Delhi blast: More attacks were planned in 4 cities; Al Falah’s university status revoked

New Delhi: A medical college professor and a cardiology student from Jammu and Kashmir were detained in Uttar Pradesh as investigators probing the deadly Red Fort blast uncovered a wider plot to carry out coordinated explosions in four cities, exposing what officials described as a “white-collar terror” network of doctors and professionals. The government on Thursday revoked Al Falah University’s varsity status and ordered a forensic audit into its finances amid growing evidence that several suspects, including key accused Dr Umar Nabi—whose DNA test confirmed he was driving the explosives-laden car that killed 13 people—had studied or worked at the Haryana-based institution now under the scanner of central agencies.

According to officials involved in the probe, the blast near Delhi’s Red Fort on Monday night was only the first in a series of planned attacks by an educated terror module with interstate links stretching across Jammu and Kashmir, Haryana, Uttar Pradesh, and the National Capital Region. Preliminary findings indicate that the group, allegedly inspired and financed by Pakistan-based Jaish-e-Mohammed and Ansar Ghazwat-ul-Hind networks, had formed an organised cell of doctors, students, and professionals who pooled funds, procured explosive materials, and used encrypted platforms to coordinate their operations while maintaining the façade of normal academic and medical lives.

The explosion, which tore through a white Hyundai i20 near the Red Fort Metro Station around 6:52 pm, killed 13 people and injured over two dozen others. The blast scattered debris and body parts across the busy stretch, and a severed hand was found the following morning on the roof of a nearby shop. Investigators later confirmed that the driver of the vehicle was 32-year-old cardiologist Dr Umar Nabi from Pulwama, Jammu and Kashmir, after DNA tests matched samples from his mother with remains collected at the site. Umar, known in his professional circle for his academic excellence, had reportedly turned radical over the past two years and joined multiple encrypted messaging groups linked to extremist networks.

The Delhi Police and central agencies, using footage from more than 50 CCTV cameras, have reconstructed Umar’s final movements before the blast. The route-mapping shows that he left Faridabad on Sunday night, drove along the Delhi-Mumbai Expressway, and exited near Firozpur Jhirka in Haryana’s Nuh district, where he parked near a roadside eatery and spent the night inside his car. “He appeared to be in hiding but not in panic. He avoided large towns and preferred highways and small eateries,” a senior officer said.

On Monday morning, he was seen again on multiple CCTV cameras, stopping briefly for tea and checking his phone before re-entering Delhi through the Badarpur border at around 8:13 am. He then drove through Okhla, Connaught Place, East Delhi, and Ashok Vihar, apparently to confuse surveillance or study crowd movements. Later, he stopped at a dhaba in northwest Delhi, ate lunch, and then went to a mosque near Asaf Ali Road, where he stayed parked for nearly three hours.

Around 3:19 pm, Umar parked his white i20 near the Red Fort complex in the Sunehri Masjid parking area. The vehicle remained there for nearly three hours before being driven out towards the Metro Station side around 6:22 pm. Barely 30 minutes later, the car exploded in a powerful blast that shattered windows and ignited nearby vehicles. Footage from traffic surveillance cameras captured the moment the slow-moving car erupted into flames, sending shockwaves through the area.

Officials say the blast was part of a broader plan to stage coordinated attacks across four major Indian cities. The conspiracy, according to investigators, involved eight accused who had divided themselves into four pairs, each assigned to a different city with multiple IEDs in possession. “They had the logistics, the material, and the funds ready. What they lacked was only time,” an official said.

During raids across Delhi, Haryana, and Uttar Pradesh, police seized over 3,000 kilograms of ammonium nitrate, potassium chlorate, and sulphur, materials commonly used in the manufacture of explosives. They also discovered that the accused had purchased 2,600 kilograms of NPK fertiliser—worth about Rs 3 lakh—from suppliers in Gurugram, Nuh, and surrounding towns. The purchases were funded from a pooled sum of Rs 26 lakh raised by the accused, reportedly contributed by Dr Muzammil Ahmad Ganaie, Dr Adeel, Umar, and Dr Shaheen Shahid. The money was handed over to Umar for operational use, police said.

