Red Fort blast: Doctors used ‘ghost’ SIMs communicate with Pakistan handlers

Investigations into the so-called 'white-collar' terror module linked to the blast near Delhi’s Red Fort on 10 November last year have revealed that highly educated doctors used a sophisticated network of “ghost” SIM cards and encrypted messaging applications to coordinate with handlers in Pakistan, officials said on Sunday.

Officials said the findings of the probe formed the basis for a sweeping directive issued by the Department of Telecommunications (DoT) on 28 November last year, mandating that app-based communication services such as WhatsApp, Telegram and Signal must be continuously linked to an active physical SIM card within the device.

According to investigators, the probe into the module uncovered the use of multiple “ghost” SIM cards by the arrested doctors, including Muzammil Ganaie and Adeel Rather, as part of a tactical “dual-phone” protocol designed to evade security agencies. Each accused, including Dr Umar-un-Nabi — who was killed while driving the explosives-laden vehicle near the Red Fort — allegedly carried two to three mobile handsets.

Officials said the accused maintained one “clean” phone registered in their own names for routine personal and professional use, while a second device functioned as a “terror phone” used exclusively for WhatsApp and Telegram communication with handlers in Pakistan, identified by the codenames ‘Ukasa’, ‘Faizan’ and ‘Hashmi’.

The SIM cards used in these secondary devices were allegedly issued in the names of unsuspecting civilians, whose Aadhaar details were misused. Jammu and Kashmir Police also unearthed a separate racket in which SIM cards were issued using fake Aadhaar documents, officials said.

Investigators noted that many of these compromised SIMs remained active on messaging platforms even when accessed from across the border in Pakistan-occupied Kashmir (PoK) or Pakistan. By exploiting features that allow messaging apps to function without a physical SIM in the device, handlers were able to direct the module to learn improvised explosive device (IED) assembly through online videos and plan “hinterland” attacks, despite some recruits initially expressing interest in joining conflict zones in Syria or Afghanistan.

To address these vulnerabilities, the Centre has invoked provisions of the Telecommunications Act, 2023, along with the Telecom Cyber Security Rules, to safeguard the integrity of the telecom ecosystem. Under the new rules, all Telecommunication Identifier User Entities (TIUEs) must ensure within 90 days that their applications function only if an active SIM is installed in the device.

The directive also requires telecom operators to automatically log users out of apps such as WhatsApp, Telegram and Signal in the absence of an active SIM. All service providers, including Snapchat, ShareChat and JioChat, have been asked to submit compliance reports to the DoT.

In its order, the DoT said the ability to use apps without a SIM posed a serious cyber-security challenge, as it was being misused from outside the country for cyber fraud and terror activities. The directive is being fast-tracked in the Jammu and Kashmir telecom circle, though officials acknowledged that deactivating all expired or fraudulent SIMs would take time.

Officials said non-compliance with the new norms would attract stringent action under the Telecom Cyber Security Rules and other applicable laws.

The “white-collar” terror module began to unravel on the intervening night of 18–19 October 2025, when posters of the banned Jaish-e-Mohammad appeared on walls outside Srinagar, warning of attacks on police and security forces. Treating the matter as serious, the Senior Superintendent of Police, Srinagar, G.V. Sundeep Chakravarthy formed multiple teams to investigate.

The probe eventually led police to Al Falah University in Haryana’s Faridabad, where two doctors — Ganaie, a resident of Koil in south Kashmir’s Pulwama district, and Shaheen Sayeed from Lucknow — were arrested. Officials said a large quantity of arms and explosives, including 2,900 kg of ammonium nitrate, potassium nitrate and sulphur, was seized.

The car explosion near the Red Fort claimed 15 lives and is being investigated by the National Investigation Agency.

With PTI inputs