Return of domestic terrorism in India, this time with help from neighbours and global Jihadist groups

In 2011, Indian Mujahideen was a familiar name for security agencies, who described it as India’s first truly domestic terrorist organisation. The group’s objective was to carry out bomb blasts across multiple Indian cities, and for several it succeeded, including in Delhi. Eventually, the NIA and other agencies arrested its leaders and dismantled its networks. At the time, many believed India had defeated domestic Islamist terrorism — home-grown plots carried out by radicalised individuals who, at least on the surface, did not have detailed operational links to global jihadist groups. Further investigations revealed that IM was not just domestic: It had backing from Pakistan-based groups and possibly its spy agency, ISI. Cut to 2025: An apparently accidental blast in Delhi’s Red Fort area on November 10 opened the eyes of security forces to a new era of domestically grown terrorism, this time with some help from neighbouring countries and global jihadist organisations.

Indian Mujahideen and the crackdown on domestic terror

Indian security agencies dismantled the Indian Mujahideen through a series of arrests, including its founder Yasin Bhatkal in 2013 and Abdul Subhan Qureshi in 2018. This was followed by a period of relative calm in major Indian cities, interrupted only by the large-scale cross-border terror attacks in Uri (2016) and Pulwama (2019) and Pehelgam attack this year, all attributed to Pakistan-based handlers. Indian Mujahideen, despite being described as a domestic group, was rooted in Students Islamic Movement of India (SIMI) networks. It received ideological, logistical, and some operational support from Pakistan-based Lashkar-e-Taiba and HuJI. Its bomb-making expertise and funding was tracked to Karachi and Gulf-based handlers.
Today, India is once again confronting a resurgence of a similar threat — but the new version looks different.

Also read: Delhi blast suspects used ‘dead drop’ emails to plan attacks, reveals probe

What’s same and what’s different about the new domestic terrorists?

The most disturbing aspect of the new wave of Islamist domestic terrorism is how elusive these actors have been, and the fact that they consist of “white-collar terrorists” — doctors, lecturers, software engineers, clerics, and university students hiding in plain sight. Unlike the IM’s centralised Pakistan-linked structure, these new modules consist of self-radicalised professionals operating in decentralised sleeper cells. Their radicalisation is largely online, inspired by the Islamic State and al-Qaeda, without requiring them to physically travel to conflict zones or to Pakistan-based terror training camps.

New domestic terrorists are adept at the use of technology

Investigations show that many members of these modules maintained double lives, working as doctors, teachers, or tech professionals while quietly plotting attacks. They used a mix of old and new technologies: dead-drop emails, encrypted communications through WhatsApp, Telegram, Signal, Threema, and WhatsApp clones. They consumed and circulated online propaganda, often through dark web channels. Despite being fragmented, they established transnational linkages both online and offline. Support from handlers or aligned groups in Pakistan, and allegedly in Turkey, has also emerged in several investigations.

Sleeper cells uncovered — but who was sleeping?

While it must be acknowledged that alert security agencies have thwarted several potential attacks and arrested ISIS- and al-Qaeda-linked modules since the Delhi blast, one cannot ignore the question: how were these groups not detected earlier, especially as reports now indicate that the Delhi module had been plotting attacks for three years? The answer may be in how difficult it is to crack open these sleeper modules, because most of them are autonomous, decentralised and self-organised.

Also read: Delhi blast: Over 2,000 Kashmiri students, tenants questioned, 13k CCTV footage scanned

The self-starter terrorist: A new breed of globally linked domestic extremist

Once the genie was out of the bottle following the Faridabad raid and the Delhi blast, security agencies moved swiftly, disrupting ISIS-inspired cells from Hyderabad in the south to Kashmir in the north. The sheer number of professionals involved has shocked investigators: doctors, engineers, IT experts, and corporate executives. Many of them are believed to have self-radicalised on Telegram, dark web forums, and ISIS publications tailored to South Asia, such as “Voice of Hind”. Most operate autonomously with no need for the old model of crossing borders.
Funding appears to rely on hawala-based micro-transfers, online donations and cryptocurrency, rather than large foreign remittances.

