Special Report - Pahalgam Attack

Brief of the terrorists involved in planning and executing the attack:

• Hashim Musa alias Suleiman / Asif Fauji: Also named in Anantnag police posters, he is a Pakistani national and a former member of Pakistan Army’s Para forces. He infiltrated into India in 2023 and has been linked to multiple previous terror attacks in 2024. These include the October 2024 Z-Morh Tunnel attack in Gagangir, Ganderbal, which resulted in the deaths of six non-local civilians and a doctor, and the Bota Pathri attack in Baramulla where two Indian Army soldiers and two porters were killed. He has now been identified as the key perpetrator behind all three attacks. An investigation conducted by the Cescube’s team concluded that he was involved in Dera ki Gali ambush on December 21, 2023. It is to be noted that Z-morh Tunnel attack was claimed by TRF whereas Botapthri and Dera ki Gali ambushes were claimed by PAFF. PAFF released footages of the Botapathri and DKG ambushes. It confirms that TRF and the PAFF are sister organisations and work as a proxy of umbrella terror outfit LeT.
• Adil Hussain Thoker: A local from Kashmir, Adil went to Pakistan in 2018 on a student visa, where he came under the influence of Lashkar-e-Taiba (LeT) and received training. He infiltrated India in October 2024 via the rugged Poonch-Rajouri sector, accompanied by 3–4 other terrorists. Since then, he remained underground to evade surveillance by Indian security forces. He was last tracked briefly in Kishtwar before the Pahalgam attack.
• Ali Bhai alias Talha Bhai: Identified in police posters released by Anantnag authorities, he is a Pakistani national and an active member of Lashkar-e-Taiba (LeT).
• Farooq Ahmed alias Farooq Teedwa: A Lashkar-e-Taiba commander, Farooq is believed to be operating from Pakistan-occupied Kashmir (PoK). His residence in Kupwara district, Jammu and Kashmir, was one of ten properties demolished by Indian security forces last week. Intelligence reports indicate that he played a key role in facilitating the infiltration of Pakistani terrorists and connected them with his network of over ground workers. These individuals have been interrogated to identify those who provided support to the perpetrators of the Pahalgam attack. Additionally, on April 25, 2025, Indian forces demolished the residence of LeT terrorist Adil Hussain Thokar in Bijbehara, Anantnag district.
• Saifullah Khalid alias Saifullah Kasuri: Deputy chief of LeT, he is believed to be the mastermind behind the Pahalgam attack. He is based in Gujranwala, Pakistan.

Planning and Reconnaissance of the Attack

The Pahalgam terror attack was the result of meticulous planning and intelligence gathering by the assailants. The attackers, reportedly guided by Adil Thokar, a local militant, trekked for nearly 20–22 hours from the Kokernag forests to reach the scenic Baisaran valley, a location selected strategically for its dense forest cover, lack of security presence, and natural escape routes.

Intelligence inputs have revealed that the terrorists had been present in Baisaran Valley two days prior to the attack. This detail emerged during the interrogation of an arrested Over Ground Worker (OGW) associated with the incident. According to sources, the militants arrived in Pahalgam on 15 April and carried out detailed reconnaissance of at least four potential targets. These included the scenic Baisaran Valley, Aru Valley, a local amusement park, and Betaab Valley. However, due to robust security deployments and enhanced vigilance in these areas, the terrorists were reportedly deterred from launching attacks at those locations.

Prior to the assault, the terrorists conducted extensive reconnaissance of the site, analyzing tourist footfall patterns and assessing the reaction time of nearby security forces. Their intelligence indicated that it would take the nearest Army and CRPF units approximately 60 to 80 minutes to respond, a window they sought to exploit. The Delta Company of CRPF’s 116 Battalion, the nearest base, is situated about 4 to 5 kilometers away.

