On the evening of November 10, 2025, when a Hyundai i20 car exploded near the Red Fort Metro Station killing 13 people and injuring more than 20, most of the Delhi residents were left horrified. The blast seemed abrupt, oddly isolated, and out of step with the ordinary rhythms of a weekday commute. What the public did not yet know was that the explosion had occurred only because security officials had spent the morning dismantling a wider network, and one doctor along with his vehicle, had slipped through the security net.
The driver who blew himself up in the blast was Dr. Umar Un Nabi, a medical lecturer at Al- Falah University. Earlier that day, security agencies had conducted coordinated raids across Faridabad, Saharanpur, and Srinagar, targeting a small group of radicalized professionals. By afternoon, the investigators had realized that Umar, whose location had not been confirmed during the raids, was likely in possession of one of the cars that was possibly wired with explosives. The evening blast, while tragic, inadvertently prevented a far wider series of coordinated explosions the group had originally planned.
The first break in the case
The unravelling of the conspiracy did not begin in Delhi or Faridabad but in Srinagar. On October 18, 2025, the J&K Police discovered a set of freshly pasted Jaish-e-Mohammad posters on a wall near the outskirts of the city centre. The posters of Jaish-e-Mohammad were unusual as they carried coded messages and stylized patterns that has not been seen in their earlier propaganda. CCTV footage traced the act to a man wearing a hooded jacket.
Investigation to identify the culprit was meticulously carried out by the SHO Naugam and overseen by IG CID Nitish Kumar and they successfully identified the individual as Dr. Adil Ahmad Rather, a Post Graduate medical professional (Doctor) originally from Qazigund, Anantnag, found working at Famous Medicare hospital at Saharanpur, U.P.
Adil’s arrest occurred quietly. During questioning, investigators found inconsistencies in his explanations and uncovered encrypted communication on his phone. Over a short time, he provided vital information suggesting that the posters were part of a larger signalling mechanism for a coordinated terror operation. The terror operation was supposed to be one of the biggest and the most audacious attack planned across six cities after 26/11 Mumbai terror attacks. Adil’s interrogation further opened a window into a conspiracy that was woven across two years, three countries, and at least four active extremist networks.
University campuses and an unexpected network
Much of the planning took place around Al-Falah University, a private institution in Faridabad, Haryana, where all principal accused shared academic or residential ties. The university, situated about thirty kilometers from Delhi, seemed an unlikely backdrop for a plot of such scale. Former colleagues described the accused doctors as “serious,” “reserved,” and “generally apolitical.”
But investigators found that the group had been communicating with a handler based in Turkey, currently identified only by his codename “Ukasa.” The handler’s role was not merely advisory but was also strategic. In the summer of 2022, Dr. Umar and Dr. Adil along with Dr Muzaffar ( brother of Dr Adil) quietly travelled to Istanbul, ostensibly for academic conferences. The immigration records and hotel logs later confirmed their presence in the city. During this visit, they met ‘Ukasa’ and received instructions on how to form a cell, how to conceal funds, how to recruit without drawing attention, and how to assemble explosives using commercially available materials.
Dr Muzaffar subsequently escaped the country in August this year and is presumed to be in Afghanistan. Upon returning to India, they began building small, compartmentalized circles inside the university. Some of these groups were framed as religious discussion groups, others as informal social gatherings. According to investigators, this environment enabled gradual persuasion without creating visible alarm within the institution.
The house in Dhauj
The safe house in Dhauj village, located a short drive away from the Al Falah university, is said to have served as the main explosive storage site. The building looked like a typical student accommodation, a rented, single-story home with two scooters parked outside. The safe house was rented out by Dr Muzammil. Inside, however, investigators later recovered nearly three tonnes (3000 kgs) of explosive precursors, wiring components, and metal sheets modified to hold blast charges. The setup suggested slow, careful accumulation rather than hurried stockpiling. Lists of materials were written with the same precision as these people trained to outline the structured coursework and laboratory discipline.
Evidence indicated that at least thirty-two vehicles were intended for placement across multiple cities. Surveillance notes earlier seized from the hostel rooms of Dr Umar-un-Nabi and Dr Muzammil show reconnaissance had already been conducted near Red Fort, India Gate, and several transportation hubs in Delhi, as well as Ram Mandir in Ayodhya and other locations in Western Uttar Pradesh. They had further collected names of 2530 people mostly belonging to Jammu and Kashmir and Mewat.
The many hands behind the plot
Though the group operated primarily under the influence of a Turkey-based handler, the ideological and logistical lines stretch further. The messaging patterns, wording, and references of the doctrinal material, directly point consistent with Pakistan based terror organization Jaish-e-Mohammad. Certain communication excerpts clearly point out to the mentorship evidence is directly pointing to individuals located in Pakistan, and few in Afghanistan. Funding streams trace back to Dhaka and Chittagong, and were routed through micro-sized cryptocurrency transfers and through hawala intermediaries. These financial pathways clearly resemble patterns previously identified in Bangladesh-based extremist cells as well.
Encrypted channels, ideological guidance, and tactical instructions after the visit of these doctors to Turkey have been found originating from Istanbul. Turkey served as the group’s primary ideological and operational anchor, replacing, in many ways, the earlier dominance of Pakistan-based leadership models.