A pan-India threat: What the investigations revealed

What is worrying is the near-national footprint of these groups. In the Pune–Thane region of Maharashtra, anaesthesiologist Dr Adnan Ali Sarkar and IT professional Tabish Siddiqui were charged with recruiting youth, manufacturing improvised explosive devices, and preparing to impose “Islamic rule” in India. Another conspirator, Rizwan Ali, was arrested in Lucknow after avoiding capture for months.
In Karnataka, a Ballari-based cell led by Minaj, alias Md Sulaiman, was found with sulphur, potassium nitrate, weapons, and ISIS literature, and is believed to have radicalised young men online. A Hyderabad-based suspect previously investigated for attempting to produce ricin poison has also resurfaced in ISIS-linked probes. In Tamil Nadu's Chennai, ISIS recruiter Abdul Basith was arrested for radicalising youth through restricted WhatsApp groups.

The global reach of India’s domestic terrorists

Despite many not having fought alongside foreign terrorist groups, the new domestic terrorists in India have demonstrated the ability to form transnational linkages. In Vizianagaram, Andhra Pradesh, accused operative Arif Husain is believed to have procured weapons through the Nepal border. A couple, including one person with an OCI (Overseas Citizen of India) card, was arrested in Nepal with suspected links to the Delhi blast module. International hideouts are also becoming part of their ecosystem. Pune conspirators Abdullah Faiyaz Shaikh and Talha Khan were detained after months of hiding in Indonesia.

Delhi blast: Only the tip of the iceberg?

The premature blast on November 10 is emblematic of this new threat. The bomber, Dr Umar Un Nabi, was an assistant professor of general medicine from Pulwama working at Al-Falah University in Faridabad. He was part of a Jaish-e-Mohammed-linked white-collar module of Kashmiri doctors radicalised online. Reports suggest the group had planned a series of blasts similar to the one at Red Fort for at least three years. Their aim was to deploy as many as 32 vehicles in serial VBIED (Vehicle-Borne Improvised Explosive Device) attacks.
Some members were in the process of modifying drones for Hamas-style strikes and experimenting with crude rocket fabrication. Jasir Bilal Wani, one of the arrested, is being described as a “drone technician”.
More than 2,900 kg of explosives seized in raids in Faridabad near Delhi revealed the shocking scale of the threat. While this seizure may have prevented a devastating chain of attacks, the accidental explosion at Nowgam police station during the handling of the seized material showed just how potent it was.

Universities as operational hubs: The shift from the IM era to the white-collar module era

At least in the Faridabad module, a university campus was used as an operational base, raising serious concerns about how deeply India’s professional and academic spaces have been infiltrated.

IM grew out of SIMI and had a hierarchical structure supported by handlers in Pakistan. Today’s domestic terrorist modules do not appear to have rigid structures or defined leadership. They form in online echo chambers. Radicalisation no longer requires madrassa networks or riot-linked grievances; it now happens through targeted digital propaganda. Jihad has been gamified for young Indian recruits.
While IM used basic emails and low-tech devices, the 2020s modules operate at the cutting edge of technology: encrypted apps, cryptocurrency-based funding, and carefully maintained digital invisibility.

The new demographic of terror in India

This is no longer a profile of angry, lower-middle-class youths with limited exposure. The new recruits are doctors, engineers, corporate employees, and university students — people with access to money, mobility, professional networks, and technical expertise.

Earlier, domestic groups depended heavily on Pakistan-based LeT, JeM, and HuJI for training and funding. While some links still exist, today’s cells pledge allegiance online to ISIS’s global caliphate or al-Qaeda’s Ghazwa-e-Hind vision, which refers to a theological narrative about the conquest of India. There is no proven direct physical contact with these groups, though Pakistan’s proxies and handlers may still exert influence. Operationally, however, the engine is domestic and self-driven.

Islamist domestic terrorism never disappeared — it adapted

All evidence points to a disturbing conclusion: domestic terrorism in India with global linkages never truly ended; it adapted to a new era. Its tactics have shifted dramatically. Instead of serial blasts in crowded markets, the new wave features suicide VBIEDs, drone experiments, rocket prototypes, and multi-city attack plans executed with professional precision. Long-term planning and sophisticated communication methods have made detection harder, especially as these operatives blend seamlessly into mainstream society.
India is now confronting a more sophisticated, decentralised, and transnational version of a monster once believed to be defeated — but clearly rising again.