Cross-Border Digital Handlers and White-Collar Module Deepen Complexity of Red Fort Blast Case
Source: India Express
Executive Summary
New open-source reporting indicates that the Red Fort bombing was directed by a network of foreign handlers operating from Afghanistan and Pakistan, including one possibly tied to the ISI. These handlers used encrypted platforms to guide a doctor-led terror module spread between Kashmir, Delhi, and Faridabad. Recent arrests in Srinagar highlight the growing role of educated “white-collar” operatives, supported remotely by cross-border digital safehouses that reduce physical exposure and complicate detection.
Analysis
The Red Fort blast investigation points to a multi-layered cross-border ecosystem that blends Afghan- and Pakistan-based direction with Indian operatives embedded in professional and academic environments. The structure of the network—remote handlers, clerical intermediaries, and highly educated local executors—demonstrates an evolving model calibrated to exploit digital anonymity, compartmentalization, and reduced local recruitment in Kashmir.
Reporting shows one handler, “Dr Ukasha,” is believed to be based in Pachir Wa Agam, Nangarhar province—an area associated with hardened jihadist networks. He and two others, Hashim and Faisal Iqbal Bhat, allegedly sent more than 40 explosive-training videos through Telegram to radicalize and guide a tight-knit module of Kashmiri doctors responsible for assembling the bomb.
Investigators describe Faisal as disciplined, directive, and operationally precise—traits leading to the assessment that he may be an ISI-linked operative. His direction reportedly included task assignments and instructions for establishing secure Telegram channels.
The Kashmir-based cleric Mufti Irfan Ahmad Wagay appears to be the internal lynchpin. He allegedly handled Jaish-e-Mohammed propaganda, facilitated logistics, and linked all conspirators in both Kashmir and Haryana. The poster case in Nowgam helped expose this architecture and ultimately connected investigators to a Faridabad hub where nearly 3,000 kg of explosive precursor material was recovered.
The State Investigation Agency’s arrest of Tufail Niyaz Bhat in Srinagar reflects continuing action against the “white-collar” layer of the module. Earlier arrests of three Nowgam suspects and a cleric-turned-Imam exposed the communication chain leading to Al-Falah University in Faridabad. There, several doctors — including the accused bomber who drove the I-20 — operated clandestine labs and justified the attack in recovered videos.
Together, these findings show a hybrid model: foreign handlers provide ideological and technical direction, clerical nodes in Kashmir facilitate recruitment and logistics, and educated operatives in urban centers execute the attack. This dispersed network reduces visibility, exploits digital anonymity, and complicates attribution—an approach consistent with the broader shift toward covert, professionalized modules seen across India-Pakistan-Afghanistan terror dynamics.
