Major Update: Red Fort Car Blast Investigation

22

Major Update: Red Fort Car Blast Investigation

A powerful car explosion near Delhi’s Red Fort on the evening of November 10, 2025, has been officially declared a “heinous terror incident” by the Indian government. The blast, which occurred in a slow-moving Hyundai i20 car, resulted in the tragic loss of at least 13 lives and injured more than 20 others.

The investigation, led by the National Investigation Agency (NIA), has uncovered a sprawling terror network and a chilling plot for a wider campaign of attacks.

Key Developments and Latest Updates

• Terror Module Uncovered and Arrests: The explosion occurred hours after an “interstate and transnational terror module” was busted, leading to the seizure of nearly 3,000 kg of explosives (including ammonium nitrate and traces of RDX) and the arrest of several individuals, including Kashmiri doctors working in the NCR.
• The Suspect: DNA analysis confirmed that the man behind the wheel of the explosive-laden car was Dr. Umar Un Nabi, a Pulwama-based doctor allegedly linked to the terror module. Initial findings suggest the device may have been triggered prematurely, possibly due to panic following the prior arrests.
• Wider Conspiracy: Investigators have uncovered a sinister blueprint involving a fleet of vehicles (including an i20, a Ford EcoSport, and a Maruti Brezza) meant to move explosives and be converted into car bombs for coordinated strikes in multiple cities. Notes recovered suggest plans to rig up to 32 vehicles.
• Government Response: Prime Minister Narendra Modi’s cabinet condemned the act and vowed a policy of “zero tolerance towards terrorism.” Authorities have been directed to pursue the investigation “with the utmost urgency” to bring all perpetrators, collaborators, and sponsors to justice.
• Security & Debris Clearing: Security has been heightened across Delhi and other major cities. Cranes and police personnel have been deployed to clear the debris and continue the forensic investigation at the Red Fort site.
• International Reaction: The incident has drawn condemnation from multiple countries, with embassies, including the US and Russian, issuing security alerts and expressing solidarity.

The focus of the investigation remains on identifying the full scope of the network and their foreign handlers. Officials are currently probing links to groups like Jaish-e-Mohammad (JeM) and an ISIS affiliate operating in Kashmir.

Suspects and The ‘White-Collar’ Terror Module

The core of the conspiracy appears to revolve around a sophisticated, inter-state network dubbed a “white-collar terror module,” with several key members being highly educated professionals.

Name (Alias)	Role/Designation	Key Involvement & Status
Dr. Umar Un Nabi	Prime Suspect/Suicide Bomber	Confirmed to be the driver and lone occupant of the explosive-laden Hyundai i20. DNA tests matched his remains with samples from his family in Pulwama. He was an assistant professor at Al-Falah University, Faridabad. Investigators believe he panicked after his associates were arrested and either prematurely triggered the blast or was trying to dispose of the car.
Dr. Muzammil Ahmad Ganaie (Musaib)	Arrested Associate/Key Conspirator	Arrested before the blast. A doctor and faculty member at Al-Falah University. His rented house in Faridabad was the primary storage location for the massive explosives cache. He and Umar Nabi were found to have traveled to Turkey, where handlers are suspected to be operating.
Dr. Shaheen Shahid Ansari	Arrested Associate/JeM Link	A doctor from Lucknow also associated with Al-Falah University. She was arrested for her alleged role in the module. She is suspected of being tasked with setting up the women’s wing of Jaish-e-Mohammed (JeM), called Jamaat-ul-Mominaat.
Dr. Adil Ahmad Rather	Arrested Associate	Arrested earlier in Saharanpur, UP. His interrogation led police to the explosives cache in Faridabad. An AK-47 rifle was recovered from his locker at a medical college in Anantnag.
Other Detainees	Medical Professionals/Students/Clerics	Multiple other individuals, including a medical college professor, a medical student from J&K, and a cleric, have been detained for questioning, suggesting the network was broad.

The Massive Explosives Haul

The most alarming update is the sheer volume of explosive material recovered, which strongly suggests a plan for coordinated, large-scale attacks far exceeding the Red Fort blast.

• Total Explosives Recovered: Approximately 2,900 kg (nearly 3 metric tons) of Improvised Explosive Device (IED) making material.
• Location: The cache was recovered from two different rented houses in Faridabad, Haryana, allegedly linked to Dr. Muzammil Ahmad Ganaie.
• Key Materials Recovered:
  • Suspected Ammonium Nitrate and other chemicals for IEDs (including potassium chlorate and sulfur).
  • 360 kg of suspected Ammonium Nitrate was specifically mentioned in initial reports.
  • 20 Timers with batteries
  • 24 Remote Controls
  • 5 kg of heavy metal
  • Walkie-talkie sets
• Weapons Seized: One assault rifle, one pistol, multiple magazines, and live rounds.

