The blast car was confirmed as a “vehicle-borne improvised explosive device (IED)”.
The driver was identified as Umar Un Nabi — a doctor from Pulwama, Kashmir, who was working as an assistant-professor at Al-Falah University in Faridabad.
Forensics confirmed the body and DNA matched with his family, confirming he was at the wheel when the car exploded.
The blast used a combination of explosives: preliminary reports say the explosives included ammonium-nitrate/fuel-oil mix and detonators.
Investigators believe the plan was not just one attack: evidence suggests a wider terror conspiracy. They found plans to rig up to 32 vehicles for coordinated attacks across multiple cities.
The terror network is being described as a “white-collar terror module” — meaning many suspects are educated professionals (doctors) rather than stereotypical “militant” profiles.
The group allegedly used “spy-craft” tactics: encrypted communications, temporary email drafts (never sent), apps without phone-number linkage, and a private server for planning/coordination to avoid leaving a digital trail.
Who’s been arrested — and how big is the network ??
Since the blast, National Investigation Agency (NIA) has made multiple key arrests across different states — J&K, Haryana (Faridabad), Delhi, Uttar Pradesh — as the network appears wide and cross-state.
One major recent arrest: a man named Soyab from Faridabad — accused of sheltering Umar Un Nabi for 10 days before the blast.
Another suspect: Amir Rashid Ali (from Jammu & Kashmir) — the car used in the blast was registered in his name. Authorities claim he travelled to Delhi to buy the Hyundai i20 later used as the IED.
Other arrests include alleged accomplices who provided technical support, procured equipment, and attempted to modify drones / make rockets as part of the larger terror plan.
So far, 73 witnesses — including the injured — have been examined. Several vehicles have been seized, and some registered to suspects.
What the investigation agencies say — motive, links & bigger picture ??
The terror module has alleged links with militant organisations Jaish-e-Mohammed (JeM) and Ansar Ghazwat-ul-Hind (AGH), according to initial intelligence inputs.
The module seems to have been active for a while — not a last-minute plot. Explosives and materials were reportedly gathered over time; weapons were procured since 2023–24.
Financial tracking suggests that around ₹20 lakh was collected for “operational expenses” — used for buying fertilizer (precursor for bombs), obtaining vehicles, and other logistics — which indicates premeditation and resource mobilization over months.
The use of educated professionals (doctors) highlights a shift in modus operandi — a “doctor-module” rather than traditional ground-level militants — which agencies describe as “white-collar terror” to avoid early suspicion and blend in.
