Foreign handler sent 42 bomb-making videos to Delhi doctor, exposing pan-India DIY terror network

Investigators probing the Red Fort blast-linked terror module have unearthed an alarming digital trail — encrypted chats, video tutorials and a suspected chain of foreign handlers who may have orchestrated similar “do-it-yourself” bomb attacks across India in recent years, according to Indian Express.

One of the three alleged handlers sent as many as 42 bomb-making videos to arrested Faridabad doctor Muzammil Ahmad Ganai through encrypted apps, according to the investigation.

Ganai, a faculty member at Al Falah Medical College, was allegedly working in close coordination with Umar Nabi, 36, the man who executed the Red Fort explosion.

Authorities believe the foreign handlers — operating under pseudonyms “Hanzullah”, “Nisar” and “Ukasa” — not only provided technical explosive-assembly support but also pushed the module towards a suicide mission.

A senior handler using the alias “Hanzullah” is said to have shared over 40 instructional videos with Ganai, who allegedly stored the explosive materials. Ganai’s arrest days before the blast led investigators to a staggering haul — over 2,500 kg of explosive material, including 350 kg of ammonium nitrate, recovered from his residence.

Focus turns to a familiar foreign recruiter

Security agencies have now zeroed in on another suspected handler — Mohammed Shahid Faisal, an engineering graduate from Bengaluru who vanished in 2012 after a LeT-linked plot was exposed.

Known online as “Colonel”, “Laptop Bhai” and “Bhai”, Faisal has been flagged as the key coordinator behind multiple terror modules across Karnataka and Tamil Nadu since 2020.

His name surfaced during the NIA’s investigation of the Bengaluru Rameshwaram Café blast (2024). He is also linked to the Coimbatore suicide car blast (2022) and the Mangaluru autorickshaw blast (2022).

Investigators believe Faisal fled to Pakistan before relocating near the Syria – Turkey border. One handler involved in the Delhi module, “Ukasa”, is also suspected to be based in Turkey, raising the likelihood of operational overlap.

Digital indoctrination, remote control

The modus operandi in the Red Fort blast mirrors the Coimbatore suicide attack, investigators say. In the 2022 case, 28-year-old mechanical engineer Jamesha Mubin died when an explosive-laden Maruti 800 detonated outside a temple. Searches revealed chemicals such as potassium nitrate and PETN, and manuals consistent with DIY videos sent over encrypted platforms.

The NIA found Mubin had been radicalized by shadow handlers who instructed him to record a self-confession before attempting the attack. Fertilizer-grade urea was used to extract ammonium nitrate, similar to the material recovered in Delhi.

Common masterminds across states?

Modules in Tamil Nadu, Karnataka, Delhi, Padgah and Pune share striking similarities —
🔹 remote radicalization
🔹 assembly-based explosives
🔹 isolated, unconnected local cells
🔹 absence of physical contact among operatives

Following the arrest of Mussavir Hussain Shazib and Abdul Matheen Taha in the Rameshwaram Café case, investigators identified Faisal as the mastermind. A special NIA court observed that the Islamic State handler “Colonel” radicalized and recruited youth for attacks.

He is also accused of sending cryptocurrency funds and bomb-making instructions to Mohammed Shariq, who was injured in an accidental blast while transporting an IED in Mangaluru in 2022.

Security agencies have now questioned several Islamic State-linked suspects lodged in prisons in Karnataka and Tamil Nadu to identify the handlers associated with the Red Fort module. Encrypted platforms such as Signal, Session and Telegram continue to remain key communication tools for the terror network.