Investigators believe the blast at the Red Fort was an act of panic or desperation by Dr. Umar Un Nabi, who slipped away with some explosives after his associates were arrested and their main hideout busted, thus potentially averting a much larger, coordinated terror conspiracy involving multiple attacks in several cities.

International Links and Handlers

The investigation has traced the plot’s origins and direction back to handlers operating from overseas, particularly Turkiye and Afghanistan, highlighting the transnational nature of the “white-collar” terror module.

The Turkiye Connection: “Ukasa”

• The Handler: A key handler, codenamed “Ukasa,” based in Turkiye (Turkey), is suspected of being the primary conduit between the Delhi-based doctors and the leaders of terror outfits like Jaish-e-Muhammed (JeM) and Ansar Ghazwat-ul-Hind (AGuH).
• Plot’s Origin: The conspiracy is believed to have been hatched as early as 2022 during a trip by Dr. Umar Un Nabi and three other associates to Ankara, Turkiye, where they allegedly received ideological and operational training.
• Coordination: Ukasa reportedly guided them on establishing covert cells and using encrypted communication apps like Signal and Threema to avoid detection, shifting from initial communications on Telegram.
• The Blueprint: Ukasa is suspected of instructing the module on the plan to carry out a “spectacular” series of attacks involving multiple Vehicle-Borne IEDs (VBIEDs) followed by armed strikes.

Jaish-e-Muhammed (JeM) and AGuH Links

• Affiliations: The module, primarily comprising medical professionals from Al-Falah University in Faridabad, is strongly linked to the banned terror outfits Jaish-e-Muhammed (JeM) and Ansar Ghazwat-ul-Hind (AGuH) (an offshoot of Al-Qaeda/ISIS).
• Motivation: Initial intelligence suggests the blast was planned by a JeM module seeking revenge for a major counter-terrorism operation (Operation Sindoor) that had recently inflicted extensive damage on the outfit’s headquarters in Pakistan.
• Wider Ambition: The recovered “Room 13 Diaries” and testimony point to a pan-India terror plot with targets in four cities, including Delhi and Ayodhya, where an attack was allegedly planned for late November to coincide with Ram temple events.

Afghanistan and Interpol Red Notice

• One of the alleged masterminds, Dr. Muzaffar Rather, who was closely associated with Dr. Umar Un Nabi and Dr. Muzammil Ganaie, fled India in August and is now believed to be sheltering in Nangarhar, Afghanistan.
• The police have sought an Interpol Red Corner Notice for his arrest.

Timeline of the Blast and Investigation

The investigation timeline shows how the timely bust of the terror module led to the desperate, premature execution of the Red Fort blast.

Date	Time (IST)	Event	Significance
Nov 9 (Sun)	Evening	Dr. Umar Un Nabi leaves the Faridabad area after his main associates (like Dr. Muzammil Ganaie) are arrested and the massive explosives cache is seized. He starts driving the IED-laden Hyundai i20.	The Panic Phase: Umar goes underground and hits the road, possibly trying to dispose of the VBIED or execute a lone-wolf attack.
Nov 10 (Mon)	~8:00 AM	The Hyundai i20 (with Haryana registration) is captured on CCTV entering Delhi through the Badarpur border.	The terrorist vehicle is now inside the National Capital.
Nov 10 (Mon)	~2:30 PM	The i20 is seen circling Connaught Place, a busy commercial hub, suggesting reconnaissance for a high-value target.	Indicates final selection and scoping of the target area.
Nov 10 (Mon)	~3:15 PM	The i20 parks near the Sunehri Masjid lot close to Chandni Chowk and remains stationary for nearly three hours.	Investigators believe Umar stayed inside, possibly receiving final instructions via encrypted channels like Threema or Signal.
Nov 10 (Mon)	6:52 PM	The car explodes near Gate No. 1 of the Red Fort Metro station on Subhash Marg, a crowded traffic area.	The Attack: At least 13 people are killed. The driver, Dr. Umar Un Nabi, is killed instantly.
Nov 11 (Tue)	Post-Blast	Home Minister transfers the probe to the National Investigation Agency (NIA); authorities begin collecting over 40 forensic samples, including human remains and explosive residue.	Official confirmation of a terror angle and activation of premier counter-terror agency.
Nov 12 (Wed)	Ongoing	DNA test results confirm the remains inside the car belong to Dr. Umar Un Nabi. Coded diaries from Al-Falah University are recovered, revealing multi-city targets.	Confirmation of the Bomber: Solidifies the link between the blast and the busted terror module.
Nov 13 (Thu)	Ongoing	Police reconstruct Umar’s last 16 hours using CCTV footage, confirming the Turkey handler “Ukasa” and the JeM links. Multiple other terror vehicles (Ford EcoSport, Maruti Brezza) are recovered.	Full Scope Uncovered: Reveals the module was a “terror on wheels” network planning much larger VBIED attacks.

