When a car bomb went off near the Red Fort in Delhi on November 10, 2025, killing at least 15 people, it appeared at first to be a sudden and shocking breach of security in the heart of the capital.
But the explosion did not come out of nowhere.
By the time the blast took place, security agencies had already spent weeks tracking a Jaish-e-Mohammad-linked network, making arrests and seizing weapons and explosives across Jammu and Kashmir, Haryana, and Uttar Pradesh. Investigators now believe the blast came as that network was being dismantled.
The blast and the hours before it
The explosion occurred at around 6.50 pm on Netaji Subhash Marg, close to the Red Fort complex. As it was a peak traffic time, the impact was felt across central Delhi, triggering immediate alerts and the deployment of multiple security agencies.
CCTV footage later showed the Hyundai i20 used in the blast entering the Sunehri Masjid parking area near the Red Fort at around 3.19 pm. The car remained in the vicinity for nearly three hours and exited shortly before the explosion.
What the driver, identified as Dr Umar Mohammad alias Umar-un-Nabi, did during this period became a key question. Police later traced his movements through CCTV cameras placed across the area. Investigators believe he spent time in a mosque on Asaf Ali Road, close to Ramlila Maidan, before driving towards the Red Fort stretch where the blast occurred.
How the investigation had already begun
The chain of events leading to November 10 began much earlier.
On October 19, police in Srinagar registered an FIR after posters linked to Jaish-e-Mohammad appeared in areas under the Nowgam police post. The probe led to arrests between October 20 and 27, including Maulvi Irfan Ahmed Waghe from Shopian and Zameer Ahmed from Ganderbal.
From there, the investigation widened quickly.
On November 5, Dr Adeel was arrested in Saharanpur. Two days later, an AK-56 rifle and ammunition were seized from an Anantnag hospital. On November 8, raids at Al-Falah Medical College in Faridabad led to the recovery of weapons and 358–360 kg of explosive material and the arrest of Dr Mujammil Shakeel, who hailed from Jammu and Kashmir’s Pulwama.
Faridabad seizures tighten the net
On November 9, another suspect, named Madrasi, was detained in Faridabad’s Dhauj, which is around 45 km from Delhi. The following day, hours before the Red Fort blast, police seized 2,563 kg of explosives from the house of Mewat-resident Hafiz Mohammad Ishtiaq, who was holding the post of Imam at Al-Falah Mosque in Faridabad’s Dhera Colony.
In total, security agencies seized close to 3,000 kg of explosives from locations linked to the module.
Officials said the explosive material used in the Red Fort blast was from the same stock that had been assembled in Faridabad.
Umar changes location
As arrests mounted and recoveries were made, Dr Umar, who worked at Al-Falah Medical College and was part of the same network, changed locations.
CCTV footage later confirmed that he was driving the car that exploded near the Red Fort.
Planning, money and coordination
The probe showed that the module operated through encrypted messaging platforms, with different members handling recruitment, finances, and logistics.
Investigators traced a hawala-linked money trail, including a transfer of about Rs 20 lakh. Officials said the money was used to buy fertiliser-grade material that was later processed into explosives.
Forensic tests indicated the use of ammonium nitrate–based explosives, pointing to a vehicle-borne blast. Investigators also recovered digital data, handwritten notes, and weapons during the raids, which suggested that the planning had been underway for several months.
Missed timelines and internal strain
Investigators said there were signs of disagreement within the group. Proposed attack dates were discussed and postponed, from August 15 to December 6, with January 26 also featuring in conversations.
Some officials believe the November 10 blast did not follow the original plan and took place as the network began to collapse following the Faridabad seizures.
Institutions under scrutiny
As the probe widened, Al-Falah University came under scrutiny because several accused were linked to it.
The Delhi Police Crime Branch registered two FIRs against the institution under cheating and forgery provisions. The Association of Indian Universities suspended its membership, and the NAAC issued a show-cause notice over accreditation-related claims.
The university said it had only a professional association with the accused doctors and expressed anguish over the developments.
Foreign links under probe
By mid-November, investigators began examining possible links outside India.
Agency reports referred to contacts in Afghanistan and Turkey, suggesting that handlers may have operated from abroad to avoid a direct trail. One alleged handler, Faisal Iqbal, was named in agency inputs, while Mufti Irfan Ahmed was identified as a local facilitator involved in recruitment and logistics.
A Red Corner Notice was sought against one accused believed to be abroad. Turkey has denied that its territory was used for radicalisation activities.
Arrests towards year-end
The investigation continued into December. On December 18, the National Investigation Agency arrested Yasir Ahmad Dar, described as the ninth accused in the case, under the UAPA and BNS.
Earlier arrests included Dr Bilal Naseer Malla, and searches across Jammu and Kashmir, Uttar Pradesh, and Haryana led to the seizure of digital devices and other material.
Where the case stands
As the year ends, investigators no longer see the Red Fort blast as an isolated act.
They describe it as part of a wider network involving recruitment, funding, logistics, and alleged foreign guidance. What remains to be established in court is whether the November 10 explosion was meant to be the final act or whether it happened as the plot began to unravel under sustained pressure from security agencies.
