The car blast near Red Fort Metro left at least 13 people dead and several others injured.(Image: X)

Investigations into the blast near Delhi’s Red Fort last year have revealed that the accused used a network of so-called “ghost” SIM cards and encrypted apps to stay in touch with handlers based in Pakistan, officials said on Sunday.

The blast took place on November 10, 2025, near Gate 1 of the Red Fort Metro Station during evening rush hour. A powerful car bomb exploded at a traffic signal, killing 13 people and injuring more than 20 others. The explosion involved a Hyundai i20 car driven by a suspected terrorist identified as Dr Umar Nabi.

“White-collar” terror module

Officials said the investigation points to a “white-collar” terror module made up of highly educated individuals, including doctors. Those arrested include Muzammil Ganaie, Adeel Rather and others. The group allegedly used a sophisticated system of ghost SIM cards and encrypted messaging platforms to avoid detection.

According to investigators, the accused followed a “dual-phone” method. One phone was used with a physical SIM card, while another device ran encrypted apps linked to ghost SIMs. This allowed them to communicate without leaving clear digital traces.

The findings of the probe led the Department of Telecommunications to issue a major directive on November 28 last year. Under the order, app-based communication services such as WhatsApp, Telegram and Signal must remain continuously linked to an active, physical SIM card inside the device.

Delhi Red Fort blast

The investigation also found that the bomb was made using ammonium nitrate and high-grade explosives. A large stockpile of around 2,900 kg of such material was seized from Faridabad on the same day. Officials said Nabi may have panicked after the arrest of his aides, Dr Muzammil Shakeel and Dr Adeel Ahmad Rather, who were allegedly linked to Jaish-e-Mohammed and Ansar Ghazwat-ul-Hind.

Security agencies believe the group was planning attacks similar to the 26/11 Mumbai terror strikes and had conducted reconnaissance of major targets, including the Constitution Club and the Gauri Shankar Temple. CCTV footage captured the moment of the blast and has been used as key evidence.

The National Investigation Agency has invoked the Unlawful Activities (Prevention) Act and taken custody of nine suspects, including Aamir Rashid Mir.