In the early evening of 10 November 2025, a white Hyundai i20 halted at a red light near Gate 1 of the historic Red Fort (“Lal Qila”) metro station in New Delhi. Moments later a devastating explosion erupted, killing at least eight people and injuring nearly two dozen. Simultaneously, less than 40 km away in Dhauj village, Faridabad, teams from the Haryana Police and Jammu & Kashmir Police unearthed one of the largest caches of explosive and bomb-making material in recent memory — nearly 2,900 kg of IED-making components, including suspected ammonium nitrate, arms and timers.
Taken together, these incidents point to something far more consequential than isolated terror acts. Intelligence agencies believe they reflect a deeper strategic shift: the Pakistan-based Inter‑Services Intelligence (“ISI”), via proxies such as Jaish‑e‑Mohammed (JeM) and Ansar Ghazwat‑ul‑Hind (AGH), is moving away from conventional cross-border attacks and towards highly compartmentalised, white-collar terror modules embedded inside India.
This article traces that evolution: the sleeper-cell architecture, how “logistics, finance, ideology and operations” are now layered and decentralised, and how the new focus on educated professionals and domestic networks is reshaping India’s security calculus.
—
The Historic Paradigm – Direct Action and Cross-Border Infiltration
To grasp the significance of the current threat environment, it helps to reflect on the previous paradigm of terrorism that dominated India’s security concerns over the past two decades. This older model featured:
Cross-border infiltration from Pakistan’s territory (via the LoC or through Jammu & Kashmir)
Direct command-and-control by proxy organisations like JeM and Lashkar‑e‑Taiba (LeT)
Large-scale attacks such as the 2008 Mumbai attacks, the 2016 Pathankot airbase assault, the 2019 Pulwama bombing and the 2019 Balakot retaliations
Relatively visible logistics chains: infiltration routes, arms smuggling, transit camps, and handlers based abroad
These methods, while lethal, had a fairly recognisable blueprint for Indian agencies. Post the major operations such as the one code-named Operation Sindoor (launched after the 2019 events), major paramilitary and intelligence agencies stepped-up counter-measures across patrols, surveillance, forensics and cross-border intelligence sharing.
However, as the security net tightened, the attackers adapted.
The New Shift: Home-Grown Modules & Plausible Deniability
In recent years, India’s counter-terror apparatus has observed a subtle but marked transition: the locus of terror-planning is shifting from overt external attacks to covert internal networks. Key features of this shift include:
1. Native recruitment, civil-professional cover
A striking feature of the recent Faridabad module is the involvement of medical professionals. Two doctors of Kashmiri origin — one teaching in Faridabad and the other formerly a resident in Jammu & Kashmir — were arrested in connection with a massive explosives haul.
This phenomenon embodies the “white-collar terror” concept: recruiting educated, credentialed citizens who blend into metropolitan society, rather than stereotyped militants. According to one report, one officer said: “No one suspects doctors.”
The implication: instead of the older heavy-footprint infiltration, the modules can function within normal urban life, with less suspicion and greater deniability.
2. Modular sleeper-cell architecture
Investigators describe a four-pronged sleeper-cell framework now being embedded across India:
Logistical Cells: procuring identity documents, SIM cards, vehicles, safe-houses.
Financial Cells: moving away from traditional hawala networks; leveraging charitable trusts, front businesses, multi-country transfers.
Ideological Cells: online propaganda, radicalisation of youth via social media, encrypted platforms.
Operational Cells: recruiting highly skilled individuals (engineers, doctors, graduates) who are “least suspicious” and can execute tasks such as IED manufacture, target planning, and suicide-operations.
This structure is designed for compartmentalisation: individual cells know only their immediate task and not the full hierarchy. If one part is compromised, the remainder remains functional. Intelligence sources claim this is a key design of the new paradigm.
3. Proxy layering and plausible deniability
A core element of the strategy is to give the appearance of decoupling the state-actor (ISI) from the terror outcome. This is achieved by:
Using lesser-known organisations like AGH, which publicly declare an Al-Qaeda-style jihadi narrative.
Having JeM and LeT provide covert logistics, funds and arms, but remaining in the background.
Cultivating domestic cadres who appear “home-grown” rather than imported.
This arrangement allows the ISI to claim “we had no direct involvement” while the operational chain still benefits from its patronage.
4. Focus on soft-targets and symbols
In contrast to major military or high-installations attacks, the emphasis has shifted to symbolic urban targets: places of domestic mobility, tourist sites, soft security zones, or densely-populated civilian zones. The 10 November Red Fort blast is illustrative: a car stopped at a red-light in a crowded Old Delhi zone, adjacent to one of India’s most iconic monuments. The timing, location and mode all point to a strategy of psychological impact as much as physical destruction.
