Operation Mahadev: How NIA linked Gagangir and Pahalgam attacks to one TRF module
Synopsis
One M-4 carbine, two massacres, five years of impunity. The NIA's ballistic match between Gagangir and Pahalgam cartridges is the forensic thread that unravelled a TRF module responsible for at least five attacks since 2023 — and pointed directly at a Pakistan-based handler who had been rebuilding LeT's Kashmir network from across the border.
Key Takeaways
Operation Mahadev on 28 July 2025 eliminated three LeT-TRF terrorists: Faisal Jutt alias Suleman , Habeeb Tahir alias Chottu , and Hamza Afghani .
Ballistic analysis confirmed the same M-4 carbine was used in both the Gagangir attack (20 October 2024) and the Pahalgam attack , formally linking the two.
The Gagangir attack on an APCO Infratech camp killed seven workers , including a doctor; the same TRF module planned both strikes.
The module is also linked to attacks in Poonch (December 2023, May 2024) and Reasi (June 2024) , killing six security personnel across those incidents.
Pakistan-based handler Sajid Jatt alias Ali Bhai ('Langda') directed the module through encrypted channels and is listed among India's most wanted terrorists.
NIA established Pakistan's direct role using digital forensics, CCTV footage , ballistic reports, IP tracking , and social media records.
The National Investigation Agency (NIA) has established that Operation Mahadev, which eliminated three Lashkar-e-Tayiba (LeT) terrorists on 28 July 2025, delivered accountability not only for the Pahalgam attack but also for the Gagangir terror attack of 20 October 2024, in which seven workers — including a doctor — were killed. Ballistic evidence and digital forensics confirmed that both strikes were executed by the same The Resistance Front (TRF) module, operating under Pakistani direction.
The Ballistic Link That Broke the Case
The critical breakthrough came from ballistic analysis. Cartridges recovered from both Gagangir and Pahalgam were found to have been fired from the same M-4 carbine — a weapon subsequently recovered by security forces during Operation Mahadev. This single piece of evidence formally connected the two attacks in the NIA's investigation.
On 20 October 2024, Pakistani terrorists stormed an APCO Infratech worker's camp near the strategic Z-Morh tunnel in Gagangir, Jammu and Kashmir, opening fire inside the dining mess and killing seven workers. The NIA subsequently determined that the same planners and handlers who orchestrated Gagangir also directed the Pahalgam strike.
The Three Terrorists Killed in Operation Mahadev
The NIA identified Faisal Jutt alias Suleman — already an accused in the Gagangir attack — as a participant in the Pahalgam attack as well. He was killed on 28 July 2025 along with two associates: Habeeb Tahir alias Chottu and Hamza Afghani. Security forces recovered two AK-47 rifles and the M-4 carbine from the site.
According to investigators, all three had been active in the Kashmir Valley since 2023, using dense forest cover to evade security forces between strikes — a pattern that made them both elusive and repeatedly dangerous.
A Wider Pattern of TRF Attacks Since 2023
The NIA probe surfaced a broader operational pattern. The same TRF module is linked to at least three other attacks in Jammu and Kashmir:
On 21 December 2023, an Army convoy was ambushed in Poonch district, killing five soldiers. On 4 May 2024, an Air Force convoy was attacked in the Shahsitar-Sanai area of Poonch, killing one personnel. On 9 June 2024, terrorists fired on a bus carrying pilgrims returning from Shiv Khori in Reasi district. All three attacks were claimed by TRF, LeT's proxy outfit.
Notably, mobile data recovered during Operation Mahadev revealed the communication threads linking all these incidents — confirming they were not isolated acts but coordinated strikes by a single, persistent module.
Pakistan's Direct Role and the Sajid Jatt Connection
The NIA established Pakistan's direct involvement through digital forensic evidence, CCTV footage, ballistic reports, IP tracking, and social media records. The three terrorists were reportedly directed through encrypted communication channels by Sajid Jatt alias Ali Bhai, also known by the alias 'Langda' — listed among India's most wanted terrorists and described by an Intelligence Bureau official as the key architect of TRF's operational revival in Jammu and Kashmir.
TRF had initially claimed responsibility for the Pahalgam attack before withdrawing the claim, reportedly fearing a strong Indian response. That response came in the form of Operation Sindoor, which, according to officials, resulted in significant damage to terror infrastructure. An official noted that Pakistan's direct hand was already established, and 'this time around, the punishment was severe.'
What Comes Next
With the Pahalgam–Gagangir module neutralised and Sajid Jatt identified as the overarching handler, the NIA investigation is expected to focus on dismantling the broader LeT network managing TRF's cross-border operations. The recovery of mobile data and encrypted communication records from the three killed terrorists is likely to yield further leads into the command structure directing attacks from Pakistani soil.
Point of View
Persistent cross-border module executing attacks at intervals, not a loose network of opportunistic cells. What is striking is the operational discipline the module maintained across nearly two years and five attacks without being neutralised. That longevity raises pointed questions about intelligence gaps. The identification of Sajid Jatt as the handler is significant, but handlers are replaceable; the deeper question is whether India's response — Operation Sindoor included — has degraded the infrastructure enough to prevent the next module from forming. The forensic rigour of the NIA's case is commendable, but accountability to victims also demands answers about why the Gagangir-to-Pahalgam trail took this long to close.
NationPress
8 Jul 2026
Frequently Asked Questions
What is Operation Mahadev and what did it achieve?
Operation Mahadev was a security forces operation on 28 July 2025 that eliminated three Lashkar-e-Tayiba terrorists — Faisal Jutt alias Suleman, Habeeb Tahir alias Chottu, and Hamza Afghani — in Jammu and Kashmir. The operation also led to the recovery of two AK-47 rifles and an M-4 carbine that forensically linked the Pahalgam and Gagangir terror attacks.
How did the NIA connect the Pahalgam and Gagangir attacks?
The NIA established the link through ballistic analysis, which confirmed that cartridges recovered from both Gagangir and Pahalgam were fired from the same M-4 carbine — recovered during Operation Mahadev. Digital forensics, CCTV footage, IP tracking, and social media records further corroborated that the same TRF module planned and executed both attacks.
What was the Gagangir terror attack?
On 20 October 2024, Pakistani terrorists attacked an APCO Infratech worker's camp near the Z-Morh tunnel in Gagangir, Jammu and Kashmir, firing inside the dining mess and killing seven workers, including a doctor. The NIA subsequently linked the attack to the same Lashkar-e-Tayiba-backed TRF module responsible for the Pahalgam attack.
Who is Sajid Jatt and what was his role?
Sajid Jatt, also known as Ali Bhai and 'Langda', is a Pakistan-based Lashkar-e-Tayiba operative listed among India's most wanted terrorists. According to an Intelligence Bureau official, he directed the TRF module through encrypted communication channels and was tasked with reviving terror activities in Jammu and Kashmir.
Which other attacks has this TRF module been linked to?
The same module is linked to an Army convoy ambush in Poonch on 21 December 2023 that killed five soldiers, an Air Force convoy attack in Poonch on 4 May 2024 that killed one personnel, and a firing on a pilgrim bus in Reasi on 9 June 2024. All three were claimed by The Resistance Front.
