The Delhi Blast and the Rise of Covert White Collar Radical Modules
Modus Operandi and Actors
Open-source reporting on the Red Fort car blast indicates that forensic teams recovered ammonium-nitrate residues at the site and are examining whether the explosive device used Ammonium Nitrate Fuel Oil, often referred to as ANFO. Several outlets quote investigators who describe ANFO as a strong working hypothesis, although they also emphasise that it has not been conclusively confirmed. Multiple unconfirmed reports mention that two different explosive samples were found at the scene. One sample appears consistent with ammonium nitrate, and the other is described as more powerful, which raises the possibility of a mixed charge involving ammonium nitrate combined with a high-grade explosive such as RDX or another booster. These findings remain preliminary until full laboratory analysis is completed. It is to be noted that ammonium nitrate on its own does not function as a high explosive and normally requires fuel oil and a detonator to form ANFO. This is why investigators are treating the presence of ammonium nitrate as an important lead but not definitive proof of ANFO use. The Delhi blast and the recent seizure of more than 350 kilograms of ammonium nitrate in Faridabad are part of this larger planning. Confidence levels in the reporting vary. There is high confidence regarding the presence of ammonium nitrate. There is moderate confidence regarding the possibility that ANFO was used. There is low and still unverified confidence regarding the presence of a high-grade booster. This distinction matters because a device based solely on ANFO suggests simpler procurement and domestic assembly, while a device that includes a military-grade booster points to better supply networks and stronger technical capability. Investigators are awaiting formal forensic results, including spectrometric confirmation of fuel-oil residues, blast-pattern assessment and trace-element analysis. These results will determine whether the device was a standard ANFO charge, a hybrid ammonium-nitrate-plus-booster configuration or a more complex multi-component improvised explosive device.
Open-source reporting indicates that investigators are exploring possible links between the Delhi Red Fort car blast and Pakistan-based groups Jaish-e-Mohammad (JeM) and Ansar Ghazwat-ul-Hind (AGuH), based on arrests, large seizures of explosive materials and what police describe as a “white-collar” module involving doctors, clerics and other professionals. Several reports mention the detention of individuals linked to Al-Falah University in Faridabad and the recovery of significant quantities of bomb-making material including at least 2900 kgs of explosive consignment across Jammu and Kashmir and Faridabad. These findings are presented as part of a wider investigative sequence that began with the discovery of a provocative JeM poster in Kashmir, followed by arrests and seizures in Pulwama and Faridabad, and finally the explosion in Delhi, prompting broad multi-state raids.
Security agencies have now conveyed to multiple media outlets that Jaish-e-Mohammad’s involvement is strongly suspected in the Delhi bombing, based on emerging leads from interrogations, digital forensics, and financial trails. While the investigation is still ongoing, the operational patterns, ideological cues, and travel links uncovered so far align with JeM’s historical modus operandi. At the same time, agencies are also examining a parallel angle involving Al-Qaeda in the Indian Subcontinent (AQIS) and its former Kashmiri offshoot Ansar Ghazwat-ul-Hind (AGuH). Given the group’s past attempts to recruit youth from the Valley and its known transnational linkages, investigators are assessing whether elements associated with AQIS-AGuH may have provided ideological influence, technical inputs, or digital facilitation to the accused.
This dual-track probe reflects the possibility of overlapping jihadist ecosystems, where Pakistan-based groups like JeM may intersect with the broader pan-Islamist networks of AQIS, especially in ideological dissemination, training resources, or online coordination. Agencies are therefore keeping both streams open as the operational picture becomes clearer.
Emergence of the New JeM Module
Preliminary investigations point towards the involvement of a Jaish-e-Mohammad (JeM) module comprising individuals of Kashmiri origin, notably local doctors and professionals operating out of Faridabad and Saharanpur. If involvement of JeM is confirmed, the recent bombing in Delhi marks a significant and disturbing shift in Pakistan-backed terror architecture, revealing a more sophisticated, deeply embedded, and ideologically adaptive form of jihadist warfare.
