Pak-bought phones, IP address, terror network: NIA busts lies on Pahalgam attack
The Pahalgam attack charge sheet says TRF claimed responsibility through the Kashmir Fight Telegram channel. The NIA traced the channel to Pakistan, undercutting the later hacked-account claim.
The National Investigation Agency (NIA) has filed its chargesheet in the 2025 Pahalgam attack, in which 26 civilians were killed, detailing what it says is a Pakistan-based conspiracy orchestrated by handlers linked to Lashkar-e-Taiba and its proxy outfit The Resistance Front (TRF). The NIA has established vivid linkages between the attackers and their handlers in Pakistan, sharing details of their IP address, phone numbers and other evidence.
MASTERMIND SAJID JATT (LANGDA)
The chargesheet names Pakistan-based operative Saifullah alias Sajid Jatt/Langda as the principal accused and says the attack was directed by him in real time from Pakistan.
According to the NIA, the probe has established "clear technical and human intelligence evidence" linking the three attackers to handlers in Pakistan, while also exposing what investigators describe as an attempted disinformation campaign to project the massacre as a "false flag" operation.
The claim surfaced within hours of the attack and was amplified widely by Pakistani social media accounts, even as TRF had initially claimed responsibility through its online channels.
IP ADDRESS TRACED TO PAKISTAN
Investigators said the first claim of responsibility came through a Telegram channel called ‘Kashmir Fight’ (IP Address: 223.123.85.41).
Technical analysis found the channel was being operated from Battagram in Pakistan’s Khyber Pakhtunkhwa province.
After the United Nations Security Council (UNSC) condemned the killings, TRF claimed its channel had been hacked and denied any role.
A second channel, TheResistanceFront_Official, was also traced by investigators to Rawalpindi.
The agency says this sequence formed part of a coordinated attempt to distance the group from the killings after international attention intensified.
MOBILE PHONES BOUGHT IN PAKISTAN
The chargesheet also cites forensic evidence from two mobile phones recovered from two of the three terrorists killed during Operation Mahadev.
The devices, according to Xiaomi’s supply-chain records accessed by investigators, were sold and delivered in Pakistan.
Quoting the chargesheet, the NIA said, “The report provided by Xiaomi India regarding the supply chain and origin of the said devices clearly establishes that both mobile phones were sold in Pakistan.”
One device, with IMEI numbers 865792067481628/636, was delivered to an address in Quaid-e-Azam Industrial Estate, Kot Lakhpat, Lahore.
The second, with IMEI numbers 867906051958387/395, was delivered to Shahrah-e-Faisal in Karachi.
The agency says this establishes both logistical support and operational planning from across the border.
SAJID JATT – ACCUSED NO. 1
Saifullah alias Sajid Jatt, listed as Accused No. 1, has been identified by the NIA as a top TRF commander operating from Lahore.
The chargesheet states that "Sajid Jatt @ Ali is the commander of the proscribed terrorist organisation Lashkar-e-Taiba/The Resistance Front".
It adds that he remained in constant communication with the attackers during the assault and was guiding them by sharing coordinates.
NIA records show Sajid was born in Kasur, Pakistan, and infiltrated into Jammu and Kashmir in 2005.
He stayed in Kulgam between 2005 and 2007, married a local woman named Shabbira and had a son.
He later returned to Pakistan with his wife, while his son remained in Kashmir.
The agency also recorded statements from his son and family members as part of the probe.
BUILT KASHMIR NETWORK, DIRECTED ATTACK FROM LAHORE
According to investigators, Sajid built an extensive network of overground workers in south Kashmir and used it to execute multiple attacks.
The NIA says the Pahalgam massacre was carried out through this same network.
The chargesheet says he played a central role in creating TRF after the abrogation of Article 370 in 2019 and continues to run cross-border arms and narcotics smuggling into Jammu and Kashmir using drones.
Investigators said Sajid, who lost a leg in a gunfight and now uses a prosthetic limb, dispatched the three attackers toward Besaran Valley on April 15–16, indicating the conspiracy was finalised days before the massacre.
CREATION OF TRF POST A 370 ABROGATION
NIA says that after the abrogation of Article 370 in 2019, he played a key role in creating TRF as Lashkar’s local proxy.
He is also accused of facilitating arms and narcotics smuggling into Jammu and Kashmir through drones.
A witness statement cited in the chargesheet says the three terrorists spoke in Urdu with a Punjabi accent and referred to the name “Jatt @ Ali” during their stay in a local shelter before the attack.
The witness also told investigators the terrorists discussed the Amarnath Yatra, nearby security camps and troop movements.