The Faridabad Haul: Evidence of the New Ecosystem
The Dhauj village-based raid in Faridabad offers a graphic case study of how this new terror-ecosystem functions.
Discovery and scale
Police from Haryana and Jammu & Kashmir, acting on leads from posters of JeM and AGH printed in the Nowgam area of Kashmir, cracked the module.
Key findings:
Approximately 2,900 kg of IED-making material (including suspected ammonium nitrate) recovered.
An assault rifle (AK-47/AK-Krinkov), pistols, 83 live rounds, timers, walkie-talkies, remote controls and other bomb-making paraphernalia found at the rented flat.
Two doctors arrested: Dr. Muzammil Ahmad (aka Ganai) working in Faridabad, and Dr. Adil Ahmad Rather from Pulwama.
Additional arrests (up to seven) across multiple states.
Professional cover, altered suspicion dynamics
Multiple sources emphasise that professional individuals — academics, doctors — were chosen because they arouse less suspicion. The claim: “The doctors had treated terrorists; handlers told them no one suspects them.”
By embedding key operatives inside high-trust professions, the network diminishes detectability and blends into routine life.
Regional spread and transnational links
The investigation revealed cross-state movement (Jammu & Kashmir, Haryana, Uttar Pradesh) and overseas funding/handlers from Pakistan and Gulf-countries.
According to the police: “A white-collar terror ecosystem involving radicalised professionals and students in contact with foreign handlers.”
Implications for biological/chemical threat
One of the more alarming concerns: medical professionals naturally have access to sensitive chemicals or clinical infrastructures. While the current operation involved ammonium nitrate-based explosives, analysts warn the same structure could be adapted for chemical, radiological or even biological threats (for example via ricin or other toxins) given the right recruitment and cover.
The Red Fort Blast: A Public Signal
While the Faridabad bust was covert, the blast near the Red Fort in New Delhi presents the flip side: a public, symbolic attack engineered to send a message.
Incident overview
On 10 November 2025 around 6:50 pm, a car stopped at a traffic signal near the Red Fort Metro station was engulfed in a sudden explosion.
At least eight dead, 19 injured in the initial reports; subsequent numbers vary.
The vehicle, a Hyundai i20, is under investigation; CCTV footage is being closely scrutinised.
In response, the National Investigation Agency (NIA) has taken over the probe; the incident has been treated under anti-terror laws (UAPA).
Strategic implications
The location is highly symbolic: a national monument, tourist hub and the site from which the Prime Minister addresses the nation on Independence Day. An attack here has outsized psychological impact.
The timing — close to public peak hours — magnifies the terror effect.
The proximity to the Faridabad module raises suspicions of a linked campaign: one cell builds weapons and logistics behind the scenes, another executes the visible strike. Agencies are intervening on that hypothesis.
State response & alertness
Several states (Uttar Pradesh, Haryana, Rajasthan etc.) issued high alerts, deploying additional checks at religious sites, sensitive districts and transport hubs.
The Home Minister himself reviewed the security posture in Delhi and multiple agencies convened high-level meetings.
Taken together, the two events — Faridabad & Red Fort — form an operational continuum: procurement and logistics → execution.
Exploring the Sleeper-Cell Architecture
To elaborate on the four types of sleeper-cell components now being emphasised in intelligence assessments:
Logistical Cells
These cells perform the mundane but vital tasks: identity procurement, SIM registration, fake documents, safe-houses, vehicles, transport cover, local movement.
Because such tasks raise fewer red flags (as opposed to heavy arms smuggling), they allow the module to embed deeply into the civilian domain.
Financial Cells
Key features:
Moving away from the classic hawala system (which has become better monitored)
Using charitable trusts and “legitimate” business fronts to transfer funds from Gulf countries / overseas Pakistani diaspora
Layering transactions so tracing becomes difficult
For example: a small trust draws funds, distributes micro-grants, which are then diverted for explosives procurement or IED components.
Ideological Cells
Online radicalisation is increasingly outsourced to small, networked cells:
Using encrypted messaging, social-media platforms, video streaming
Targeting youth, educated students, professionals with themes of disenfranchisement, communal grievance, identity crisis
“Soft indoctrination” rather than overt martyrdom calls—gradual conditioning leading to radicalisation
This ideological kernel seeds the operational cell with recruits who consciously believe in the cause, rather than purely being assets.
