Last updated:
The full scale of the conspiracy is still emerging, but for now, agencies believe they have prevented a much larger conspiracy from coming to light
13 people were killed in the blast at the Red Fort. (PTI)
The evening blast near Delhi’s Red Fort on November 10 has exposed a radical white-collar terror module: a network of doctors, a cleric and associates that is active in several Indian cities and linked to the Jaish-e-Mohammed (JeM) and Ansar Ghazwat-ul-Hind (AGUH) terrorist groups.
The suicide attack in which 13 people were killed and more than two dozen were injured was not a random act of violence. This was the result of long-term ideological preparation, encrypted coordination, foreign travel, recruitment drives and ultimately a race against time when members of the module began to be arrested.
Now the National Investigation Agency (NIA), which is investigating the case, is adding how the network was formed and how its members were connected to each other.
Where did the network start and who was behind the radicalization?
According to investigators, the initial threads of the conspiracy can be traced back to October this year, when Jaish-e-Mohammed posters were revealed in Nowgam, Srinagar.
The three youths who pasted the posters were identified in the CCTV footage as Arif Nisar Dar alias Sahil, Yasir-ul-Ashraf and Maqsood Ahmed Dar. Their interrogation pointed the police towards a cleric whose name came up again and again: Irfan Ahmed Wagah, a former paramedical employee at GMC Srinagar who had also served as an imam.
Officials say Wagah and his wife created the ideological basis of the module. He allegedly radicalized medical interns, junior doctors and educated youth through sermons, closed-door sessions and online channels such as Telegram. His messages allegedly promoted extremist narratives and encouraged the creation of “open sleeper cells” using doctors and professionals with clean profiles.
This ideological base is directly linked to two encrypted Telegram groups: Farzandan-e-Darul Uloom, Deoband, and the other run by Jaish-e-Mohammed terrorist Omar bin Khattab in Pakistan.
These groups, accessed through end-to-end encrypted chat, became the meeting places for the module’s operatives. Over time, discussions shifted from grievance-laden rhetoric to directions for movement, recruitment, and reconnaissance.
How did the doctors know each other?
At the heart of the “Doctors’ Module” is the link between three people: Dr. Omar Un Nabi, Dr. Muzammil Ghani and Dr. Adil Ahmed Rather. All three studied or worked at different places in the Government Medical College (GMC) Srinagar and GMC Anantnag, leading to early friendship and professional relations.
Investigators say Umar and Muzammil’s friendship at GMC Srinagar was the first mutual link. They graduated around the same period, later serving as residents before moving to the medical college of Al-Falah University in Faridabad, Haryana.
By this time, they were also in touch with Adil, who had already come up on the intelligence radar after a separate incident: he had taken sudden leave on 26 September, married a fellow doctor on 4 October, and returned to Saharanpur on 27 October after pro-Jaish posters appeared in Srinagar’s Rainawari and Jadibal areas. CCTV footage and mobile data later linked the poster act to Adil.
Over time, another important member joined the circle – Dr. Shaheen Saeed, a doctor from Lucknow, who investigators say had a close personal relationship with Muzammil. According to the agencies, her role was significant: she was allegedly central to the effort to create a women’s wing linked to Jaish-e-Mohammed and was in regular contact with the network of clerics in Kashmir.
Shaheen and another female doctor from Kashmir had completed MBBS from Dhaka Medical College. Both reportedly came into contact with the cleric during their internships in Srinagar hospitals, with investigators now describing this period as a turning point in their ideological transformation.
Foreign travel ties further strengthened these relationships. Omar and Muzammil traveled to Türkiye earlier this year on instructions sent through a Telegram handler. Arrangements for their stay and travel were made abroad, strengthening the suspicion among investigators of direct coordination with Jaish-e-Mohammed-linked facilitators.
Why was Al-Falah University at the center of the conspiracy?
Al-Falah University of Faridabad emerged as the physical command center of the network. Building 17, Room 13, now sealed, was where planning discussions, meetings and data storage reportedly took place. According to the investigating agencies, forensic teams have recovered chemical residues, glass vessels and material which suggests that small batches of the ammonium nitrate mixture were tested in a laboratory inside the complex. The samples have been sent for detailed forensic examination.
The university’s medical college offered anonymity and resources: dorm rooms, laboratory access, and a constant flow of young professionals.
Muzammil lived in Dhauj area of Faridabad, while his associate Haji Ishtiaq had stored more than 2,500 kg of explosive-making chemicals in a nearby house. Investigators say this al-Falah-Dhauj belt formed the operation and storage center of the plot.
From Muzammil’s room alone, officials recovered about 350 kg of ammonium nitrate, detonators, manuals, timers and two automatic pistols. Frightened by Muzammil’s arrest, Shaheen allegedly threw an AK-47 from his car behind the university campus, which was later recovered.
For agencies, this represents both the module’s physical footprint and its concealment tactics. The use of a legitimate medical university helped conceal suspicious activities, frequent visitors, and storage of chemicals.
What did investigators find in the car’s Kashmir trail?