Investigators also recovered coded notebooks and diaries from rooms rented by Umar and Muzammil on the Al Falah University campus. The entries, dated between November 8 and 12, contained numerical codes, names, and repeated references to the word “operation”, indicating detailed planning for multiple attacks. The documents also included mentions of 25 to 30 individuals, many from Jammu and Kashmir as well as Faridabad and adjoining areas, suggesting a wider network of associates.

Authorities have described the use of encrypted communication as one of the most challenging aspects of the case. The suspects relied on the Switzerland-based app Threema, which allows users to communicate through unique IDs without using phone numbers or email addresses. “They had even created a private Threema channel for coordination,” an investigator said, adding that a smaller Signal group was also used for operational messaging. Such encrypted channels made real-time monitoring almost impossible.

The government’s response was swift. Following a one-and-a-half-hour review meeting chaired by Union Home Minister Amit Shah, the Centre ordered a forensic audit of Al Falah University’s records and directed the Enforcement Directorate and other agencies to investigate its finances. The Association of Indian Universities later suspended Al Falah’s membership, citing that the institution “does not appear to be in good standing.” The National Assessment and Accreditation Council had earlier issued a show-cause notice to the university for displaying false certifications on its website.

Meanwhile, the Uttar Pradesh ATS detained two more suspects linked to the case. Dr Farukh, an assistant professor of obstetrics at GS Medical College in Hapur, was taken into custody from the college campus on Wednesday night. Another, Mohammad Arif Mir, a first-year DM cardiology student at Kanpur’s GSVM Medical College, was detained in Kanpur and later transferred to Delhi after his laptop and mobile phone were seized for forensic analysis. Both men hail from Jammu and Kashmir and are believed to have studied or worked with other accused members of the module.

Officials said that the investigation also led to the identification of several vehicles connected with the conspiracy. The first, a Swift Dzire registered in the name of Dr Shaheen, was seized with weapons and incriminating material inside. The second, the white i20 used in the Red Fort blast, was destroyed in the explosion. A third vehicle, a Ford EcoSport, was traced to Faridabad, while a fourth, a Maruti Brezza, is still being hunted by the Faridabad Crime Branch. A fifth car, believed to have been used for reconnaissance, remains untraced.

The Jammu and Kashmir Police have now approached Interpol seeking a Red Corner Notice against Dr Muzaffar of Qazigund, who is believed to be in Afghanistan. Muzaffar, the brother of accused Dr Adeel, was part of the same network and reportedly left India for Dubai in August. His name surfaced during interrogation, with several suspects confirming that he had travelled to Turkiye in 2021 with Dr Umar Nabi and Dr Muzammil Ganaie. Officials said the three doctors were in Turkiye for 21 days, ostensibly for academic purposes, but are suspected to have come into contact with radical elements during their stay.

Reacting to reports linking Turkiye to the case, its Directorate of Communications’ Centre for Countering Disinformation issued a statement denying any role. “Claims that Turkiye provides logistical, diplomatic, or financial support to terrorist groups operating in India are entirely baseless and disinformative,” it said, calling the allegations “a malicious attempt to damage bilateral relations.”

As the investigation deepens, intelligence agencies are focusing on the digital trail left behind by the accused and their sources of radicalisation. Preliminary analysis suggests the group operated under the guise of legitimate medical professionals while actively planning acts of terror. Several online communication channels and social media groups they joined over the past two years are being examined for links to foreign handlers.

The Delhi Police have termed the operation one of the most sophisticated domestic terror conspiracies uncovered in recent years, given the professional backgrounds of the accused and their technological sophistication. “It is a case of educated radicalisation,” said a senior investigator. “Highly qualified individuals, including doctors and professors, used their positions and access to resources to mask an organised terror plot.”

Political reactions followed swiftly, with the Congress party calling for Prime Minister Narendra Modi to convene an all-party meeting and advance the Winter Session of Parliament, scheduled to begin on December 1, for a discussion on the incident. “There must be accountability. The home minister cannot evade responsibility when such serious attacks take place,” said Congress spokesperson Pawan Khera.