Operational Cells
This is the execution component: recruiting individuals who are well-placed in society, skilled in their profession, and thus less likely to be profiled.
Doctors, engineers, professors, graduates — candidates who move in “normal” professions.
They may work quietly, cover professional identity, and are harder to flag.
The compartmentalised structure means the operational cell may not know the full chain — they just take instructions to build bombs, move vehicles, trigger events.
In the Faridabad case, doctors were part of operational logistics and procurement of explosives.
Compartmentalisation & Network Resilience
The architecture is designed so that any compromised node does not expose the entire network. Key features:
No direct link between large-scale leadership (in ISI/JeM/AGH) and the street-operative in Delhi or Faridabad
Each cell limited to its function (logistics, finances, indoctrination, operations)
Encrypted communication channels, often via proxies or shell entities
Use of domestic nationals reduces dependence on external infiltration
Branding by newer proxy organisations provides deniability
Proxy Ecosystem: ISI → JeM/LeT → AGH → Home-Grown Module
Understanding the chain of sponsorship and deniability is critical.
The ISI’s role
As India’s intelligence agencies assert, the ISI remains the ultimate strategic patron of terrorist operations targeting India—shaping policy, providing cross-border logistics, enabling training, funding, and arms transfer. Because of international scrutiny, direct attribution is harder now. Instead, the ISI uses a layered approach to protect plausible deniability.
JeM and LeT as covert operators
Jaish‑e‑Muhammad (JeM) and LeT continue to serve as operational arms for Kashmir and other strike theatres. The current shift, however, sees them supporting domestic modules inside India rather than just external infiltration. For instance, the Faridabad module is being linked to JeM.
AGH and its narrative function
Ansar Ghazwat‑ul‑Hind (AGH) is a lesser-known but increasingly influential proxy network. It purports to further the “Ghazwa-e-Hind” narrative of jihad inside India, thereby providing ideological cover. The structure appears as: AGH handles radicalisation (ideology) while JeM/LeT provide arms, training and logistics.
This dual-structure enables ISI to claim: “We were not involved; this was AGH’s initiative,” even as the operational link remains covert.
Domestic module recruitment and activation
The chain flows: External handler (Pakistan/Gulf) → Channel funds to front trust → Domestic financial cell funds research/chem-procurement. Another stream: Ideological cell radicalises a domestic professional. Then operational cell executes.
The Faridabad arrests involved doctors, ties to posters in Kashmir, and explosive materials in Faridabad. The Red Fort blast appears linked by vehicle trail and timing.
The use of domestic professionals drastically raises the ceiling of threat: skilled individuals with access to chemicals, access to mobility, and low suspicion profiles become the next frontier.
Why India Is Vulnerable to This Shift
Several structural factors make India particularly exposed to this transformed threat architecture.
A large educated domestic workforce
India has a large number of professionals — doctors, engineers, academics, businesspeople — who can be embedded into normal urban life. These individuals are less likely to trigger suspicion, especially if they hold respectable positions.
Access to chemicals and dual-use materials
Modern manufacturing, healthcare and educational institutions provide access to chemical reagents, explosives precursors, lab-infrastructure. In the Faridabad case, suspected ammonium nitrate was the key material.
When operatives are already professionals, the logistics of procurement become easier and less visible.
Urban population density and high-value soft targets
Cities like Delhi have dense civilian traffic, historic monuments, public transport hubs and cultural-tourist zones. These are high-impact targets. The Red Fort blast demonstrates this vulnerability. Urban targets allow those implementing the attack to blend into everyday flow until execution.
The murkiness of financing and social redundancy
Front organisations, charitable trusts, shell companies and the ubiquity of digital financial transfers mean that following the money is harder. Especially when funds are routed through legitimate-looking charitable or educational institutions.
Pakistan’s strategic calculus
From Pakistan’s perspective, the old model of major external infiltration becomes riskier due to heightened Indian surveillance, cross-border controls and drone/air-intelligence. A home-grown module reduces the footprint, increases deniability, and allows for attrition-resilient network design.
Expert Perspectives
To contextualise the evolving threat, we draw on insights from security analysts and journalistic investigations.
On white-collar radicalisation
“The discovered network in Faridabad is illustrative of what we term ‘white-collar terrorism’ — educated professionals with cover identities, recruited for their low-suspicion profile.” — security analyst, quoted in Deccan Herald.
“Doctors are chosen because they are above suspicion — the handlers explicitly believed that no one suspects them.”