This composition signals a critical evolution in Pakistan’s proxy warfare strategy, a deliberate move away from the visible insurgent model in Jammu and Kashmir (J&K) to a more covert, white-collar syndicate capable of executing high-impact strikes deep within India’s urban core.
Over the past few years, there has been a pronounced decline in local terrorist recruitment within J&K. Most active terrorists neutralised in recent operations belong to Pakistani cadres rather than locally radicalized youth. At first glance, this seemed like a counterterrorism success, a sign that radical appeal was waning among Kashmiri youth.
However, a careful assessment of J&K-Saharanpur-Faridabad module increasingly suggest that this is not a retreat but a recalibration by Pakistan’s Inter-Services Intelligence (ISI). The decline in local recruitment appears to be a tactical deception, a mirage engineered to mislead Indian security agencies into believing that terrorism is ebbing in the Valley, while ISI silently shifts its human network base deeper into India’s hinterland.
The Faridabad–Saharanpur White-Collar Syndicate
The emergence of the Faridabad–Saharanpur module embodies this new phase of hybrid warfare. These are not the uneducated, disenfranchised youth of southern Kashmir’s rural belts but educated professionals with legitimate employment and urban anonymity. Their insertion into India’s socio-economic fabric makes them inherently low-profile and less likely to attract suspicion. This transformation serves multiple ISI objectives of reducing detection risk, widening operational reach, and portraying Pakistan-sponsored jihad as an “educated resistance” rather than state-sponsored terrorism. In effect, Islamabad has replaced gun-toting terrorists in the mountains with white-collar jihadists in the plains, an adaptation that both expands tactical reach and reinforces deniability.
Radicalisation and the International Link
Investigators have identified Maulvi Irfan, a cleric from South Kashmir, as the individual who first introduced several medical professionals to extremist ideologies reportedly linked to JeM. Two key suspects, Dr. Adil and Dr. Muzammil, are believed to have travelled to Türkiye earlier this year, where they allegedly met with their handler.
According to sources, the handler arranged their accommodation and movements during the visit, suggesting a level of coordination that points to external facilitation. Interrogation reports suggest that Türkiye was deliberately chosen as the meeting point to avoid detection by Indian intelligence networks. Both doctors reportedly met several individuals there, including one identified as Abu Ukasa, believed to be a facilitator for multiple cross-border groups.
Investigators have recovered over 400 encrypted chat exchanges between the two doctors and other contacts, discussing fund transfers, logistics, and potential safe houses. One of the accused is believed to have received multiple foreign remittances from Istanbul and Doha between 2023 and 2024, possibly linked to their activities. These leads indicate a transnational support structure that extends beyond South Asia.
J&K as the Central Node
Despite this outward expansion, J&K remains the central node of this entire network, both operationally and ideologically. The region continues to serve as the command, control, and communication hub for JeM’s distributed modules.
As per media reports, handlers operating from across the Line of Control (LoC) in Pakistan-Occupied Jammu and Kashmir (PoJK) maintain encrypted contact with cadres across India through intermediaries, often using familial or educational links to ensure loyalty and discretion. Logistical pipelines for explosives, funds, and radical material still flow through the traditional route originating from J&K. This confirms that the Valley remains the operational heart of Pakistan’s terror apparatus. Even when attacks are executed in Delhi or Haryana, they are conceptually tied to the Kashmir jihad narrative, framed as extensions of the resistance front rather than standalone terror acts.
This structure mirrors a hub-and-spoke model in which J&K functions as the command hub providing ideology, logistics, and oversight, while newly activated cells in Faridabad, Saharanpur, and other Tier-2 cities act as peripheral spokes capable of carrying out high-visibility, low-detectability attacks in India’s interior.
