanai area of Poonch, killing one personnel. On June 9, gunmen opened fire on a bus carrying pilgrims returning from Shiv Khori in Reasi district -- the same day Prime Minister Narendra Modi was taking oath.

Lashkar-e-Taiba/TRF had claimed responsibility for that attack as well.

According to the NIA, all these attacks followed a similar pattern involving reconnaissance, ambush-style assaults and subsequent online propaganda or responsibility claims through social media networks.

PAK CONSPIRACY ANGLE

According to NIA, te mobile data recovered during the Mahadev encounter exposed links between the Pahalgam attack and earlier terror operations.

Data recovered from the phone of slain terrorist Junaid Bhat revealed that he and his associates were present in the Poonch-Rajouri belt till July 2024 before crossing the Pir Panjal range into the Kashmir Valley.

Two mobile phones recovered from the terrorists contained photographs, chats and location screenshots. According to officials, Sajid Jatt alias Ali Bhai, identified as a Lashkar-e-Taiba commander based in Pakistan, was directing the attackers through chats and encrypted communication channels.

Investigators also recovered screenshots from the Alpine Quest application showing marked locations around Baisaran Park. The screenshots were dated April 15 and 16, 2025, and were allegedly sent by the terrorists to Sajid Jatt.

The marked coordinates were close to Baisaran Park, suggesting that planning for the attack had begun at least by April 15.

The probe further revealed that both Redmi phones recovered from the terrorists had been purchased in Pakistan. One device was reportedly supplied in Lahore's Quaid-e-Azam Industrial Estate, Kot Lakhpat area, while the other was delivered in Karachi's Shahrah-e-Faisal locality.

Officials concluded that the entire conspiracy behind the Pahalgam terror attack had been orchestrated from Pakistan.

According to evidence placed before the court, Pakistan-based Lashkar-e-Taiba and its proxy organisation TRF planned the attack, including movement of terrorists, target selection, drone-based delivery of supplies, weapons logistics and operational coordination.

BALLISTIC MATCH WITH EARLIER ATTACK

A forensic examination also established a link between the Pahalgam attack and the October 20, 2024 terror strike at the APCO camp in Gagangir.

Ballistic analysis confirmed that cartridges recovered from both locations had been fired from the same M-4 carbine, which was later recovered during Operation Mahadev.

Officials said this established that the same Pakistan-backed terror module was behind both attacks. The probe also confirmed that Faisal Jatt alias Suleman, accused in the Gagangir attack, had also participated in the Pahalgam massacre.

Based on digital forensic evidence, social media records, IP tracking, CCTV footage and ballistic reports, agencies concluded that the Pahalgam attack had been executed by the Pakistan-backed Lashkar-e-Taiba/TRF network.

The NIA named six accused in the case: pony operators Parvaiz Ahmad and Bashir Ahmad, who remain in custody; the three terrorists killed during Operation Mahadev; and alleged mastermind Sajid Saifullah Jatt.

WHO IS SAJID JATT?

According to investigators, Sajid Jatt, also known as 'Langda' because he allegedly had a prosthetic leg, was already listed among wanted terrorists.

The chargesheet stated that he played a key role in reviving Lashkar-e-Taiba operations in Jammu and Kashmir. He is believed to have infiltrated the region around 2005 and later strengthened TRF in south Kashmir by recruiting young men, overground workers and former militants.

Parvaiz Ahmad and Bashir Ahmad also told officials that they heard the terrorists speaking in Punjabi and referring to "Sajid Jatt Bhai".

NIA alleged that Sajid Jatt operated from Pakistan through encrypted networks, directing the terrorists about routes, locations, drone drops and movement patterns while the three attackers on the ground carried out the operation according to his instructions.

- Ends