On network compartmentalisation
“Such modular design — logistical cell unaware of ideological cell, ideological cell unaware of operational cell — builds network resilience. It is a hallmark of modern terror design.” — counter-terror investigator, briefing to journalist.
On proxy layering & plausible deniability
With agencies pointing to links between JeM, AGH and Pakistan’s ISI, the layering affords strategic cover. As one Rajiv Kumar (name changed for security) explained: “If AGH claims responsibility, Pakistan can deny; if JeM emerges behind the scenes, it becomes harder to attribute directly; meanwhile, home-grown operatives muddy the origin story.”
On implications for chemical/biological threat
Given that medical professionals and labs are part of the operational pool, intelligence agencies are now sounding alarms on dual-use chemicals. Even though the Faridabad haul was conventional explosives, the architecture is adaptable. “If ammonium nitrate is in play today, tomorrow it might be toxins, precursors to biological warfare,” said a senior official.
Data & Empirical Evidence
Below is a snapshot of empirical indicators relevant to the current scenario:
Haul size: Nearly 2,900 kg of IED-making material recovered in Faridabad module.
Arrests: At least seven individuals—including two doctors—detained in connection with the module.
Targeted area: The Red Fort-metro zone, a high-traffic and symbolic area, saw the car-blast on 10 November.
Legal invocation: The car blast is being treated under UAPA (Unlawful Activities Prevention Act).
Geographic spread: The module crosses J&K, Haryana, UP, indicating a pan-north Indian reach.
These data points confirm the scope, sophistication and geographic diversity of the threat.
Strategic Implications & Policy Challenges
The emerging terror architecture presents significant challenges for Indian security and policy-making. Some of the key implications:
Intelligence & surveillance must evolve
Traditional border-centric infiltration detection is insufficient. Surveillance must intensify on:
Domestic professional networks (academia, hospitals, research institutes)
Financial flows through charitable trusts and educational institutions
Online ideological radicalisation targeting educated youth
Dual-use chemical procurement and lab-based threat vectors
Legal and investigative frameworks
The use of compartmentalised networks complicates attribution and prosecution. Legal frameworks like UAPA, Arms Act and Explosive Substances Act must be supplemented with:
Cyber-forensics for encrypted communications
Tracking funding flows via non-traditional channels
Monitoring precursor chemicals under dual-use regulation
Cross-border cooperation and diplomatic front
India must engage bilaterally and multilaterally:
With Pakistan to curb the ISI’s sponsorship, though deniability complicates this
With Gulf states and diaspora nations to curb funding channels
With international institutions to classify and sanction front trusts
Domestic professional vigilance & institutional checks
Hospitals, universities and research labs must incorporate threat awareness protocols:
Background screening of foreign nationals or Kashmiri-origin individuals in sensitive roles
Monitoring procurement of large quantities of precursor chemicals
Whistle-blower mechanisms in educational and medical institutions
Public-awareness and civic resilience
Given the shift to urban soft targets, public awareness becomes vital:
Citizens must be alert to unusual behaviour by service-professionals, medical staff outside hospitals, sudden vehicle use etc.
Rapid reporting mechanisms for suspicious documents, large unusual purchases (chemicals, timers, walkie-talkies)
Future threat vectors
With the evolving architecture, India must anticipate the next frontier:
Chemical/Biological Terrorism: Through medically-embedded operatives, access to toxins or pathogenic materials becomes conceivable
Cyber/Hybrid Attacks: Logistics cells could facilitate ransomware or infrastructure disruptions in parallel with physical attacks
Small-Footprint Attacks: Instead of large explosives, multiple simultaneous small-scale blasts to diffuse law-enforcement response
Case Study: From Posters to Module — Tracking the Chain
A micro-analysis of how the Faridabad module emerged:
1. Trigger: In October 2025, posters of JeM and AGH surfaced in Srinagar’s Nowgam area – signalling ideological mobilization.
2. Investigation initiates: Jammu & Kashmir Police launch UAPA case and trace the poster distribution to contacts in Pulwama/Kashmir.
3. Arrest of Dr Muzammil Ganai: A medical professional in Faridabad, teaching at a private institution, is taken into custody. Further leads reveal his links to larger network.
4. Raids in Faridabad’s Dhauj village: Seizure of 2,900 kg of materials, arms and explosives.
5. Secondary arrests: Additional individuals across J&K, Haryana, UP, including another doctor Dr Adil Rather.
6. Follow-up operation: Vehicle tracing leads to possible link with the Red Fort blast car. (Under investigation)
This chain illustrates how ideological trigger, professional cover, logistical embedding and operational readiness combine in a matter of weeks across states.