Encrypted Communication and Its Expanding Role in Terror Networks
The investigation into the Faridabad–Saharanpur module has brought renewed focus on the growing use of advanced encrypted platforms within the terror ecosystem. The arrested doctors reportedly relied on an application called Session, which allows account creation without a mobile number and stores no chat metadata, making it extremely difficult for investigators to retrieve communication records. The app also routes traffic through multiple servers and conceals the user’s IP address, preventing agencies from establishing the physical location or identity of the individuals involved. This shift toward decentralised, privacy-focused platforms appears to have been directed by a JeM handler operating under the alias Abu Ukasa, who initially contacted the recruits through a virtual number registered in Turkey before instructing them to migrate to Session for enhanced secrecy. Investigators now face significant challenges because these tools eliminate traditional digital footprints, such as call records, SIM details, IP logs and server data that are normally used to establish networks of communication. The presence of the suspects in Telegram groups sharing extremist content adds another layer of complexity because both encrypted messaging ecosystems and closed-group channels allow radical material, instructions and ideological narratives to circulate without detection. This pattern demonstrates how modern terror modules leverage a blend of anonymised digital platforms to shield their communication chains, disrupt surveillance and slow down attribution efforts, requiring agencies to develop new technical and intelligence capabilities to counter such digitally sophisticated networks.
The ANFO Signature
Adding to the gravity of this evolution are the strong indications that Ammonium Nitrate–based explosives may have been used in the Delhi bombing, based on the nature of materials and signatures detected during the investigation. While there has been no reported recovery of a complete ANFO device, the preliminary assessment suggests that the explosive composition could be consistent with ammonium nitrate–fuel mixtures, a formulation commonly employed in large-scale improvised devices. These observations have prompted agencies to examine whether the perpetrators drew on methods seen in wider jihadist ecosystems, including groups that have historically relied on fertiliser-based explosives.
The mixture typically contains about 94 percent porous ammonium nitrate, which serves both as the oxidiser and the absorbent for the remaining 6 percent fuel oil. ANFO is widely used in industries such as coal mining, quarry operations, metal extraction and large civil engineering projects, where its low cost and simplicity often make it preferable to more sophisticated explosives. Within the mining sector, the term ANFO specifically refers to a blend of solid ammonium-nitrate prills combined with diesel fuel.
In India, ammonium nitrate (AN) is a dual-use chemical commonly used as a high-nitrogen fertiliser and in industrial blasting operations (such as mining, quarrying and infrastructure projects) but also subject to strategic risk due to its potential misuse. Under the Ammonium Nitrate Rules, 2012 (notified under the Explosives Act, 1884), AN and any mixture containing more than 45 % ammonium nitrate by weight is deemed an “explosive” and is regulated accordingly. The manufacturing, import, export, transport, storage, conversion, bagging and possession of AN are regulated by the Petroleum & Explosives Safety Organisation (PESO) and licensing under the Act and Rules is mandatory. Industrial usage is significant, for example, as per public information the explosives industry requirement was estimated at around 600,000 MT annually, and import/manufacture numbers in past years indicate large volumes. Nonetheless, misuse remains a serious concern as can be seen in the Delhi blast. The regulatory framework has been strengthened with amendments (for example in 2021) addressing storage norms (e.g., specifying port-storage distance, mandatory fire-fighting measures) and disposal procedures for seized material.
Ammonium nitrate’s dual-use character is one of the main reasons it is both widely distributed and difficult to fully secure. On one hand, it is an essential input for India’s agricultural economy as a high-nitrogen fertiliser, and on the other, it is a key oxidiser used in industrial blasting operations across mining, construction, quarrying, tunnelling and large infrastructure projects. This broad spectrum of legitimate applications ensures that ammonium nitrate moves through large, decentralised supply chains involving fertiliser companies, transporters, blasting-service providers, civil contractors, and hundreds of authorised storage points. The scale of industrial activity in India means that high volumes of ammonium nitrate are continuously manufactured, transported and stored, making complete physical verification and tracking a persistent challenge even under regulation.
