By Rattandeep Singh[1] & Madhav Kapoor[2]
The ammonium nitrate seizure in Faridabad and the attempted fidayeen-style incident at the Red Fortthese both occurring within hours cannot be considered as isolated episodes. When examined through a broader security lens, Both of them begin to resemble components of a single operational continuum. Intelligence assessments point to an underlying structure shaped by shifts in Pakistan-origin terror architecture and its evolving methods inside India.
For decades, Pakistan’s ISI has relied on proxy outfits such as Jaish-e-Mohammed (JeM) and Lashkar-e-Taiba (LeT) to input sleeper cells within Indian territory. These cells typically remain dormant for years but can be instantly activated when needed. However, the landscape appears to have transformed significantly after India’s Bahawalpur strike that is the Operation Sindoorin whichIndia inflicted major damage on JeM’s base earlier this year. As a result, JeM seems to have moved towards a more diversified+plausible-deniable and internally embedded structure.
According to internal assessments, A total of four categories of sleeper cells have increasingly become visible Post-Operation Sindoor: logistical, financial, ideological, and operational. Each is structured to perform compartmentalised functions which assures that exposure of one segment does not unravel the entire chain.
Logistical Cells
These units rely heavily on locals. In this, individuals are recruited to procure SIM cards, identity documents, storage facilities, or unmonitored urban spaces. Because the recruits appear ordinaryand often are degree holders their activities rarely trigger red flags. Several arrests related to such procurement have been made in recent months, though many escape public or news attention due to national security sensitivities.
Financial Cells
A key shift has occurred in funding mechanisms. Traditionally dependent on hawala networks, the system has evolved to exploit charitable trusts, NGOs, and legitimate business entities. Money now arrives in India through lawful channels, giving it a clean financial trail. These funds are used to acquire chemicals, precursor materials, and logistical infrastructure. The sophistication of this structure allows procurement to appear mundane until connected by forensic investigation.
Ideological Cells
This category has expanded rapidly. Working in tandem with a “sister organisation” which is later linked by investigators to Ansar Ghazwat-ul-Hind (AGH)—JeM appears to have intensified efforts to push curated propaganda through encrypted communication platforms. The target demographic is digitally active youth, especially those already connected to religious organisations.
The process, according to intercepted communications, relies on cognitive conditioning: repeated exposure to narratives of persecution, systemic suppression, and victimhood. These narratives are engineered to foster emotional vulnerability, a sense of injustice, and a willingness to participate in protest actions or more radical activities. The so-called “I Love Mohammed” incident, which produced decentralised micro-mobilisations across several cities, is cited as one ground manifestation of this ideological machinery.
Operational Cells
This is the most sensitive and strategically significant categoryone that directly touches upon the Faridabad–Red Fort sequence. These cells recruit skilled individuals: doctors, engineers, university researchers, and technically trained youth. Because such individuals do not fit the conventional profile of a clandestine operative, their activities rarely attract surveillance.
It is precisely this element that intelligence agencies believe is now visible in the Faridabad arrests.
The Faridabad Arrests: Anatomy of a Localised Node
The investigative trail began tightening after the arrest of Dr. Adil Ahmed, a resident of Saharanpur, detained for distributing JeM posters across Srinagar and commuting frequently between Kashmir and Uttar Pradesh. His interrogation revealed the presence of multiple active sleeper structures across the NCR region, particularly in Faridabad and Noida.
Acting on this information, investigators apprehended Imam Ishtiyaqas he is also from Faridabad, for his role in indoctrination and targeted recruitment. He, in turn, led agencies to two additional suspects whose profiles fundamentally altered the nature of the case.
The first was Dr. Muzammil Shakil Sheikh, arrested at a medical college in Faridabad. Investigators discovered significant quantities of ammonium nitrate and other materials associated with improvised explosive devices (IEDs). According to operational assessments, Dr. Muzammil had been quietly experimenting with explosive precursors for an extended period.
Shortly afterwards, another medical professional—Dr. Shaheen Shahid—was detained in Lucknow for allegedly providing transport logistics and vehicle support. Both individuals fall squarely into the “least suspicious category,” confirming the emerging trend of white-collar terrorism: educated, professionally established individuals covertly embedded within militant logistics.