Why the ISI-Linked Strategy Makes Sense For the Adversary
From the adversary’s strategic calculus (i.e., ISI and its proxy networks), the shift offers multiple advantages:
Reduced detection risk: Native professionals attract far less suspicion than infiltrators from across the border.
Cost efficiency: Using domestic resources reduces logistics cost of cross-border infiltration.
Denial-friendly narrative: If a domestic operative is caught, the sponsoring entity can deny direct links more convincingly.
Scalable network: The model can be replicated in multiple cities, across professions, making the network expansive and malleable.
Psychological impact: Attacks in major cities using domestic assets heighten sense of internal vulnerability—eroding public confidence in security.
Hybrid escalation: Coupling visible attacks (Red Fort) with hidden logistics (Faridabad) allows a spectrum of disruption—both dramatic and latent.
Challenges Facing India’s Security Apparatus
Despite the urgency, Indian security architecture faces significant hurdles.
Identification of professional-recruitment pathways
It is difficult to monitor doctors or engineers unless there is concrete suspicion. Professionals enjoy privacy, high trust and mobility. Generating thresholds for suspicious behaviour without infringing civil liberties is a major policy challenge.
Financial transparency vs legitimate flows
Balancing oversight of charitable trusts and educational institutions with their legitimate operations is legally and administratively complex. Many legitimate NGOs could face undue scrutiny, creating a chilling effect.
Online radicalisation in encrypted environments
Ideological cells operate via encrypted apps and social platforms. Legal access (via warrants) to these channels lags behind technological sophistication. Radicalisation logs, recruitment trails are hard to trace.
Inter-state coordination
The module in question spanned multiple states: J&K, Haryana, UP. Coordination among disparate police forces, state agencies and federal agencies like NIA is essential but often hampered by jurisdictional and administrative silos.
Attribution and diplomacy
When attacks or modules surface that appear “home-grown,” attributing Pakistan-based ISI involvement becomes harder. International diplomacy with Pakistan over state-sponsorship loses traction when plausible deniability is built in.
Looking Ahead: What Should Be Monitored
Over the next 12–24 months, certain indicators will help assess whether this architectural shift is indeed entrenched and whether India’s counter-measures adapt effectively:
Increase in modules involving professionals: More arrests of doctors, engineers, professors, educational-institution staff being linked to terror modules.
Seizures of dual-use chemicals, toxins: Not just ammonium nitrate, but reagents, lab-equipment, biological/vaccine materials, with forensic evidence of intent.
Emergence of front charities/trusts: Entities registered in India facilitating foreign funding, overlapping with radicalised individuals.
Simultaneous multi-city attacks: Coordinated strikes across metros signalling a networked architecture rather than isolated cells.
Cyber/logistics overlap: Use of encrypted apps, online funding, darknet procurement of timers, electronics, or even cyber-components triggering physical attacks.
Geo-political fallout: Pakistan’s state-sponsorship narrative being challenged; responses in Pakistani media or diplomatic channels indicating pressure or denial patterns.
A New Era of Terror and the Response Imperative
The twin incidents in Faridabad and New Delhi are more than headline-grabbing cases. They serve as a warning: the era of large-scale cross-border infiltration is evolving into an era of embedded, compartmentalised, professionalised networks operating inside India. When the adversary is no longer a foreign militant crossing the border but a doctor, professor, engineer embedded in everyday society, the paradigm of detection must change.
India must recognise that terror is no longer solely an external threat but an internal orchestration—enabled by domestic cover, white-collar recruits, and transnational funding and ideology. The layering of logistics, finance, ideology and operations means that isolating one link will not suffice: entire ecosystems must be disrupted.
From the Faridabad explosives haul to the car-blast near the Red Fort, the message is clear: the frontline of the terror war is increasingly inside urban India and behind the scenes of legitimate-looking professions. The choice for India is stark: adapt quickly or remain a step behind.
In practical terms, this means:
Strengthening intelligence-surveillance on professional networks and dual-use procurement
Ensuring financial regulatory frameworks catch front organisations and shell-channels
Building institutional awareness in hospitals, universities, research labs about terror-vulnerability
Adapting investigative tools for encrypted communications and decentralised terror architecture
Enhancing inter-state and centre-state coordination to dismantle trans-state modules
Maintaining diplomatic pressure even when plausibility and deniability are the adversary’s tactics
If India succeeds in this transition, this new terror-architecture can be degraded. If it fails, the next attacks may be more complex, more simultaneous, and executed by insiders who move invisibly in plain sight.