Three people were initially in custody in the case: Tariq Ahmed, Amir Rashid and Omar Rashid. Aamir and Omar (brothers) work locally as plumbers and electricians. Their names emerged when investigators started tracking the movement of the Hyundai i20 used in the Red Fort blast.
sources told cnn-news18 The car, which was originally registered in Gurugram under HR26 and owned by Mohammed Salman, was sold to a buyer in Delhi’s Okhla area last year. Investigators traced the vehicle to Kashmir, where it was purchased by Amir Rasheed.
An important detail identified by the investigators is that when Aamir bought the car, he provided a mobile number registered in the name of Tariq, who is a known driver of his. Aamir was using Tariq’s number, causing both their identities to appear in call records and tower dumps associated with the vehicle. This overlap initially caused confusion, with a widely circulated image of Aamir holding the car keys being incorrectly tagged as “Tariq”.
Police detained Amir, his brother Omar and Tariq to clarify the circumstances of the purchase, verify why Tariq’s number was used, and determine whether any of them knowingly facilitated the transfer of the vehicle before it reached alleged suicide bomber Dr Omar un Nabi. The authorities also interrogated Dr Omar’s mother and two brothers to ascertain his last movements.
How did the network spread across the state?
Authorities believe the spread was deliberate and planned. After returning from Türkiye, Umar and Muzammil were instructed to disperse to different places. Muzammil went to Faridabad; Adil moved to Saharanpur to work in a private hospital; Shaheen shifted to Faridabad; And Maulvi remained active in Kashmir.
Each location has a purpose: Faridabad for logistics and material assembly; parts of Kashmir for recruitment and movement; Saharanpur to create additional operational node; Lucknow for expanding women’s network; And Mewat area for storing huge quantity of explosives through Haji Ishtiaq.
The design of the network was decentralized. Each member had a role – logistics, recruitment, reconnaissance, firearms, finance or propaganda. One of the doctors reportedly received several foreign remittances through digital wallets from Istanbul and Doha between 2023 and 2024, believed to fund his activities.
How did the conspiracy go from preparation to execution?
The first revelation in the case came from Srinagar, where posters of Jaish-e-Mohammed came to light. CCTV footage led police to three overground workers – Arif Nisar Dar, Yasir-ul-Ashraf and Maqsood Ahmed Dar – who are residents of Naugam. His interrogation pointed investigators towards Maulvi Irfan Ahmed in Shopian, whose interrogation became the turning point of the investigation.
From Irfan, the series moved to Dr. Adil Ahmed Rather, who was recently transferred to Saharanpur from GMC Anantnag. Police recovered an AK-series rifle from his locker. Their sustained interrogation revealed the existence of a larger network and led to the detention of Zameer Ahangar from Ganderbal, who was also linked to the Maulvi.
These clues eventually led investigators to Dr. Muzammil Ghani in Faridabad. His two rented rooms, originally owned by the cleric, led to the biggest seizures: about 350 kg of ammonium nitrate, detonators, timers and weapons from one room, and 2,563 kg of suspected explosives from another hideout in Fatehpur Taga. The recovery triggered a massive crackdown in Faridabad, including searches at Al-Falah University, where Muzammil had been working for the last three and a half years.
By this stage, Dr. Omar un Nabi had already gone underground. Jammu and Kashmir Police searched for him in Pulwama but found that he had fled. Investigators believe that, knowing that Muzammil, Adil and Shaheen were all in custody and that the Faridabad cache had been discovered, Omar concluded that his arrest was imminent.
On November 10, he left Faridabad at 7 am, entered Delhi via Badarpur Toll at 8:13 am, refueled shortly after, and parked near the Red Fort at around 3 am. He waited there for more than three hours. At 6:52 pm, the explosion shook the entire area.
Investigators believe it was a panic-induced suicide bombing, an attack carried out after Omar realized the module had collapsed and the window to execute a larger, coordinated operation had closed.
What do investigators believe was the bigger plan?
Sources say the network aimed to carry out a series of coordinated attacks similar to the 26/11 model. The material recovered in Faridabad reveals preparations for several blasts. Receipt photographs of Delhi sites, foreign funding routes and instructions on Telegram channels strengthen the suspicion of a larger conspiracy.
Investigators argue that the defining feature of the module was its composition: young doctors, university associates and professionals – people who had no traditional markers of extremist activity. It was designed to avoid detection and embed high-trust networks within “white-collar terrorism” professional spaces.
what happens next?
With the case handed over to the NIA, investigators are probing other links including foreign travel, digital money trails and additional operators. More doctors may also be interrogated.
The full scale of the conspiracy is still emerging, but for now, the agencies believe they have prevented a much larger conspiracy from coming to light.
Karishma Jain, Deputy Editor in Chief, News18.com, writes and edits opinion pieces on a wide range of topics including Indian politics and policy, culture and arts, technology and social change. Follow him @kar…read more
Karishma Jain, Deputy Editor in Chief, News18.com, writes and edits opinion pieces on a wide range of topics including Indian politics and policy, culture and arts, technology and social change. Follow him @kar… read more
November 13, 2025, 15:13 IST
read more