ISIS, LeT, JeM, AGUH
A day before the Anti-Terrorist Squad (ATS) had successfully busted a terror module linked to ISIS. The operation had led to the arrest of three suspects including a doctor. Dr Syed Ahmed Mohideen, Suhail, and Azad Saifi. According to the Gujarat ATS, one of the accused ‘had prepared a liquid called ricin, which is highly poisonous, and it was going to be used for mass’ destruction. A significant cache of weapons, including two Glock pistols, a Beretta pistol, and 30 rounds of ammunition, was also seized from the suspects who were intercepted in a car. The investigation has revealed that the terror cell had conducted reconnaissance in Ahmedabad, Lucknow, and Delhi for potential attacks. The arrested individuals are believed to be part of the ISKP module, a branch of ISIS, and were being interrogated to uncover their specific targets and wider network.
Intelligence analysts noted that the rhetoric, logistical methods, and digital style of communication reflected a hybrid ecosystem is at works. Rather than belonging to one organization, the different terror cells appear to draw inspiration, funding models, and operational cues from multiple extremist groups simultaneously. This “interplay” is reflecting as an evolving trend of multiple terror organizations planning consorted attacks with a shared ideological reservoir.
Women in the network
The arrest of Dr. Shaheen Shahid from Lucknow on the 10th of November added a new layer to the investigation. During her interrogation she revealed to the authorities that she coordinated logistics and finance not only for the terror plot but was also serving for the women’s wing of the terror group JeM. She further revealed that she was in direct touch with Sadia who heads the women wing called Jamaat-e-Mominat, and is a close aide of JeM Chief Masood Azhar. She revealed to the security agencies that her role involved storage of materials, transportation of small components, and overseeing funds collected through platforms, in addition to recruiting women in India to carry out further terror acts at the behest of Jaish-e-Mohammad. Dr Shaheen revealed that she raised funds to the tune of Rs. 26 lacs for the busted terror plot.
At her residence, investigators found written notes that referenced tasks with coded labels and phrases that, when explained by her, aligned with procurement steps for explosive materials, fund raising as well as vehicle preparation. In her vehicle an automatic Krinkov rifle with three magazines along with a pistol with live rounds and two empty cartridges were also found.
The morning raids
The arrests of Dr Muzammil from Faridabad and Dr Shaheen from Lucknow occurred without any confrontation. The materials recovered from the safe house of Dr Muzammil and the hostel rooms of Dr Umar and Muzammil provided sufficient evidence of a mass-casualty plot. But one suspect was still missing. When officers checked Dr Umar’s whereabouts, they couldn’t find any. Only later in the day did investigators confirm that one of the vehicles listed in the Dhauj inventory was also unaccounted for.
The evening blast
At approximately 6:52 p.m., the white Hyundai i20 exploded outside Red Fort Metro Station in old Delhi, killing thirteen people and injuring more than twenty. Forensic evidence confirmed that the device that exploded was consistent with the materials recovered earlier.
The premature detonation prevented the wider plot from being executed. Whether Umar intended to detonate the vehicle or was it an accidental detonation remains unclear. His digital trail also ends abruptly the moment he left Faridabad.
The evening blast, tragic in itself, marked the conclusion of a chain of events that could have been far more devastating had these terrorists succeeded in carrying out their intended plot.
The unresolved questions
Much of the investigation now focuses on understanding the motivations of the group. None of the doctors came from marginalized environments. All held stable academic positions. Their families have feigned ignorance and unawareness of their involvement.
Investigators are examining all records to unearth the entire network that has been directly or indirectly involved in this terror plot. Further arrests have been made in the case and efforts to nab the rest are on. The case has challenged a long-standing assumption about how educated professionals engage with extremist ideologies. It highlights the fragility of institutional environments and the ease with which digital networks can bypass traditional modes of detection.
A plot unlike any seen before
India’s security agencies have averted twenty-two major terror plots in the last six months, including ten in the last six weeks alone. But officials repeatedly emphasize that this one stands apart, not only because of its scale, but because of who the planners were.
Over the past several months, India’s security and intelligence agencies have prevented a series of major terror plots spanning at least a dozen states, exposing a fast-evolving threat environment driven by online radicalization, multi-national foreign handlers, and multi-country terror ecosystems. The incidents reflect not only the scale of extremist activity but also the tireless, often under-appreciated work of the security agencies operating under immense pressure.
In Rajasthan, the ATS arrested Maulvi Osama Umar, who had been radicalizing youth online for four years while maintaining contact with a Pakistan based handler. Digital evidence confirmed his foreign links. In Varanasi, police rescued 38 youths after dismantling a fraudulent digital recruitment racket posing as a job network.
In late October, Delhi Police foiled multiple ISIS-linked plots. On October 27, two men associated with the ISIS-inspired “Saut-ul-Ummah” module were arrested with IED-making materials. Days earlier, on October 24, two radicalized youth trained for fidayeen attacks were detained with weapons and explosives.
A major Jaish-e-Mohammed (JeM) module operating across Andhra Pradesh, Uttar Pradesh, and Maharashtra was neutralized on October 13, while on September 30, Uttar Pradesh ATS arrested four individuals attempting to form a “Mujahideen Army” to impose Sharia rule through violent means.
Throughout September, nationwide operations continued as the NIA busted an online ISIS network spanning eight states (September 17). Delhi Police arrested five individuals tied to a Pakistan-backed module spread across five states (September 11) and Punjab Police foiled a JeM-backed attack with arrests in Punjab and J&K (September 2).
Earlier in the year, arrests in Gujarat, Uttar Pradesh, Hyderabad, West Bengal, and near the Nepal border dismantled ISIS, AQIS, JMB, and Pakistan-linked networks involved in recruitment, explosives procurement, and cross-border logistics.
These operations were carried out quietly, relentlessly, and went unnoticed often underscoring the critical role played by India’s security agencies, whose vigilance continues to avert tragedies long before they reach the public eye.
Note: The article is written by Raja Muneeb, independent journalist and geopolitics expert. He can be reached on X at @rajamuneeb.
