In the three days since a car exploded near the Red Fort in the national capital, killing eight people, security agencies across several states have carried out a series of coordinated operations targeting suspected militant networks, facilitators and individuals under long-term surveillance.
The scale and speed of the actions- occurring across Delhi, Jammu & Kashmir, Gujarat, West Bengal, Tripura and Meghalaya, point to a centrally driven effort to disrupt what officials describe as “interlinked nodes of radicalisation, logistics and recruitment” scattered across the country.
Forpol traced the sequence of events, conversations with senior police officials, counter-terror investigators and district-level officers, and reviewed preliminary briefings to piece together the picture that has emerged over the past 72 hours since the Red fort Attack happened.
Probe into Red Fort Explosion Moves to NIA
The trigger was the evening of November 10, when a white Hyundai parked near the Red Fort burst into flames after a loud explosion, killing eight and injuring at least a dozen. Initial visuals captured by tourists and local residents showed a mangled chassis and blackened debris. By late night, a case under the Unlawful Activities (Prevention) Act (UAPA) had been registered, formally indicating that investigators believed the incident may have been a terror attack.
On November 11, the Union Cabinet passed a resolution calling the car blast at Red fort- a “terrorist incident”, an unusual step at such an early stage of a probe. Later that evening, the Ministry of Home Affairs transferred the case to the National Investigation Agency. According to officials, the NIA constituted a ten-member Special Investigation Team and began coordinating with Delhi Police’s Special Cell, the Intelligence Bureau, Haryana Police and Jammu & Kashmir Police.
A senior Delhi Police official told The Forpol that investigators are examining whether the blast has any link to older modules traced to Pakistan-based handlers. “We are looking at earlier patterns, including communication recovered from multiple modules last year. It is too early to establish direct links, but we are not ruling anything out,” the official said.
J&K Witnesses Large-Scale Detentions and Searches
Even as the national probe into the blast intensified, Jammu & Kashmir saw one of its largest security sweeps in recent years. Over the past three days, police and paramilitary forces detained more than 1,000 individuals across districts including Pulwama, Anantnag, Kulgam, Shopian and Srinagar.
Police officials described the detentions as “preventive”, part of a wider strategy to disrupt logistical chains and communication networks that may be exploited in the run-up to planned attacks. According to officials, several of those detained have prior records under preventive detention laws or pending UAPA cases.
On November 12, the crackdown escalated with over 300 searches at locations linked to members and sympathisers of the banned Jamaat-e-Islami (JeI). Documents, electronic devices and financial records were seized for scrutiny. Several clerics and overground workers associated with earlier JeI cells were questioned.
A senior Jammu & Kashmir Police official said the operation had been planned over several weeks but was accelerated after the Delhi blast. “We were acting on multiple intelligence inputs already. The incident in Delhi created the need for immediate action,” the official said.
ISIS-K Linked Module With Trained Professionals Under Lens
In a separate investigation developing parallel to the Delhi case, agencies arrested several individuals allegedly linked to an ISIS-Khorasan–inspired module spanning Hyderabad, Faridabad, Saharanpur, Gujarat and parts of Kashmir.
Central to the probe is a Hyderabad-based doctor arrested in Gujarat. According to ATS officials, he was allegedly in possession of weapons believed to have been smuggled from Pakistan using drones, along with chemicals associated with ricin production. Ricin, a highly toxic compound, has been used in several high-profile international terror plots.
Subsequent searches in Faridabad and Saharanpur led to the recovery of additional firearms, electronic devices and documents. Two more doctors and several associates are being questioned.
Officials said the presence of medical professionals and the nature of materials recovered suggest a “more sophisticated level of planning” than in routine modules. “This was not a single-state module. We are examining whether the individuals were in touch with handlers abroad,” a senior ATS officer said.
NIA Extends Operations to Eastern and Northeastern States
On November 13, the NIA expanded its operations to West Bengal, Tripura, Meghalaya, Haryana and Gujarat. In Murshidabad, a district known for earlier modules linked to al-Qaeda in the Indian Subcontinent (AQIS), the agency searched the home of a man associated with a 2023 conspiracy case registered in Ahmedabad.
NIA teams also conducted searches in parts of Tripura and Meghalaya in connection with suspected illegal cross-border networks. According to officials, some of these networks are believed to have facilitated the movement of individuals across the India-Bangladesh border using forged identification documents.
Electronic devices, mobile phones, financial materials and travel records were seized and sent for forensic analysis. Officials said preliminary findings will be shared with state police forces for follow-up action.
Clerics, Overground Workers and Ideological Nodes Examined
Apart from operational cells, investigators have broadened their focus to include individuals suspected of offering ideological or logistical support. Two clerics from Shopian and one from Ganderbal are under scrutiny in connection with both the Delhi blast and earlier arms recoveries in Faridabad. Their residences were searched, and call records are being analysed.
An officer involved in the Kashmir operations said the objective is to map “who met whom, at what time, and for what purpose” in the weeks leading to the Delhi explosion. “In several earlier cases, the operational module and the facilitation network were separate. We want to see if there is any overlap,” he said.
Integrated Response Reflects Evolving Counter-Terror Strategy
Officials familiar with the ongoing operations said the clustering of actions within a 72-hour window reflects a conscious shift toward pre-emptive disruption. Rather than waiting for modules to fully form or for attacks to be executed, agencies are focusing on early-stage indicators including communication, funding movement and cross-border contact.
The coordination between state police forces, the NIA, central intelligence agencies and district-level units marks a shift toward a more integrated operational model. Investigators are also placing greater emphasis on dismantling infrastructure- safe houses, document forgery units, informal financial channels, that allow modules to function across state boundaries.
According to officials, the immediate priority remains establishing whether the Delhi blast is connected to any of the other modules currently under investigation. At the same time, agencies are working to prevent any potential follow-up attacks by neutralising support structures that remain active.
Crackdown Likely to Continue
With materials from multiple raids now in forensic labs, and interrogation of detainees ongoing, agencies are expected to brief the Ministry of Home Affairs later this week. The NIA is likely to file additional requests for technical data from telecom providers and digital platforms as part of the expanded probe.
Officials indicated that more searches may be conducted in the coming days based on leads generated from seized devices and financial trails. Some detainees in Jammu & Kashmir may be released after questioning, while others might face fresh cases depending on evidence gathered.
As investigations progress, the central government is expected to review both the immediate handling of the Red Fort blast and the broader security posture across states that have emerged as nodes of recent activity.
