Delhi blast: Probe finds handler shared 42 'bomb-making' videos with doctor

A foreign handler allegedly sent 42 'bomb-making' videos to a doctor on encrypted apps, as agencies check if the Delhi blast module used methods seen in earlier Karnataka and Tamil Nadu cases

blast, Delhi Blast, Bomb Blast
Security personnel at the spot after a blast occurred in a parked car near Red Fort. (Photo/PTI)
Rimjhim Singh New Delhi
4 min read Last Updated : Nov 21 2025 | 9:54 AM IST
Investigators looking into the Red Fort blast-linked terror module have uncovered a trail of encrypted communications, bomb-making videos, and possible links to earlier attacks in Karnataka and Tamil Nadu, The Indian Express reported.
 
One of the three suspected foreign handlers sent as many as 42 bomb-making videos to the arrested doctor, Muzammil Ahmad Ganai, through encrypted apps. Ganai worked at Faridabad’s Al Falah Medical College and was closely associated with Umar Nabi, 36, who carried out the explosion.
 
Security agencies are now studying the roles of the three handlers, identified only by their pseudonyms,  “Hanzullah”, “Nisar” and “Ukasa”. Investigators believe these individuals guided the module in assembling the explosives and pushed them towards carrying out a suicide attack, the news report said.
 
The handler using the alias “Hanzullah” sent over 40 instructional videos to Dr Ganai, who allegedly helped store the explosives for the module. Ganai was arrested days before the blast, and police recovered over 2,500 kg of explosive material, including 350 kg of ammonium nitrate, from his residence.  ALSO READ: Doctors, engineers engaging in anti-national activities: Delhi police in SC

Focus on a known foreign handler

 
Investigators have also identified another suspected handler, Mohammed Shahid Faisal, who operates online using names like “Colonel”, “Laptop Bhai”, and “Bhai". He has been on the radar for coordinating terror modules in Karnataka and Tamil Nadu since 2020. Faisal is linked to the Coimbatore car suicide blast (2022), the Mangaluru autorickshaw blast (2022), and the Bengaluru Rameshwaram Cafe blast (2024).
 
Faisal, an engineering graduate from Bengaluru, disappeared in 2012 after an alleged Lashkar-e-Taiba-linked plot was uncovered. He reportedly fled to Pakistan and later moved near the Syria-Turkey border. His identity resurfaced during the National Investigation Agency (NIA)’s probe into the Rameshwaram Cafe blast, the news report said.
 
One of the handlers in the Delhi module, “Ukasa”, is also believed to be based in Turkey, raising the possibility of overlap.

Similarities to the Coimbatore suicide blast

 
The Red Fort blast shares several similarities with the Coimbatore suicide car blast, the news report said. In that case, mechanical engineering graduate Jamesha Mubin (28) died when a second-hand Maruti 800 exploded outside a temple in 2022. A search of Mubin’s premises led to the recovery of chemicals such as potassium nitrate and PETN, as well as materials linked to DIY bomb-making methods shared over encrypted apps.
 
The NIA found that Mubin had been radicalised through remote handlers and had recorded self-confession videos explaining his motives. His group used fertilisers like urea to extract ammonium nitrate for the bomb.

Common handlers across states

 
According to The Indian Express, the terror modules in Tamil Nadu, Karnataka, Delhi, Padgah and Pune followed similar patterns: online radicalisation, DIY explosives, and no direct contact with each other. This raised suspicion that common handlers were guiding these separate groups.
 
Faisal was identified as the key handler after the arrests of Mussavir Hussain Shazib and Abdul Matheen Taha, accused in the Rameshwaram Cafe blast case. “The Islamic State online handler ‘Colonel’ conspired to radicalise and recruit youths,” a special NIA court observed during the framing of charges.
 
Faisal is also accused of sending money through cryptocurrency and sharing bomb-making videos with Mohammed Shariq, who suffered injuries in an accidental blast in Mangaluru in 2022 while transporting an IED.
 
Investigators have found striking similarities in the use of encrypted platforms such as Signal, Session and Telegram to circulate bomb-making content. Following the November 10 Delhi blast, security agencies have questioned Islamic State-linked suspects lodged in prisons in Karnataka and Tamil Nadu to identify the handlers involved in the Red Fort case, the news report said.
*Subscribe to Business Standard digital and get complimentary access to The New York Times

Smart Quarterly

₹900

3 Months

₹300/Month

SAVE 25%

Smart Essential

₹2,700

1 Year

₹225/Month

SAVE 46%
*Complimentary New York Times access for the 2nd year will be given after 12 months

Super Saver

₹3,900

2 Years

₹162/Month

Subscribe

Renews automatically, cancel anytime

Here’s what’s included in our digital subscription plans

Exclusive premium stories online

  • Over 30 premium stories daily, handpicked by our editors

Complimentary Access to The New York Times

  • News, Games, Cooking, Audio, Wirecutter & The Athletic

Business Standard Epaper

  • Digital replica of our daily newspaper — with options to read, save, and share

Curated Newsletters

  • Insights on markets, finance, politics, tech, and more delivered to your inbox

Market Analysis & Investment Insights

  • In-depth market analysis & insights with access to The Smart Investor

Archives

  • Repository of articles and publications dating back to 1997

Ad-free Reading

  • Uninterrupted reading experience with no advertisements

Seamless Access Across All Devices

  • Access Business Standard across devices — mobile, tablet, or PC, via web or app

More From This Section

Topics :Delhi blastterror attacksRed FortBS Web Reports

First Published: Nov 21 2025 | 9:25 AM IST

Next Story