A reward of Rs 10 lakh has been announced for Sajid Jatt, who investigators say remains one of India’s most wanted terrorists.
The National Investigation Agency (NIA) has filed its chargesheet in the 2025 Pahalgam attack, in which 26 civilians were killed, detailing what it says is a Pakistan-based conspiracy orchestrated by handlers linked to Lashkar-e-Taiba and its proxy outfit The Resistance Front (TRF). The NIA has established vivid linkages between the attackers and their handlers in Pakistan, sharing details of their IP address, phone numbers and other evidence.
MASTERMIND SAJID JATT (LANGDA)
The chargesheet names Pakistan-based operative Saifullah alias Sajid Jatt/Langda as the principal accused and says the attack was directed by him in real time from Pakistan.
According to the NIA, the probe has established "clear technical and human intelligence evidence" linking the three attackers to handlers in Pakistan, while also exposing what investigators describe as an attempted disinformation campaign to project the massacre as a "false flag" operation.
The claim surfaced within hours of the attack and was amplified widely by Pakistani social media accounts, even as TRF had initially claimed responsibility through its online channels.
IP ADDRESS TRACED TO PAKISTAN
Investigators said the first claim of responsibility came through a Telegram channel called ‘Kashmir Fight’ (IP Address: 223.123.85.41).
Technical analysis found the channel was being operated from Battagram in Pakistan’s Khyber Pakhtunkhwa province.
After the United Nations Security Council (UNSC) condemned the killings, TRF claimed its channel had been hacked and denied any role.
A second channel, TheResistanceFront_Official, was also traced by investigators to Rawalpindi.
The agency says this sequence formed part of a coordinated attempt to distance the group from the killings after international attention intensified.
MOBILE PHONES BOUGHT IN PAKISTAN
The chargesheet also cites forensic evidence from two mobile phones recovered from two of the three terrorists killed during Operation Mahadev.
The devices, according to Xiaomi’s supply-chain records accessed by investigators, were sold and delivered in Pakistan.
Quoting the chargesheet, the NIA said, “The report provided by Xiaomi India regarding the supply chain and origin of the said devices clearly establishes that both mobile phones were sold in Pakistan.”
One device, with IMEI numbers 865792067481628/636, was delivered to an address in Quaid-e-Azam Industrial Estate, Kot Lakhpat, Lahore.
The second, with IMEI numbers 867906051958387/395, was delivered to Shahrah-e-Faisal in Karachi.
The agency says this establishes both logistical support and operational planning from across the border.
SAJID JATT – ACCUSED NO. 1
Saifullah alias Sajid Jatt, listed as Accused No. 1, has been identified by the NIA as a top TRF commander operating from Lahore.
The chargesheet states that "Sajid Jatt @ Ali is the commander of the proscribed terrorist organisation Lashkar-e-Taiba/The Resistance Front".
It adds that he remained in constant communication with the attackers during the assault and was guiding them by sharing coordinates.
NIA records show Sajid was born in Kasur, Pakistan, and infiltrated into Jammu and Kashmir in 2005.
He stayed in Kulgam between 2005 and 2007, married a local woman named Shabbira and had a son.
He later returned to Pakistan with his wife, while his son remained in Kashmir.
The agency also recorded statements from his son and family members as part of the probe.
BUILT KASHMIR NETWORK, DIRECTED ATTACK FROM LAHORE
According to investigators, Sajid built an extensive network of overground workers in south Kashmir and used it to execute multiple attacks.
The NIA says the Pahalgam massacre was carried out through this same network.
The chargesheet says he played a central role in creating TRF after the abrogation of Article 370 in 2019 and continues to run cross-border arms and narcotics smuggling into Jammu and Kashmir using drones.
Investigators said Sajid, who lost a leg in a gunfight and now uses a prosthetic limb, dispatched the three attackers toward Besaran Valley on April 15–16, indicating the conspiracy was finalised days before the massacre.
CREATION OF TRF POST A 370 ABROGATION
NIA says that after the abrogation of Article 370 in 2019, he played a key role in creating TRF as Lashkar’s local proxy.
He is also accused of facilitating arms and narcotics smuggling into Jammu and Kashmir through drones.
A witness statement cited in the chargesheet says the three terrorists spoke in Urdu with a Punjabi accent and referred to the name “Jatt @ Ali” during their stay in a local shelter before the attack.
The witness also told investigators the terrorists discussed the Amarnath Yatra, nearby security camps and troop movements.
A reward of Rs 10 lakh has been announced for Sajid Jatt, who investigators say remains one of India’s most wanted terrorists.