The same chemical characteristics that make ammonium nitrate useful in mining and construction also make it susceptible to misuse. As an oxidiser, it can be blended with fuel oil or other sensitising agents to create a powerful improvised explosive mixture. Because ammonium nitrate is stable under normal conditions and not itself a high explosive, it can be transported and stored with fewer logistical complexities than military-grade materials like RDX or TNT. For malicious actors, this reduces the operational burden of procurement, handling and concealment. In contrast to military explosives, which are tightly controlled and monitored, ammonium nitrate’s presence in legitimate commercial sectors gives cover and ambiguity to procurement attempts, especially when diversion or pilferage occurs from industrial supply chains.
Its granular or prilled form also allows for easy transport and concealment, and it can be purchased legally through multiple channels if proper verification lapses occur. Once diverted, even small quantities can be repurposed for improvised explosive devices, and when combined with fuel, can generate significant blast effects. Historically, many global terror incidents have involved fertiliser-based precursors precisely because they allow operatives to circumvent the more difficult task of acquiring military-grade explosives. This is why ammonium nitrate is treated as a strategically sensitive commodity under Indian law. Its legitimate importance to industry coexists with an inherent vulnerability to exploitation by threat actors looking for accessible, low-signature materials for attacks.
Use of ANFO by Non-State Actors
The Provisional Irish Republican Army (PIRA) was one of the earliest groups to adopt low-grade explosive mixtures made from ammonium nitrate combined with diesel or fuel oil, commonly known as ANFO. The organisation used such mixtures in several major attacks, including the Canary Wharf bombing on 12 February 1996. PIRA operatives also experimented with enhanced formulations, for example by adding nitrobenzene and aluminium powder to ammonium nitrate to increase its effectiveness. Outside of PIRA, ANFO became widely known after the 1995 Oklahoma City bombing, in which Timothy McVeigh, a right-wing extremist acting alone, used approximately two tonnes of ammonium nitrate mixed with diesel fuel, nitromethane and commercial explosives such as Tovex and Primadet to destroy the Alfred P. Murrah Federal Building.
Ammonium nitrate has featured in many other major attacks globally. It was part of the explosives used in the Istanbul bombing on 15 November 2003, in the 8 November 2003 bombings in Saudi Arabia and in the October 2002 Bali attack, where at least 1,000 kilograms of the compound were employed. In March 2004, separatist militants in southern Thailand reportedly stole more than 1,300 kilograms of ammonium nitrate, along with dynamite and blasting caps, during an attack on a quarry. Other precursors such as potassium chlorate, often associated with homemade explosives, have also been seized, for example in East Java in late 2004. Those who followed the Battles of Raqqa, Aleppo, and Mosul during the height of the Islamic State’s (ISIS) campaign will recall how ISIS revolutionized the use of ANFO-based explosives in asymmetric urban warfare. They built industrial-scale factories for producing ammonium nitrate mixtures enhanced with aluminium powder and fuel oil, which were used to create devastating vehicle-borne improvised explosive devices (VBIEDs). These were driven at high speed into Iraqi or Kurdish forces and detonated with enormous destructive power, often levelling entire neighbourhoods. Beyond the physical damage, these “suicide tanks” were designed to psychologically shatter advancing troops, demoralising elite units through the sheer terror of explosive shock and unpredictability.
Because ammonium nitrate has only about 40 percent of the explosive force of TNT, the bombs made from it tend to be very large. These devices often consist of multiple sacks weighing up to several tonnes and are therefore most destructive when used in truck bombs against urban targets. To maximise its effectiveness, the mixture must be milled to a specific texture, a process that can take several days and increases the likelihood of detection. Ammonium nitrate is also chemically insensitive and highly hygroscopic, which means it readily absorbs moisture and must be kept in airtight containers to remain usable.
