EXCLUSIVE | Red Fort blast module: Foreign handler ‘shared 42 bomb-making videos with doctor on encrypted apps’

The three handlers in the Delhi case have been identified as “Hanzullah”, “Nisar” and “Ukasa”, which could be pseudonyms and not real identities, sources said.

The person using the identity of “Hanzullah” is alleged to have sent over 40 videos on bomb-making to Dr Ganai, 35, who allegedly arranged storage for explosives used by the module, said police sources familiar with the initial findings from the Delhi blast probe.

Dr Ganai was arrested 10 days before the blast and over 2,500 kg of explosive material, including 350 kg of ammonium nitrate, was recovered from his premises.

Mohammed Shahid Faisal, a foreign handler who uses pseudonyms like “Colonel,” “Laptop Bhai”, and “Bhai” and is believed to have coordinated with terror modules in Karnataka and Tamil Nadu to execute bombings since 2020, has also emerged as a person of interest in the case, sources said.

Faisal is believed to be linked to the Coimbatore car suicide bomb blast on October 23, 2022, the “accidental” Mangaluru autorickshaw blast of November 20, 2022, and the Bengaluru Rameshwaram Cafe blast of March 1, 2024.

According to investigators, Faisal alias Zakir Ustad is an engineering graduate from Bengaluru who went missing as a 28-year-old in 2012, following the unearthing of an alleged Lashkar-e-Taiba-linked terror plot in Bengaluru involving several young engineers, doctors and others.

He is reported to have fled to Pakistan after police and security agencies identified him as a key player in the plot.

According to sources, Faisal moved to the Syria-Turkey border more recently, and his identity was established in the NIA probe of the Rameshwaram Cafe blast, where he has been named as an absconding accused.

Incidentally, one of the handlers of the Red Fort terror module, identified by the pseudonym “Ukasa”, is believed to be Turkey-based.

“There is a possibility of the Delhi incident being linked to recent incidents in Karnataka and Tamil Nadu through the remote handler. There are similarities in the operations at the handler level. This is being studied, but more information is awaited,” said security sources in Karnataka, who are familiar with the Delhi probe and multiple terror probes in south India.

Similarities to Coimbatore car suicide bomb incident

Among the recent incidents in South India, the Red Fort blast bears the closest resemblance to the Coimbatore suicide car bomb blast of October 23, 2022, where a mechanical engineering graduate who ran a library, Jamesha Mubin (28), died in a 4 am car blast outside a temple in Coimbatore.

A Maruti 800 car that was bought second-hand, allegedly with the sole intent of the bombing, was used in the explosion.

Mubin, who was driving, was the lone casualty. Investigators believe he used an IED to trigger an LPG explosion in the car.

A search of properties linked to Mubin led to the seizure of potassium nitrate, red phosphorus, PETN powder, batteries, and other materials suspected to be related to DIY bomb-making techniques propagated via encrypted social media platforms.

A Chennai court was informed during investigations by the NIA “that a similar kind of blast happened in Mangalore (November 19, 2022) and it is suspected that there may be common linkages”.

The probe revealed that Mubin was radicalised to take up jihad by remote handlers, and a pen drive recovered from the motorcycle of a co-accused revealed that he “had recorded three self-confession videos on why he was committing this terror attack”, according to notings in a special court order in the case.

The NIA probe in the Coimbatore case revealed that Mubin and associates procured fertilisers like urea to derive explosives like ammonium nitrate for a blast.

Common handler for modules in TN and Karnataka

While the presence of a common handler for the terror modules involved in bomb incidents in 2022 in Tamil Nadu and Karnataka was suspected, the identity of the handler only emerged after the Rameshwaram Cafe blast.

“There were modules of youths created in Karnataka and Tamil Nadu using the front of the Islamic State during this period. There were also very similar modules operating in Delhi, Padgah and Pune. All these modules were acting in a similar way – trying to build IEDs on their own using everyday materials after online radicalisation – but without interaction with each other, leading to the suspicion that there were common handlers for the different modules identified in the 2020-2025 period,” sources familiar with probes in multiple states said.

“Faisal was identified after analysis as a common handler for the groups in Tamil Nadu and Karnataka, while another missing terror suspect, Rashid, was identified as the possible handler of IS groups that were created in Delhi, Padgah and Pune,” the sources said.

Faisal’s role emerged following NIA arrests of the two alleged perpetrators of the Rameshwaram Cafe blast — Mussavir Hussain Shazib, 30 and Abdul Matheen Taha, 30.

Faisal is alleged to have sent dozens of DIY bomb making videos and thousands of rupees through cryptocurrencies to Taha, an IT engineer, for running terror operations in the south from 2020.

While framing charges against the Shivamogga module of Taha and others, a special NIA court in Bengaluru said on March 7, 2025, that “the Islamic State online handler ‘Colonel’, conspired to radicalise and recruit youths” and “to prepare the newly recruited members for major operations of Islamic State such as ‘Istishhad’ (suicide bombing), assassination, mass attacks, and lone wolf attacks, with the intention to wage war against the Government of India”.

Faizal is also alleged to have shared bomb-making videos with a youth, Mohammed Shariq, 26, a college dropout recruited by Taha, who attempted to plant a bomb in Mangaluru on November 19, 2022, but suffered injuries after a premature, accidental blast.

Shariq and others in the Shivamogga module are alleged to have tested IEDs they built – using instructions and everyday materials described in videos shared online by the handler – on a river bed in Shivamogga in 2022 before attempting the Mangaluru blast.

Like Shariq’s module, Mubin’s is also alleged to have conducted tests for IEDs in remote locations.

Among the other similarities between the Delhi Red Fort incident and previous incidents in Karnataka and Tamil Nadu is the use of similar encrypted messaging platforms – Signal, Session, Telegram – to communicate and disseminate online videos on DIY bomb-making techniques and materials by handlers based in other countries, sources said.

Since the Delhi blast on November 10, security agencies have spoken to key suspects from the Islamic State-linked modules of the missing handler Faisal, who are lodged in prisons in Karnataka and Tamil Nadu at present, to ascertain the identities of the handlers involved in the Delhi blast.