In a dramatic escalation of India’s counterterrorism efforts, security agencies have unraveled a sophisticated terror module composed not of stereotypical militants, but of educated professionals—doctors, academics, and religious leaders—operating from within the country’s most trusted institutions. The recent arrest of Irfan Ahmad Wagay, also known as Imam Irfan, from South Kashmir’s Shopian district, marks a pivotal moment in the investigation into what officials are now calling a “white collar Islamic terrorism” network, a term that underscores the alarming shift in recruitment tactics among extremist groups.
The operation that led to Wagay’s arrest was carried out jointly by the Counter-Intelligence Kashmir (CIK) and Srinagar Police on November 12, 2025, following weeks of surveillance and a targeted raid on his residence. According to Hindustan Times, authorities seized electronic devices and a cache of incriminating materials that pointed to Wagay’s central role in masterminding the terror network linked to the Faridabad explosives case. Wagay, a former paramedic at the Government Medical College in Srinagar and an imam at a mosque in Nowgam, is accused of leveraging his dual influence in the healthcare and religious sectors to radicalize a circle of young medical professionals and students.
Intelligence reports cited by India Today reveal that Wagay’s methods involved introducing extremist ideologies inspired by Pakistan-based groups Jaish-e-Mohammed (JeM) and Ansar Ghazwat-ul-Hind (AGuH) to his followers. He is believed to have shown JeM propaganda videos to medical students and maintained clandestine contact with handlers in Afghanistan and Pakistan via VoIP channels, a tactic designed to evade electronic surveillance. Investigators allege that Wagay raised funds under the guise of charity and welfare initiatives, which were then funneled into terror logistics, including the procurement of weapons and the assembly of improvised explosive devices (IEDs).
The case broke open after a massive cache of explosives—approximately 2,900 kilograms—was discovered in Faridabad, Haryana. Security agencies, in a series of raids between November 8 and 10, 2025, recovered bomb-making chemicals, wires, remote detonators, and multiple firearms, including AK-56 and Krinkov rifles. Hindustan Times reports that these materials were intended for a coordinated, multi-city attack designed to “set India ablaze” in retaliation for Operation Sindoor, an Indian military operation reportedly resulting in the deaths of family members of JeM chief Masood Azhar in Pakistan.
The sophistication of the plot and the professional backgrounds of its members have alarmed investigators. Wagay’s network included Dr. Muzammil Shakeel and Dr. Mohammad Umar, both of whom were arrested for their involvement. Notably, Dr. Umar, a Pulwama-based doctor working at Al-Falah Hospital in Faridabad, is suspected of driving the white Hyundai i20 that exploded near Delhi’s Red Fort on November 10, 2025, killing at least nine people. CCTV footage confirmed Dr. Umar was behind the wheel, and forensic analysis matched the explosives used in the blast to those recovered in Faridabad, according to Hindustan Times.
Investigators believe Dr. Umar acted out of “panic and desperation” after the crackdown on the terror module, possibly triggering the blast either intentionally or by accident. “Raids by security agencies across multiple locations in Delhi-NCR and Pulwama, recovery of significant quantities of explosives, are believed to have led the suspect to act hastily under mounting pressure,” a senior officer told Hindustan Times. The bomb, described as “premature and not fully developed,” ultimately limited the scale of destruction, but the incident underscored the grave threat posed by the module.
The investigation, now led by the National Investigation Agency (NIA), has expanded rapidly. Joint police teams from Delhi and Jammu & Kashmir have conducted raids in Shopian, targeting activists and doctors linked to the Red Fort blast. Among those searched were the residences of former Jamaat-e-Islami chief Dr. Hameed Fayyaz and activist Mohammad Yusuf Falahi, based on information gleaned from Wagay’s interrogation. The probe also led to the arrest of Dr. Shaheen Sayeed, a faculty member at Al-Falah University in Lucknow, identified as the alleged financier and Indian commander of JeM’s women’s wing, Jamaat-ul-Mominaat.
Authorities have detained Wagay’s wife, suspected of helping recruit women into the network, and are questioning other family members, including Wagay’s brother, an officer in the Jammu & Kashmir Police, to determine the extent of their involvement or knowledge. Mobile phones seized during the raids contained extremist instructions and communications with foreign handlers, further cementing the case for a well-organized, cross-border conspiracy.
The origins of the investigation trace back to October 19, 2025, when posters bearing Jaish-e-Mohammed’s insignia appeared in Nowgam’s Bunpora area. This initial clue triggered a broader probe, which soon exposed the module’s extensive links to Pakistan-based handlers and operatives across several Indian states. The network’s ultimate aim, officials believe, was to orchestrate simultaneous terror strikes in multiple cities using the explosives stockpiled in Faridabad.
This case has drawn attention to a troubling trend: the radicalization of educated professionals who operate under legitimate covers, making detection and prevention far more challenging. As Sushant Sareen of the Observer Research Foundation noted in a special report for India Today, “it’s not very surprising to see people from the same profession or same persuasion, you know, getting radicalized together.” The emergence of such “white collar” terror modules signals a shift from conventional militancy to a more covert, intellectualized form of extremism, one that leverages social trust and institutional access to spread its reach.
The crackdown on this network, officials say, likely prevented a much larger and more devastating terror conspiracy. Yet, the investigation is far from over. Authorities continue to trace the module’s financial networks, encrypted communication channels, and foreign handler links. The accused face multiple charges under the Unlawful Activities (Prevention) Act (UAPA), the Explosive Substances Act, and the Arms Act, among others.
For India’s security apparatus, the dismantling of Wagay’s network is both a victory and a wake-up call. The case has exposed the vulnerabilities within professional and academic institutions, highlighting the need for more robust monitoring and counter-radicalization strategies. As the investigation unfolds, it serves as a stark reminder that the face of extremism is changing—and so too must the efforts to combat it.