The investigation is actively seeking the cooperation of foreign intelligence agencies to trace Ukasa and Muzaffar Rather.

Enhanced Security Measures in Delhi-NCR

The security response is multi-layered, involving advisories, visible deployment, and stringent checks to neutralize the threat of follow-up VBIED (Vehicle-Borne IED) attacks.

Airports and Air Travel

• Mandatory Early Arrival: The Bureau of Civil Aviation Security (BCAS) has mandated that air travelers report to airports at least three hours before their flight departure.
• Intensive Screening: There is now 100% secondary screening of passengers and their cabin baggage at the boarding gate.
• Vehicle Checks: Intensive checking of vehicles and persons at airport approach points and parking areas.
• Surveillance: Enhanced surveillance of non-scheduled flights, including air ambulances, and strict monitoring of drones, gliders, and hot air balloons in and around Delhi-NCR.

Metro and Railway Stations

• Travel Advisory: Delhi Police has issued an advisory urging passengers to reach:
  • Metro Stations: At least 20 minutes before their scheduled departure.
  • Railway Stations: At least one hour before their train’s scheduled departure.
• Increased Presence: The Central Industrial Security Force (CISF) and the Railway Protection Force (RPF) have placed all major transport hubs, including the Delhi Metro, New Delhi Railway Station, Old Delhi, and Hazrat Nizamuddin, on high alert.
• Patrols & Checks: Intensified foot patrols, deployment of K-9 (dog) squads, and multiple random checks of passengers and luggage at entry/exit gates and platforms are in effect.

Public Places, Borders, and Governance

• Border Vigilance: Security has been strengthened at all inter-state borders (especially with Haryana and Uttar Pradesh) with intensified vehicle checks to intercept any movement of suspicious persons or vehicles (like the other suspected cars the module had planned to use).
• Critical Infrastructure: The CISF has placed heritage sites (like the Red Fort itself), government buildings, and other key installations under high alert.
• Vehicle Verification: Delhi Police is holding meetings with car dealers and market associations to step up measures for stricter vehicle registration and ownership verification procedures, targeting the ease with which the IED-laden car was procured.
• Trade Fair Security: The India International Trade Fair at Bharat Mandapam, which opened on November 14, is operating under a multi-layered security blanket with Quick Reaction Teams (QRTs) and enhanced CCTV surveillance due to the expected high footfall.
• Tenant Verification: Police have initiated drives to verify the details of hotel guests and tenants staying as Paying Guests (PGs), with records of individuals from Jammu and Kashmir in the city being scrutinized closely.

High Alert in Other States

The terror module’s planning for multi-city attacks prompted a high alert across several states:

• Uttar Pradesh (UP): Security has been intensified at sensitive religious sites (like Ayodhya), major railway stations, metro stations, and border areas.
• Maharashtra, Haryana, Bihar, Rajasthan, and Karnataka have also issued statewide alerts, deploying additional forces at crowded public places, markets, and transport terminals.

The overall message to the public is to cooperate with security personnel, report suspicious activity immediately, and allow for extra time for travel due to the mandatory, stringent checks.

NIA Interrogation Reveals New Details in Delhi Blast Plot

The investigation, now officially led by the National Investigation Agency (NIA), has made significant progress, primarily through the custodial interrogation of the arrested suspects, particularly the highly educated members of the “white-collar” terror module from Al-Falah University.

Here are the key takeaways from the ongoing interrogation and forensic analysis:

1. New Target and Date Revealed

The most critical information extracted is the module’s larger, foiled plan.

• Coordinated Attacks: Interrogations of Dr. Muzammil Ganaie and Dr. Shaheen Shahid Ansari revealed that the module was planning coordinated explosions in six cities.
• Target Date: The planned date for the synchronized blasts was allegedly December 6, the anniversary of the Babri Masjid demolition, suggesting a strong communal motive for maximum impact.
• Phases of Operation: The plot was designed in five phases:
  1. Formation of the module (linked to Jaish-e-Mohammad/Ansar Ghazwat-ul-Hind).
  2. Procurement of raw materials (IED components) from Nuh and Gurugram, Haryana.
  3. Manufacturing IEDs and conducting target reconnaissance.
  4. Distribution of bombs among module members in different cities.
  5. Execution of synchronized explosions.

