NEW DELHI: The National Investigation Agency (NIA), in its charge sheet, has stated that both the claim of responsibility for the April 2025 Pahalgam terror attack and a later denial issued by the banned outfit The Resistance Front (TRF) originated from Pakistan.
Investigators said the first post appeared on the open-source social media platform Mastodon at around 4.32 pm on April 22, barely two-and-a-half hours after terrorists carried out the attack at Baisaran meadows near Pahalgam in Jammu and Kashmir. The message was circulated through a TRF-linked propaganda handle called “Kashmir Fight” and explicitly referenced the attack using the hashtag #PahalgamAttack.
The attack left 26 people dead, including 25 tourists - 24 Indians and one Nepali national - as well as a local Kashmiri resident. According to eyewitness accounts cited by investigators, the victims were singled out on the basis of religion and shot at close range in front of their families before the attackers fled the scene.
The TRF, a militant organisation active in Jammu and Kashmir and designated a terrorist group by both India and the United States, withdrew its claim three days later. On April 25, it used a newly created Telegram-based outlet titled “TheResistanceFront Official” to deny any involvement in the killings.
The NIA has described the retraction as an attempt by both the TRF and Pakistan to create plausible deniability in the face of global outrage and condemnation, including criticism from the United Nations Security Council.
According to the agency, digital forensics established that the internet protocol (IP) address used to publish the initial claim was traced to Battagram in Pakistan’s Khyber Pakhtunkhwa province. The Telegram account that issued the denial was traced to Rawalpindi and was registered using a Pakistani mobile phone number.
“TRF had claimed the Pahalgam attack 2.5 hours after the attack through social media posts. It withdrew the claim after three days. Analysis of both posts revealed that they were uploaded from Pakistan from handles associated with TRF,” a senior NIA official said, quoting the agency’s charge sheet filed before a Special NIA Court in Jammu.
The NIA formally took over the investigation on April 27, 2025, following directions from the Union Ministry of Home Affairs (MHA). Its charge sheet, filed on December 15, named Pakistan-based TRF chief Sajid Jatt as the mastermind behind the attack, alleging that he remained in direct contact with the three terrorists involved in the killings.
Three months after the attack, Union Home Minister Amit Shah informed Parliament that the attackers - Faisal Jatt alias Suleman Shah, Habeeb Tahir alias Jibran and Hamza Afghani - had been killed during Operation Mahadev, a joint operation by the Army, the CRPF and the Jammu and Kashmir Police in the Dachigam forest area near Srinagar.
The operation led to the recovery of the weapons used in the massacre as well as two mobile phones belonging to the terrorists. Investigators later discovered that both devices had been shipped to Pakistan by Chinese smartphone manufacturer Xiaomi, with company records showing deliveries to addresses in Karachi and Lahore.
A forensic examination of the phones uncovered screenshots stored in the AlpineQuest navigation application containing geographical coordinates adjacent to Baisaran meadows. The screenshots were taken on April 15 and April 16, 2025, indicating that reconnaissance and planning for the attack had begun at least a week before the attack.
