Pakistan Backed Winter Threats Against India Amid Renewed JeM and LeT Activity
Source: IN
Executive Summary
Recent open source reporting indicates a high risk of Pakistan based and Pakistan backed terrorist activity against India in late 2025, centered on Lashkar e Taiba and Jaish e Mohammed efforts to retaliate for India’s Operation Sindoor and to rebuild infrastructure, funding, and networks after earlier setbacks. Intelligence leaks and media accounts describe a mix of classic infiltration through Jammu and Kashmir, white collar sleeper cells around Delhi and the National Capital Region, and digital fundraising and regrouping on Pakistani soil, all of which increase the likelihood of further attacks against major Indian cities in the near term and raise escalation risks between India and Pakistan.
Analysis
Open source reporting suggests that Pakistan based groups aligned with elements of the Pakistani security establishment are likely preparing a winter campaign that combines cross border infiltrations with urban attacks in India, including possible fidayeen raids and drone enabled strikes against security forces and symbolic targets in Delhi, Mumbai, and other cities. These efforts appear designed both to avenge losses from Operation Sindoor and to demonstrate that India’s offensive has not degraded the capacity of LeT and JeM to threaten the Indian mainland.
Indian media, citing intelligence sources, report a “critical warning” of a “long winter of terror,” with LeT and JeM units reactivating sleeper cells after October meetings in Kotli in Pakistan occupied Kashmir that allegedly included ISI officers, Jamaat e Islami figures, Hizbul Mujahideen members, and former commanders on Pakistani stipends. The same reporting highlights renewed reconnaissance along the Line of Control, drone and aerial weapon drops, rising infiltration attempts since September, and the restart of about 15 terror camps in PoK to support operations.
The Zee News account states that Northern Command intelligence now tracks 131 active terrorists in Jammu and Kashmir, up from 59 Pakistani militants earlier in 2025, with 122 current actors believed to be Pakistani nationals and only 9 locals, and notes that while local recruitment is officially at “zero,” Pakistan backed groups and their fronts such as TRF and PAFF continue to insert foreign fighters with sophisticated weapons.
The same reporting describes the uncovering of a white collar module and links to the 10 November Delhi blast, with highly educated recruits including professionals allegedly radicalized and tasked as suicide attackers or covert operatives, suggesting a shift from visible local gunmen in Kashmir toward embedded, low profile networks in urban India.
These indicators, taken together, point to a deliberate strategy to offset the loss of local militant manpower in the Kashmir Valley by importing Pakistani fighters and cultivating educated urban supporters who are harder to detect, consistent with broader patterns of homegrown and externally enabled violent extremism that focus on small, capable cells instead of large underground organizations. Earlier jihadist propaganda, including ISIS media, has at times used seasonal or “campaign” language and highlighted drones, fortified winter positions, and multi theater attacks, which may influence other groups’ messaging and planning.
At the same time, detailed analysis of the Red Fort car bombing and linked plots suggests that Jaish e Mohammed, with at least tacit support from parts of the Pakistani state, has rebuilt infrastructure, funding mechanisms, and geographic depth since Operation Sindoor, creating conditions for further high impact attacks on Indian soil and feeding a cycle of accusation and retaliation between two nuclear armed states.
A Middle East Forum observer piece argues that the 10 November 2025 Red Fort bombing, which killed at least a dozen people and injured dozens more, was carried out by a Jaish e Mohammed linked cell in Faridabad that functioned as a professional “white collar” ecosystem, reportedly centered on doctors and other medical staff radicalized around Al Falah University and handled by Pakistan based coordinators using encrypted communications and occasional overseas meetings.
The same account and other media reporting say the Red Fort attack fits into a longer arc that began with an April 22 Pahalgam massacre of non Muslim tourists, India’s retaliatory Operation Sindoor strikes on nine terror infrastructure sites in Pakistan and PoK that allegedly killed over 100 militants, and Pakistan’s response. This response reportedly included a government “Shuhada Package” that compensated not just civilians but families of killed militants, state supported rebuilding of sites hit by Indian airstrikes, and overt security and political support to Jaish e Mohammed gatherings in Khyber Pakhtunkhwa.
Open source intelligence further describes a Jaish e Mohammed digital fundraising drive of about 14 million dollars via EasyPaisa and SadaPay wallets, controlled by associates of Masood Azhar, to build 313 markaz that function as safe houses, training centers, and logistical hubs, alongside a strategic relocation of core operations from PoK to Khyber Pakhtunkhwa, with local police protection and participation by Jamiat Ulema e Islam figures at rallies such as the mid September recruitment event in Mansehra.
A strategic intelligence report on regional bombings notes that India is publicly cautious about directly naming Pakistan for the Red Fort blast while its National Investigation Agency pursues arrests linked to earlier seizures of explosives in Haryana and Uttar Pradesh, yet the political pressure for some form of visible response could grow if cross border links are formally established, especially given the memory of India’s strikes in May 2025 and the mediated ceasefire that followed.
These developments occur alongside major attacks in Pakistan itself and rising three way tensions involving Afghanistan. The same strategic report recounts a vehicle bomb and suicide assault on a cadet college in Wana in South Waziristan on 10 November, and a suicide blast near a police van outside an Islamabad court on 11 November. Pakistani authorities attribute the Wana attack to the Tehreek e Taliban Pakistan and say the Islamabad bomber was an Afghan tied to a TTP faction, while public rhetoric reframes such violence as the work of Indian backed proxies labeled “Fitna al Khwarij” and “Fitna al Hindustan.” India rejects those claims and continues to highlight Pakistan’s own history of support to militant groups, and the Afghan Taliban refuses to accept responsibility for TTP safe havens, arguing that its territory is being blamed for political reasons.
This contested narrative space complicates any joint effort to disrupt networks that touch all three countries and raises the risk that a fresh large scale attack in India that is credibly linked to Pakistan based handlers could trigger another round of cross border strikes, while Pakistan’s own internal attacks deepen its sense of encirclement and reliance on militant assets for leverage. The reported shift by LeT and JeM toward foreign fighters, winter hardened training, drones, and white collar modules means that even as overt recruitment of Kashmiri youth declines, the operational threat is evolving rather than fading.