2. Digital Footprint and Communication

Investigators have successfully breached the module’s encrypted communications, shedding light on their operational security.

• Encrypted Apps: The accused primarily used Threema, a paid, highly secure messaging app that does not require a phone number for registration, and Signal for communication, showing a high degree of digital awareness.
• The ‘Drafts’ Trick: The suspects reportedly accessed a common email ID where they saved their highly sensitive operational messages as drafts to avoid leaving a digital trail in their sent folders.
• “Room 13 Diaries”: Coded notebooks and diaries recovered from the suspects’ rented rooms at Al-Falah University, including “Room 13,” contain dates between November 8–12, coded names, and numerical sequences, confirming a planned operation window.

3. Financial and Procurement Network

The focus has shifted to the logistics of procuring the massive cache of explosives.

• Explosive Source: The NIA is probing the sources of the nearly 2,900 kg of IED-making material (suspected to be Ammonium Nitrate and other chemicals).
• New Detentions: A fertilizer seller in Nuh, Haryana, has been detained for allegedly supplying 300 kg of Ammonium Nitrate. While licensed to sell the chemical, the seller failed to verify the purpose of the bulk purchase, pointing to a regulatory failure exploited by the module.
• Money Trail: The Enforcement Directorate (ED) has been roped in to trace the money trail, including alleged hawala links connected to their foreign handlers in Turkiye and Pakistan, to identify how the operation was financed.

4. Al-Falah University Under Scrutiny

The educational institution where most suspects worked or studied is now a focal point of the probe.

• Forensic Audit: The government has ordered a forensic audit of all records, including finances, of the private Al-Falah University in Faridabad.
• Institutional Action: The Association of Indian Universities (AIU) has suspended the university’s membership citing “irregularities,” and its website has been taken offline.
• Staff Interrogation: The Special Cell of Delhi Police is questioning several other faculty members and students from the university who were reportedly close to Dr. Umar Un Nabi and Dr. Muzammil Ganaie.

The NIA’s investigation strongly suggests that the timely arrests of the key conspirators and the seizure of the explosives cache led to the panicked, premature, and less impactful Red Fort car blast.

Status of International Suspects

Handler: “Ukasa” (Location: Ankara, Turkiye)

• Identity and Role: “Ukasa” is confirmed as a codename, likely a cover for the handler who was the direct point of contact for the “white-collar” module members, including the deceased bomber Dr. Umar Un Nabi. Agencies suspect the name is used to conceal a high-ranking member of an overseas terror outfit.
• Location Traced: Investigators have traced Ukasa’s digital footprint to Ankara, Turkiye (Turkey).
• Modus Operandi: Ukasa allegedly directed the module’s movements, finances, and radicalization efforts, primarily using highly encrypted messaging apps like Session (known for its high anonymity) and Signal to avoid surveillance.
• The 2022 Trip: The entire plot is believed to have been hatched after Dr. Umar Un Nabi and three associates traveled to Ankara in March 2022, where they allegedly came into contact with Ukasa and were radicalized and recruited into the network, linking them to Jaish-e-Muhammed (JeM) and Ansar Ghazwat-ul-Hind (AGuH).
• NIA Action: The NIA is currently coordinating with foreign intelligence agencies and counterparts to track Ukasa’s digital and physical movements, establish his true identity, and pursue legal avenues for his apprehension.
• Turkiye’s Official Stance: Turkiye’s Directorate of Communications Centre for Countering Disinformation has strongly denied recent media reports that its territory was used for radicalization activities, stating that the claims are “purely disinformative and lacks any factual basis.”

Fleeing Suspect: Dr. Muzaffar Ahmad Rather (Location: Afghanistan)

• Identity and Role: Dr. Muzaffar Ahmad Rather, a paediatrician and one of the initial masterminds, is the older brother of the arrested Dr. Adil Ahmad Rather and was a close associate of the deceased bomber. He was associated with the Al-Falah University module.
• Fleeing India: Muzaffar is believed to have secretly left India in mid-August (before the arrests and the blast) by first traveling to Dubai and then crossing over to Afghanistan.
• New Role: Intelligence sources believe he was asked to liaise between the terror cell and Afghanistan-based jihadists to receive advanced training on bomb-making and assault techniques.
• NIA Action: The Jammu and Kashmir Police’s State Investigation Agency (SIA) has formally initiated the process to issue an Interpol Red Corner Notice (RCN) against Dr. Muzaffar Rather. An RCN is an international alert seeking the location and provisional arrest of a person pending extradition, surrender, or similar legal action. The central agencies are moving forward with this to secure his arrest via international cooperation.

The focus on these two individuals confirms the extensive international nature of the conspiracy and the sophisticated level of coordination the module had achieved.