The Pahalgam terror attack on April 22 last year was planned by The Resistance Front (TRF)/Lashkar-e-Taiba (LeT) terrorist Sajid Saifullah Jatt alias Langda, who shared the Baisaran grassland coordinates with the attackers; One of the terrorists involved was also part of a terrorist attack on the Srinagar-Leh highway in October 2024; And the three terrorists involved had lunch sitting outside in a grassland before launching their attack and then opened fire in celebration.
These details are part of the National Investigation Agency (NIA) charge sheet, which also provides evidence of Pakistan’s involvement in the attack that killed 25 tourists and a pony operator by tracing the IP addresses of social media accounts and purchase details of two phones recovered from the attackers. The charge sheet, filed on December 15 last year, but the details of which are yet to emerge, also gives a sequence of events leading up to the attack. HT has reviewed a copy of the charge sheet.
Read this also One year of Operation Sindoor: How India paralyzed terror to avenge the Pahalgam killings
The agency has named seven accused: Sajid Jatt, based in Kasur, Pakistan; The three attackers – Faisal Jatt alias Suleman, Habib Tahir alias Jibran Bhai and Hamza Afghani (all three were killed in an encounter with security forces on July 28, 2025); Locals Bashir Ahmed Jothatad and Parvez Ahmed; And Lashkar/TRF in the charge sheet. He has been charged with murder and waging war against India and relevant sections of the Arms Act and Unlawful Activities Prevention Act (UAPA).
According to the charge sheet, Faisal Jatt, who is believed to be at large in Pakistan, had shared the coordinates of the Grassroots attack with the three attackers on April 15.
According to the charge sheet, data obtained from two phones recovered from the terrorists revealed that “in chats with Sajid Jatt, they were given directions… and screen shots of the Alpine Quest app showed coordinates of places near Baisaran Park”. Based on data from the Indian branch of phone maker Xiaomi, the NIA said both the phones were sold in Pakistan.
Read this also Massacre, Hunt, Eliminate: 93-day operation to track Pahalgam attackers with links to Pakistan
On April 21, the three arrived outside Parvez Ahmed’s dhok (hut), about a kilometer away from the grassland. Ahmed was arrested on June 22 last year along with Jothtad, a pony operator, and his maternal uncle. It was Jothatad who first encountered the trio on April 21 around 4 pm. According to the charge sheet, they demanded a safe place and food in the name of Allah. He recognized them for who they were, and let them into the hut. Ahmed, his wife Tahira and their newborn child were present. All three asked to hide their weapons, and asked for food; While eating, he inquired from the uncle and nephew about the upcoming Amarnath Yatra, security forces camps nearby and their activities. According to the charge sheet, he also talked to the Jat. The terrorists took shelter in the hut for about five hours and left around 10 pm after getting some rotis made from Tahira and taking some spices, two blankets, tarpaulin and a cooking vessel. Before leaving, he gave Ahmed ₹3,000.
The charge sheet states that Jothatad and Ahmed saw the terrorists the next morning (April 22) when they reached Baisaran Park for work. The trio were sitting outside the fence, but the uncle and nephew did not think to warn security forces, tourists or even their fellow pony handlers. The NIA charge sheet said that before entering the park, the terrorists sat under a tree and had lunch. After some time, he took out the blanket from his bag and covered it over himself. The charge sheet said two of the three terrorists walked towards the place where a drain entered Baisaran Park and sat there to observe the activities inside.
They then launched their attack at 2.23 pm.
Faisal Jatt carried an M4 carbine and wore a GoPro camera around his head; Two of them, Tahir and Afghani (AK-47), went straight towards the main entrance of the park along the toilets, while Faisal Jatt went towards the end of the zipline. According to the charge sheet, the trio “systematically verified the religious identity of the victims before killing them”.
It said, “Victims who could not recite the Kalma or who disclosed that they were not Muslims were shot at close range. Throughout this sequence, the attackers asked the victims to ‘Say Modi’, making it clear that the attack was aimed at sending a message to the elected government of India, revealing the ideological intent behind the act.”
Read this also One year anniversary of Pahalgam terror attack, stream of people paying tribute: ‘We are united’
According to the charge sheet, coordinated attacks from the axis of the zipline in the south and the main gate/dhabas in the north created “an enclosed killing zone in the central meadow”, aimed at maximizing civilian casualties. All three did not spare anyone.
