Investigators probing the November 10 blast near Delhi’s Red Fort have established a link to the Jaish-e-Mohammad, uncovering what they describe as an extensive plan for 200 coordinated explosions across North India. According to officials connected to the investigation, the explosive used in the Red Fort incident forms only a fraction of a larger cache prepared by a module operating out of Faridabad, allegedly under the guidance of a senior JeM operative identified as Hanzulla. The confirmation of his involvement has placed the focus on how the group intended to simultaneously trigger blasts in Delhi, Gurugram and Faridabad.
The probe indicates that the Faridabad module had been receiving instructions from Hanzulla, who was reportedly in close contact with key accused Iran Ahmed. Investigators say Ahmed acted as a link, connecting the JeM operative with module members who were responsible for assembling the explosives. The scale of the plot became clearer after the seizure of nearly 2,900 kilograms of ammonium nitrate. Officials state that the accused had been preparing devices by mixing the chemical with Triacetone triperoxide (TATP), a formula known for its high potency and low preparation threshold.
The involvement of TATP, an explosive used in several global terror attacks, has raised concerns about the ease with which the devices could be manufactured and deployed. Investigators say the mixture can be set off with minimal effort and does not require sophisticated triggering mechanisms. One officer noted that its volatility also makes it suitable for placement inside vehicles, where environmental heat alone can initiate an explosion. This method, officers say, is known to be used by groups such as the Islamic State Khorasan Province, which favours easily deployable explosives for lone or small-cell attacks.
Officials explain that the clues linking the case to JeM emerged after posters appearing in Jammu and Kashmir carried the name “Commander Hanzulla Bhai”, prompting agencies to trace connections to earlier intelligence on the Faridabad group. While the operative’s location remains unknown, the probe shows he had been directly guiding the procurement of materials and offering detailed instructions on assembling the devices. His communication with Ahmed, who then connected him to Shakeel and other module members, has been cited as central to the investigation.
Shakeel is believed to have transported the materials and provided the white Hyundai i20 car used in the Red Fort blast. Preliminary findings suggest the group may have intended the Red Fort incident to be part of the larger coordinated attack. Investigators believe the plan did not unfold as intended, with early execution possibly disrupting the wider objective. The discovery of the massive ammonium nitrate stockpile, coupled with intercepted communications, has led investigators to conclude that the module had been preparing a large number of improvised explosive devices meant to detonate at once.
The network appears to have operated covertly for months, aided by encrypted communication platforms and coded language. Officials say the accused used terms like “biriyani” to refer to explosives and relied heavily on their professional identities to avoid scrutiny. Several members of the group were doctors, which investigators note made their travel patterns and social movements appear routine. One of the key members, identified as Dr Shaheen, is believed to have travelled frequently to Jammu and Kashmir for meetings with Ahmed, who guided the recruitment strategy and directed efforts to build what officials call a “white collar module”.
The probe has also revealed that the Faridabad module was being simultaneously handled by Ahmed in Kashmir and another handler based in Afghanistan, indicating multi-point coordination. The findings suggest that the group’s attempts to remain off the radar were largely effective until the Red Fort blast triggered an accelerated investigation. Agencies are now working to trace the whereabouts of Hanzulla and determine whether similar modules may have been operating across the northern region.