The Shift Toward Hybrid Networks
While initial indications tied the accused to JeM, deeper analysis by R&AW’s counter-terror desk highlighted the involvement of Ansar Ghazwat-ul-Hind (AGH). Formed in 2017 by Zakir Musa after breaking from Hizbul Mujahideen, AGH functions as an Al-Qaeda-aligned entity designed to operate with high ideological intensity.
The evolving model appears to follow a dual-track structure:
- JeM and ISI manage the logistics: money, weapons, chemicals, and coordination.
- AGH handles ideological radicalisation, recruitment narratives, and online indoctrination.
This split allows both groupsand more importantly, ISIto maintain plausible deniability. If operations surface, they appear tied to global jihadist ideology rather than Pakistan-based state-supported networks.
Compartmentalisation and Cognitive Manipulation
One striking feature across all interrogations is the role of compartmentalisation. Recruits operate in isolation, unaware of the identities or functions of others within the chain. This structure mirrors clandestine intelligence tradecraft, ensuring that even if one operative is arrested, the broader network remains insulated.
Digital communication reinforces this architecture. Encrypted platforms enable ideological reinforcement while making attribution extremely difficult. Pakistan-based handlers are believed to rely heavily on the assumption that encrypted traffic cannot be broken in an assumption countered by India’s expanding interception and decryption capabilities.
The Home-Grown Terror Module
R&AW’s consolidated assessment suggests an emerging trend: a home-grown terror module built inside India using local recruits who are ideologically primed, operationally trained in basic assembly of explosives, and embedded in normal professional environments.
This module appears to be engineered not only to execute attacks but to manufacture their own material capacities domestically also minimizing cross-border movement and reducing the risk of exposure.
The involvement of medical professionals raises an additional security dimension: access to sensitive biological materials. Recent statements by India’s Chief of Defence Staff and Army Chief about the rising possibility of biological threats acquire renewed significance in this context.
Red Fort as the Signal Event
Viewed alongside the Faridabad seizure, the Red Fort incident behaves almost as a signalling mechanism: a demonstration of capability withmens rea and operational proximity. Agencies believe this may merely be an early indicator of a larger chain of attempts which are yet to unfold.
Upcoming interrogations are expected to expose further nodes and NIA-led raids across multiple regions are anticipated. The defining risk now is not merely imported terror but an indigenous, decentralised, deniable, and digitally-networked ecosystemoperating through white-collar professionals+ fragmented cells and ideologically conditioned youth.
References
Reuters (2025). India says Delhi blast was ‘terror incident’, sources cite possible link with Kashmir arrests. Retrieved from:
https://www.reuters.com/world/asia-pacific/india-probes-link-between-delhi-car-blast-earlier-kashmir-arrests-sources-say-2025-11-12/
The Guardian (2025). India confirms deadly Delhi car blast being treated as terror incident. Retrieved from: https://www.theguardian.com/world/2025/nov/12/india-confirms-deadly-delhi-car-blast-being-treated-as-terror-incident-red-fort
NDTV (2025). Ammonium Nitrate To Ricin Poison: Terror Attacks And The Doctors Behind Them. Retrieved from: https://www.ndtv.com/india-news/ammonium-nitrate-to-ricin-poison-terror-attacks-and-the-doctors-behind-them-9608122
Times of India (2025). White-collar terror exposed: Meet the 5 doctors linked to India’s multi-state module. Retrieved from: https://timesofindia.indiatimes.com/city/delhi/white-collar-terror-exposed-meet-the-5-doctors-linked-to-indias-multi-state-terror-module/articleshow/125245712.cms
BBC News (2019). Zakir Musa: India’s most wanted militant ‘killed’ in Kashmir. Retrieved from: https://www.bbc.com/news/world-asia-india-48384909
[1]4th Year, B.B.A. LL.B Student, University Institute Of Legal Studies, Chandigarh University.
[2]4thYear, B.B.A. LL.B Student, University Institute Of Legal Studies, Chandigarh University.
