Pakistan’s strategy of proxy warfare in Kashmir has entered a new phase marked by rebranded terrorist fronts operating under neutral-sounding names.
Over two dozen new groups have emerged on digital platforms since August 2019, presenting themselves as resistance movements rather than jihadist outfits. This shift, facilitated by Pakistan’s Inter-Services Intelligence (ISI), is designed to shield Islamabad from global scrutiny while continuing its support for cross-border terrorism.
The Resistance Front (TRF), People’s Anti-Fascist Front (PAFF), and Kashmir Tigers (KT) are among the most active of these entities. These groups began appearing shortly after the abrogation of Article 370. Their communiqués avoid religious terminology, instead framing attacks as part of a political resistance against India’s presence in Jammu and Kashmir. Security agencies have noted that these groups primarily exist in the digital space and often share high-resolution posters, threats, and statements through Telegram, Twitter (X), and Signal.
TRF, PAFF And KT Emerged Post-2019, Avoiding Islamist Labels And Adopting Civil Resistance Tones
According to intelligence agencies, TRF surfaced in 2019 and began claiming attacks in north Kashmir, particularly in the Baramulla and Kupwara belts. PAFF gained visibility in the Rajouri-Poonch region by 2020, frequently issuing statements after encounters and attacks. Kashmir Tigers became active in the Doda-Kishtwar axis around 2021. These names do not appear in any pre-2019 police records, and their emergence coincides with a noticeable drop in claims by LeT and JeM under their original banners.
Investigators from the National Investigation Agency (NIA) and Jammu and Kashmir Police have confirmed that many of the operatives neutralised in encounters claimed by TRF or PAFF were previously linked to Lashkar-e-Taiba (LeT) and Jaish-e-Mohammed (JeM). Forensic examination of digital devices recovered from slain terrorists has further revealed media and message trails linked to handlers operating from Pakistan-occupied Jammu and Kashmir (PoJK).
MHA Has Formally Designated TRF, PAFF And JKGF As Terrorist Groups Based On Evidence Of Activity
In 2023, the Ministry of Home Affairs declared TRF, PAFF and J&K Ghaznavi Force (JKGF) as terrorist organisations under the Unlawful Activities (Prevention) Act. The decision was based on consistent patterns of attack claims, video propaganda, and threats issued through these aliases. Intelligence sources stated that these groups often mirrored the modus operandi, target selection, and strategic messaging previously used by banned organisations.
Security agencies have reported that the names TRF and PAFF have been used extensively to claim targeted killings of non-locals, minorities, and political workers. These groups have also been central to propaganda efforts targeting development projects such as tunnel works, railway infrastructure and the G20 summit preparations. The use of rebranded names has enabled Pakistan to publicly distance itself while continuing to fuel unrest.
Refutations And Digital Disclaimers Are Being Used To Avoid Diplomatic Backlash After Civilian Killings
One observed pattern has been the withdrawal of responsibility claims following high-profile attacks. In the aftermath of the Reasi attack on 09 June 2024 and the Pahalgam incident on 22 April 2025, social media accounts associated with TRF and PAFF initially claimed responsibility. However, within hours, separate statements were issued disclaiming the attacks and expressing condolences for civilian deaths. These reversals appeared synchronised and were likely coordinated to manage diplomatic fallout.
Intelligence sources confirmed that these refutations originated from the same digital infrastructure used by the tanzeems to circulate earlier threats. Multiple outfits occasionally issued conflicting statements about the same incident, suggesting that media handlers operate independently or with limited coordination. This tactic has complicated attribution and allowed Pakistan to maintain a façade of distance from such acts.
Digital-only Tanzeems Are Harder To Trace, Enabling ISI To Sustain Proxy Warfare Without Direct Exposure
Law enforcement agencies have highlighted that these rebranded groups exist almost entirely on encrypted platforms, with no known physical offices, camps or formal command chains visible inside Kashmir. Proxies use VPNs and anonymised networks to post content. According to cyber units working with J&K Police, identifying the original location of these uploads remains a persistent challenge due to routing through overseas IP addresses.
The messaging strategy adopted by these outfits allows ISI to claim plausible deniability. The narrative built around “resistance” and “people’s struggle” helps these tanzeems bypass traditional red flags associated with terrorism in international media and policy circles.