Transnational Learning and Tactical Convergence
The detection of similar explosive compounds in India reflects transnational learning and doctrinal diffusion from West Asia to South Asia. Pakistan-based outfits such as JeM appear to be absorbing operational lessons from ISIS and Al-Qaeda, adopting their explosive techniques and tactical innovations while retaining Pakistan’s strategic objectives. This convergence of ideology and technique signifies a deeper transformation that Pakistan’s proxy groups are no longer limited to regional insurgency models but are now part of a global jihadist ecosystem where knowledge, materials, and methods flow seamlessly across continents. The ISI’s long-standing policy of using terror as a strategic tool has thus evolved from exporting jihad to importing expertise.
The tactical preference for ANFO also reveals a move away from military-grade explosives or traditional RDX smuggling, both of which carry higher risk and traceability. Instead, these groups now rely on dual-use industrial precursors that are easily sourced and difficult to regulate. This shift reduces the logistical footprint of attacks while retaining their lethality. It also enables smaller, compartmentalized cells to independently assemble bombs without requiring direct access to military stockpiles or state infrastructure. In intelligence terms, this marks the decentralization of terror capability, a core characteristic of post-ISIS jihadist warfare.
Taken together, these developments illustrate the hybridization of Pakistan’s proxy warfare. The JeM’s Faridabad–Saharanpur module represents the intersection of ISI’s strategic intent and ISIS’s operational innovation, a potent mix of state direction and transnational jihadist influence. The outcome is a new generation of terrorists who are ideologically indoctrinated, technically proficient, and socially camouflaged, capable of operating within India’s urban heartland with minimal detection risk.
Conclusion: The New Battlefield
The Delhi bombing highlights a significant transformation in the nature of terror threats faced by India. The incident shows that hostile networks are evolving into fluid and adaptive structures that draw on a mix of ideological influence, transnational facilitation and domestic recruitment. The suspected involvement of educated professionals suggests that future terror modules may rely increasingly on individuals with legitimate social identities who are able to operate quietly inside the urban landscape. The possibility that Pakistan-based handlers and wider jihadist ecosystems provided ideological or technical inputs underlines the external dimension of the threat and the continued effort to destabilise India through dispersed and compartmented cells. The indications of ammonium nitrate-based compositions also show how easily available industrial materials can be diverted for destructive purposes despite existing regulatory frameworks.
In this environment, security agencies need to strengthen both preventive and investigative measures. First, early-warning mechanisms must be improved by enhancing cooperation between state police units, central intelligence agencies and financial monitoring systems so that unusual travel, suspicious digital activity and foreign remittances are flagged in real time. Second, the regulatory architecture surrounding ammonium nitrate needs continued tightening through improved traceability, periodic physical audits of warehouses, and coordinated monitoring of transport channels because diversion often occurs at the logistic stage. Third, greater emphasis should be placed on identifying radicalisation pathways in professional and academic spaces since educated recruits can blend into urban environments more effectively than traditional operatives. Community-facing engagement and discreet surveillance of vulnerable clusters will be essential. Fourth, counterterror investigations must focus on digital forensics, encrypted communication patterns and online ideological mobilisation because the new generation of modules relies heavily on digital anonymity. Finally, India will benefit from deeper international cooperation with countries that have experience dealing with similar dual-use explosive threats and cross-border ideological facilitation. A sustained, whole-of-system approach that integrates intelligence, enforcement, technology and community awareness will be critical for preventing similar attacks in the future and for disrupting the emerging architecture of hybrid terror networks.
The Delhi bombing is not an isolated incident. It is a signal event marking the maturation of Pakistan’s hybrid warfare playbook, where terrorism, ideology, and technology converge into a dispersed, educated, and networked threat. As Pakistan-based outfits modernise their doctrines and absorb lessons from global jihadist movements, India must confront a new reality that the battlefield is no longer confined to the Line of Control or the Pir Panjal. It now extends into the cities, laboratories, and offices of India’s own hinterland.
(The views expressed are those of the authors and do not represent the views of CNAWS.)
