According to the agency's findings, three men—Umar Un Nabi, Muzammil Shakeel Ganai and Muzaffar Rather—travelled to Turkey in 2022 where they met a Syrian national under instructions from handlers in Pakistan. The trio are alleged to have participated in a radicalisation cycle and operational planning that led to the eventual strike on the monument. Intelligence records show encrypted communication channels were used for transmitting bomb-making videos, instructions and operational directives. The two doctors were later arrested and face interrogation on the structuring of the module. Other co-accused are believed to have helped with logistics, safe houses and weapon procurement.
The defendants’ professional backgrounds as medical practitioners and an academic underscore a trend flagged by security analysts as the emergence of a “white-collar terror ecosystem.” Investigators found that the attacker had established a laboratory near Faisalabad University in Faridabad to experiment with explosives, and handlers shared dozens of instructional videos on Telegram and other encrypted apps to instruct them remotely. One foreign handler using the pseudonym “Colonel” is believed to have groomed several modules across the country by disseminating DIY bomb-making content and crypto-funds—a method traced first in incidents in southern states and now in the national capital.
Enquiries reveal that the explosion was designed not as a stand-alone act but as part of a broader wave of coordinated assaults. The vehicle used was registered under a contact linked to one of the accused. Forensic analysis found a substantial haul of ammonium nitrate and other explosive materials in premises associated with the group. Financial trails lead to dark-web cryptocurrency transfers and overseas bank accounts. Officials say the Turkey trip was pivotal: it provided the accused direct access to overseas operatives, opened communications with foreign handlers and marked the moment the plot shifted from radical rhetoric to planning.
A senior official within the probe described the Turkey link as “the turning point” in the module’s evolution and highlighted its significance in establishing an international network that connected doctors, clerics and militant handlers across continents. This network is now under scrutiny for ties with known terror outfits and for replicating tactics seen in overseas attacks such as drone-borne or car-borne bombings in other jurisdictions. Investigators are reviewing encrypted app logs, call data, travel history and financial flows to map the full spectrum of the network.
The country’s interior ministry has elevated the threat to Level 3 counter-terror alert status in metropolitan centres, citing the interconnected nature of the cell and the professional background of its members. Security agencies emphasise the danger posed by radicalised individuals with technical training and foreign connections, noting the challenge of detecting modules that operate under the radar, leverage legitimate professions and blend into urban life. Analysts argue that the Turkey meeting signals a shift in the geography of terror operations, with less visible hubs and remote handlers steering domestic plots.