Hyundai i20, Ford EcoSport, Maruti Suzuki Brezza: Terrorists had planned a ‘spectacular attack’ with multiple vehicle-borne IEDs and assault rifles

NEW DELHI: Umar Un Nabi — confirmed by a DNA test as the man who detonated an IED near Old Delhi’s Red Fort on Nov 10 — and a small “white‑coat” module that included three fellow doctors had plotted a multi‑vehicle, multi‑strike attack, investigators say.

The module procured three cars — a Hyundai i20 (which exploded), a red Ford EcoSport (DL‑10 CK‑0458), and a Maruti Suzuki Brezza — and intended to use vehicle‑borne IEDs followed by firing with assault rifles in a “spectacular” coordinated strike.


Also read: Delhi car blast probe: Next terror attack may have been planned on Babri Masjid demolition anniversary

Security sources and probe officers described a tightly knit operation that was hatched overseas, rehearsed locally, and fuelled by clandestine communications, cash transfers and large caches of explosives.

• Vehicles and the blast: Umar drove the i20 that blew up near the Red Fort on Nov 10. The EcoSport was traced to Faridabad; police have issued BOLOs for the Brezza amid fears more explosives or devices may be hidden. Sources say Umar was the principal procurer of the three cars.
• International direction: The plot has an overseas thread. Probe teams say the plan was hatched in Turkiye in 2022. Umar travelled to Ankara in March that year for two weeks and operated under instructions from a Turkey‑based handler codenamed “Ukasa”, according to agency sources. The module’s encrypted conversations began on Telegram and migrated to Signal and Session apps.
• Explosives trail: Investigators found the module had been collecting explosive material since 2022 — intelligence referred to an initial accumulation of over 350 kg of explosive components. After the seizure that followed Dr Muzammil’s arrest, searches in Faridabad uncovered a much larger stash — nearly 2,900 kg of ammonium nitrate and other explosive substances stored across two rented rooms, police say.
• University link: Both Umar and Dr Muzammil (Muzammil Ahmad Ganaie) were on the faculty of Al‑Falah University in Faridabad. Muzammil, who taught MBBS students, is accused of arranging multiple reconnaissance visits to Red Fort earlier this year and of using rented rooms near campus to receive and stash material. Their presence in the university — which houses a growing medical college — has widened the probe to colleagues, staff who helped with logistics, and anyone who may have assisted in securing vehicles or premises.
• Targets and timeline: Beyond Delhi, investigators say the group planned to strike Ayodhya — an attempt was allegedly plotted for Nov 25, coinciding with a ceremonial hoisting at the Ram temple. Documents and interrogation accounts indicate the module intended phased actions, with some plans extending towards Republic Day 2026.
• How the operation unravelled: J&K police action and subsequent forensic leads led to the Faridabad seizures and Muzammil’s arrest. Sources say the bust prompted Umar to go on the run; he remained mobile for more than 16 hours before detonating the i20. CCTV, toll‑plaza footage and vehicle tracings have become important pieces of the timeline as agencies attempt to map accomplices and pick up any remaining sleeper cells.

What investigators have recovered from the university‑linked searches

• Notebooks and diaries from campus lodgings with coded entries, repeated use of the word “operation”, and dates around Nov 8–12.
• Lists with 25–30 names — many traced to Jammu & Kashmir, Faridabad and neighbouring areas — suggesting a wider support network.
• Evidence of a Signal group formed by Umar with 2–4 members for coordination.

Large consignments of ammonium nitrate and components typically used to make powerful IEDs, moved in multiple batches to rented rooms in Dhauj and Fatehpur Taga.

Agency response and next steps
The National Investigation Agency, J&K Police and Haryana Police are jointly probing the module’s origin, financing and logistics.

Officers say they are tracing supply chains for explosives, vehicle purchases, handlers abroad, and any university staff who may have assisted — knowingly or unwittingly. Intelligence agencies are also combing travel and communication records to map the Turkey link and identify other operatives.

An officer involved in the probe said: “They intended a spectacular attack — vehicle IEDs followed by firing. The overseas direction, reconnaissance and the scale of material recovered make this one of the most serious modules we have seen in recent years.”