The Delhi Police confirmed that Monday’s Red Fort Metro Station blast was a terror attack. Investigators believe the bomber, Dr Umar Un Nabi, had links with handlers based in Turkiye and Nangarhar, Afghanistan.
Fresh details from the ongoing probe into the Red Fort blast have revealed that Dr Muzammil Ganaie, one of the key accused in the recently busted ‘white-collar terror module’, had carried out multiple reconnaissance visits of the Red Fort area in January this year, according to officials. Investigators believe these visits were part of a larger conspiracy to target the historic monument around Republic Day, but the plan was reportedly foiled due to heightened police patrolling in the area at the time. Investigations have also shown that Dr Muzammil and Dr Umar Un Nabi, the suspected driver of the Hyundai i20 that exploded near the Red Fort, had both travelled to Turkiye earlier.
Delhi New findings link Red Fort blast to earlier reconnaissance
According to Delhi Police sources, the investigation so far points to a foreign link. The handlers who guided Umar and his group are suspected to be operating from Turkiye and Nangarhar (Afghanistan), both known to host extremist networks. Immigration stamps found in Dr Muzammil and Dr Umar Un Nabi’s passports are now being examined to determine whether they met any foreign handlers during their trip to Turkiye.
Meanwhile, Delhi Police have issued an alert to trace a red Ford EcoSport, believed to be linked to the same module. The warning follows evidence that some of the suspects connected to the Hyundai i20 used in the explosion also had access to another red vehicle. The high-intensity blast, which killed 12 people and injured several others, occurred only hours after police arrested eight members of the Jaish-e-Mohammad and Ansar Ghazwat-ul-Hind-linked module, including three doctors.
Delhi Police on Wednesday confirmed that the powerful explosion near the Red Fort Metro Station earlier this week was a terror attack. The initial investigation has revealed that the attack was planned and guided by handlers based in Turkiye and Nangarhar in Afghanistan, according to news agency Press Trust of India.
Officials said these handlers were in constant contact with Umar Un Nabi and other members of what investigators call the ‘doctor module’, a newly uncovered terror network operating in India. Indian intelligence agencies believe these handlers were coordinating with Umar and others in the ‘doctor module’ through encrypted communication channels.
Who was Umar Un Nabi?
Umar Un Nabi, originally from Jammu and Kashmir, is believed to have carried out the ‘lone wolf fidayeen attack’ near the Red Fort on Monday evening, reports PTI. Police sources said Umar had been on the run after escaping earlier raids by the Jammu & Kashmir Police. On the day of the blast, he was reportedly inside a Hyundai i20 car that detonated at a traffic signal near the Red Fort, claiming several lives and injuring many.
Officials said only an arm, believed to be his, was recovered near the car. DNA tests are being conducted to confirm his identity.
DNA samples sent for confirmation
The Forensic Science Laboratory (FSL) has collected the DNA samples of Umar’s mother. These samples have been sent to the AIIMS Forensic Laboratory to match them with the remains found at the blast site. This testing is expected to confirm whether the body parts recovered indeed belong to Umar Un Nabi.
The National Investigation Agency (NIA) has officially taken over the case from the Delhi Police following orders from the Ministry of Home Affairs (MHA), which cited a clear terror angle in the explosion. The NIA has formed a dedicated and comprehensive investigation team led by senior officers of the rank of Superintendent of Police and above.
The team is coordinating with other central and state intelligence units to identify everyone involved in the wider network.
Connected to Faridabad ‘doctor module’
The Red Fort blast is now linked to the Jaish-e-Mohammad module that was recently exposed by Indian agencies in Faridabad, Haryana. The Faridabad case began when police recovered a huge cache of explosives from different locations connected to the module.
On November 10, investigators seized 2,563 kilograms of explosives from the home of Hafeez Mohammad Ishtiyaq, the Imam of Al-Falah Mosque in Mewat’s Dhera Colony. Another 358 kilograms of explosive materials, including detonators and timers, were recovered later.
In total, nearly 3,000 kilograms of explosives were found, one of the largest recoveries in recent years.
Doctor’s arrest leads to bigger discoveries
The investigation began after objectionable posters were found in Srinagar’s Naugam area in October 2025, leading to an FIR and subsequent arrests. During questioning, police learned about the involvement of Dr Muzammil Ahmad Ganaie, a doctor at Al-Falah Medical College in Faridabad. His arrest opened the trail to other members of the module, including Umar.
The group is suspected of being influenced by Jaish-e-Mohammad (JeM) and had plans for multiple coordinated attacks across northern India.
Explosives from Faridabad match Red Fort blast
Forensic experts have confirmed that the chemical composition of the explosives used in the Red Fort blast matches the materials recovered from Faridabad. This link has helped investigators conclude that Umar Un Nabi was part of the same terror module.
CCTV footage from the blast site also confirms that Umar was alone inside the car moments before it exploded.
Questions over Umar’s final actions
Investigators are still trying to determine whether Umar detonated the car intentionally as part of a fidayeen mission or whether it went off accidentally when he was attempting to hide the explosives. Sources say he was under immense pressure after his associates’ arrests and feared being tracked by the agencies. His final actions, they say, may have been out of panic and desperation.
Focus on foreign network and digital trail
The NIA’s top priority is to identify the foreign handlers and map their communication with Umar. The agency is working with cyber experts to retrieve data from encrypted chats, emails, and social media platforms used by the suspects.
Officials said this digital trail could provide critical evidence linking the module to terror groups operating from Afghanistan and Turkiye.
Preacher from Haryana detained
In a major development in the ongoing investigation into the terror module, the Jammu and Kashmir Police on Wednesday detained a preacher from Mewat, Haryana, officials confirmed. The man, identified as Maulvi Hafeez Mohammad Ishtiyaq, was residing in a rented accommodation within the Al-Falah University complex in Faridabad, from where authorities had earlier seized over 2,500 kilograms of explosives.
Ishtiyaq has now been brought to Srinagar for questioning and is expected to become the ninth person to be formally arrested in the case. Investigators believe he played a key role in storing and possibly distributing the explosives used by the module linked to the Jaish-e-Mohammad and Ansar Ghazwat-ul-Hind networks.
(With inputs from agencies)