The NIA writes that while escaping, the terrorists encountered three civilians hiding behind trees outside the fence and shot them at close range. The agency said they also fired celebratory shots while leaving.
The NIA quoted the testimony of a protected witness (identity is kept secret in such cases) as saying that on April 21, this witness had seen Jothath signaling to three persons near Ahmed’s dhok and later going inside.
Pakistan’s hand
The NIA chargesheet said the investigation had “conclusively established that the Pahalgam (Baisaran) terror attack was planned, directed and controlled from Pakistan”. It said the banned terrorist organization Lashkar-e-Taiba (LeT) and its proxy The Resistance Front (TRF) “planned the entire conspiracy through Pakistani handler Sajid Jatt, who coordinated terrorist movement, targeting, drone drops, arms supply and communication using phones of Pakistan origin”.
“The hierarchical command structure, cross-border encrypted coordination, weapons logistics, and handler-driven tasking, as depicted in the charge sheet and confirmed by physical evidence, leave no doubt that the attack was a Pakistan-sponsored terrorist operation, carried out by LeT/TRF,” it adds.
This shows that soon after the Pahalgam attack, at 16.32 hrs, the Mastodon handle @KashmirFight, widely believed to be associated with TRF, posted a statement claiming responsibility. On 25 April, as the UN Security Council issued a statement condemning the attack and international pressure on Pakistan increased, TRF launched a Telegram bot to automate the dissemination of updates and propaganda material, claiming that attribution of the attack was false, hasty and part of a planned campaign to discredit the Kashmiri resistance.
Read this also ‘Dot, Dot, Dot’: Rajnath Singh’s secret warning to Pakistan one year after Pahalgam attack
“Both the claim and denial have come from Pakistan-based social media handles and have been verified through technical analysis,” the NIA said in the charge sheet. While the IP address of the social media account claiming the attack was found in Battarwala in Khyber Pakhtunkhwa, the denial came from an IP address found in Rawalpindi. Some of the Facebook accounts and phone numbers used to share images of the attack were also found to be from Rawalpindi and Bhawalpur in Pakistan.
General link with the attack of October 20, 2024
Before the Pahalgam attack, the TRF was involved in several attacks on civilians in Jammu and Kashmir. One such attack took place on October 20, 2024, when two unidentified terrorists entered the camp of APCO, a construction company engaged in the Z-turn tunnel project, at Jagangir in Ganderbal district on the Srinagar-Leh highway, killing seven APCO employees. One terrorist was later killed and identified as Junaid Ahmed Bhat. Pictures from a GoPro camera were recovered from his mobile. This GoPro camera was recovered from Dachigam forest after an encounter with terrorists on July 28, 2025. One of the terrorists seen in CCTV footage at APCO was identified as Faisal Jatt; He was killed in Dachigam. The M4 carbine weapon used to kill workers at the APCO site was also used in Baisaran. “Thus, in both the APCO attack and the Pahalgam attack, one terrorist, one rifle (M4 carbine) and one GoPro camera were common. Faisal Jatt alias Suleman was the common terrorist with M4 carbine and GoPro camera,” the charge sheet said. “This proves that the same Pakistani terrorist module was involved in both the attacks.”
further testing
The NIA said it is still investigating the terror attack and is awaiting response from some countries to uncover financial clues related to the drone drop of cash, narco and weapons at the behest of LeT/TRF and Sajid Jatt. Additionally, it is trying to uncover the digital trail of the networks used by terrorists belonging to LeT/TRF, identify overground workers (associates) who were in contact with Sajid Jatt, and uncover links between the attackers and terrorist organizations such as Jaish-e-Mohammed (JeM), Al Qaeda and its affiliates, Hamas and other global terrorist groups.
To complete its investigation, the NIA examined 1,113 witnesses, including 543 dhok residents, pony vendors, animal owners, photographers, dhaba workers, taxi drivers, shopkeepers and others.
The terrorist attack brought India and Pakistan to the brink of full-scale war. India launched Operation Sindoor on the morning of 7 May and attacked terrorist and military installations in Pakistan and Pakistan-occupied Kashmir (PoK) ahead of the ceasefire on 10 May.
