Dead For Years, Active Before Attack: The Phone Trail Behind Pahalgam Attack

One of the two mobile phones used by terrorists in the 2025 Pahalgam attack was traced to a consignment imported into Pakistan in 2021, financed by a Karachi-based bank whose name has surfaced previously in cases linked to terrorism, NDTV has learnt.

Relations between India and Pakistan plummeted last year after a terror attack in picturesque Pahalgam in Jammu and Kashmir killed 26 men, mostly Hindu tourists, leading to their worst conflict in decades.

India blamed Pakistan for backing the attack - a charge Islamabad denied - triggering tit-for-tat diplomatic measures and a sharp military escalation that included airstrikes, drone swarms, and heavy mortar fire over four tense days.

Investigative agencies have now obtained evidence indicating that the attack was not a spontaneous event. The planning for it had been going on for years, they said.

Investigations conducted by the National Investigation Agency (NIA) and the Jammu and Kashmir Police have revealed that among the mobile phones recovered from the terrorists involved in the attack, one device was procured in Pakistan four years ago and remained unused from that time until just prior to the attack.

The focus of the investigation is no longer limited solely to the terrorists. Efforts are on to unearth the networks that provide technical and logistical support to these operatives from Pakistan.

The three terrorists - Suleiman Shah, Habeeb Tahir alias Jibran, and Hamza Afghani - were gunned down by security forces in Operation Mahadev at Dachigam near Srinagar. After the encounter, two mobile phones were recovered from terrorists' possession. The phones proved to be the most crucial link in the entire investigation, sources said.

The Pahalgam attackers carried two Xiaomi cellphones of the Redmi series: a 9T imported in 2021 and a Note 12 in 2023. Both phones turned out to be linked to Pakistan, investigators told NDTV.

Xiaomi Global was contacted via the mobile phones' International Mobile Equipment Identity (IMEI) numbers - the unique 15-digit numeric codes given to every cellular-enabled device - and the company was requested to provide the supply history of these devices, sources said.

Records provided by the company revealed that the Redmi 9T phone was part of a large shipment that arrived in Pakistan in January 2021. This shipment was imported by a Karachi-based company named Tech Sirat Pvt Ltd, meaning it arrived in the country legally. According to the records, Faysal Bank was listed in the funding and logistics arrangements for this consignment. The delivery address was also that of the bank's headquarters.

It is important to note that in international trade, banks frequently provide importers with Letters of Credit and other financial facilities. Therefore, the mere presence of a bank in import documentation cannot, in itself, be deemed as proof of a crime.

However, the attention of investigative agencies was drawn to this matter because Faysal Bank's name has surfaced previously in cases linked to terrorism. In the past, international reports claimed that certain banned organizations held accounts at this bank. The bank, on its part, has consistently denied such allegations, maintaining that action was taken against the relevant accounts immediately upon the imposition of sanctions.

The Redmi 9T phone arrived in Pakistan in January 2021, but it was never switched on for the four years that followed. No network records were found for it, no calls were made, and no SIM card was ever used. In 2025, this phone suddenly became active and was then found in the possession of the terrorists involved in the Pahalgam attack.

Investigating officers believe that this cannot be a mere coincidence.

They suspect that the phone was set aside for a specific purpose right from the start. It is possible that the mobile phone was kept in a secure location to be handed over to terrorists and was activated only when the need arose, sources said.

If there had been only one such phone, it could have been considered a coincidence. A second phone, too, turned out to follow almost the exact same pattern.

The Redmi Note 12 was imported into Pakistan in 2023 by Air Link Communications Limited. This company is based in Lahore and is considered a major name in mobile distribution within Pakistan. The investigation revealed that this phone, too, was never used after being imported. It, too, was activated only just before the attack, sources said.

The fact that two mobile phones, imported at different times, remained inactive for years only to eventually lead back to the same terrorist module appears to point investigative agencies toward a larger network, sources said.

Investigators found no call records, messages, social media chats, or internet communications on either of the two phones. The reason cited for this is that the terrorists were utilising long-range radio communication technology, sources said. This technology is independent of mobile networks or the internet, allowing secure communication over distances of several kilometers. This explains why investigative agencies did not retrieve any digital communication data from the mobile phones themselves, sources said.