This premeditated surveillance underscores a sophisticated understanding of both the terrain and the operational limitations of Indian security infrastructure. Furthermore, the terrorists likely fled post-attack towards Kishtwar via Sinthan Top, maneuvering through Kokernag and Daksum forests, with the natural landscape providing effective cover and multiple escape routes. Despite multiple attempts by security forces to track them down, the terrorists managed to slip away on at least four separate occasions. These encounters occurred in Hapat Nar, Kulgam, Tral Ridge, and Kokernag, highlighting both the vastness and the complexity of the terrain in which they operated. The rugged topography, filled with thick vegetation, ridgelines, and natural hideouts, combined with the availability of local intelligence and logistical support, made it extremely difficult for security personnel to maintain sustained contact or mount successful pursuit operations. This pattern of escape illustrates how topographical advantages, combined with human intelligence on the ground, allow militants to exploit the environment and prolong their evasion, further emphasizing the importance of neutralizing OGW networks as a strategic counterterrorism priority.

Execution of the Attack

According to intelligence sources, the assault was carried out by a four-member terrorist module. Two assailants infiltrated the site through the main entrance, one was positioned at the exit to cut off escape routes, while a fourth operative is believed to have remained concealed in the adjoining pine forest to provide cover if needed. Three of the terrorists opened fire on unsuspecting civilians, specifically targeting tourists. Notably, two of the attackers were clad in military-style uniforms, while a third wore a traditional Kashmiri pheran to blend in.

Initial gunfire erupted near the exit gate, setting off chaos and fear among visitors. As people scrambled toward the main entrance in panic, they were ambushed by the two attackers already stationed there. Eyewitness accounts have surfaced with harrowing details—terrorists allegedly attempted to separate men from women and Hindus from Muslims. Upon facing resistance, the attackers reportedly demanded that individuals recite the Kalma (Islamic creed). When the crowd refused to comply, the terrorists unleashed indiscriminate gunfire.

The highest number of fatalities occurred near a cluster of food stalls—specifically around the tea and bhelpuri vendors—where large groups of tourists had congregated. After executing the attack, the terrorists are believed to have escaped by scaling a wall on the park’s left perimeter.

Sources familiar with the ongoing investigation have indicated that credible intelligence points to the possible presence of additional terrorists still concealed within the region. These individuals are suspected to be part of the broader operational module that orchestrated the April 22 attack in Pahalgam’s Baisaran Valley. During the course of the assault, investigators believe that more militants may have been strategically positioned at a distance—potentially tasked with providing cover fire in the event of swift retaliation by security forces. This operational layering suggests a higher degree of tactical planning and coordination than initially assumed, reinforcing concerns that the group involved may be part of a larger, still-active network in South Kashmir.

Weapons and Tactical Gear Used

The attackers were armed with US-made M4 carbine rifles and AK-47 assault rifles, both confirmed through forensic analysis and cartridge recovery from the site. Between 50 to 70 used cartridges were recovered, aligning with ballistic data that confirms the use of these weapons.

One of the most disturbing tactical elements was the use of GoPro cameras, reportedly mounted on the terrorists’ caps, likely intended to record the attack, a method reminiscent of previous attacks conducted by People’s Anti-Fascist Front and Kashmir Tigers, a proxy of another Pakistan based terror outfit – Jaish-e-Mohammad.

This incident marks another known use of the M4 carbine in Jammu and Kashmir. The first such weapon was recovered in 2017, following the elimination of Talha Rashid, nephew of Masood Azhar, in Pulwama. Since 2021, there has been a rise in the cases of the use of M4 carbines in the terrorist attacks in Jammu and Kashmir. These rifles are believed to be part of the stockpile left behind in Afghanistan following the U.S. military withdrawal in 2021, now circulating through illegal arms markets and acquired by Lashkar-e-Taiba (LeT) operatives with the direct backing of Pakistan’s ISI. However, some rifles were found to be cheap copies of M4s made in Darra Adam Khel. While M4 carbines themselves do not offer any extraordinary lethality compared to other assault rifles, their true tactical advantage lies in the modular rail system, which allows terrorists to mount optics, night vision devices, and other enhancements that significantly improve accuracy and effectiveness, particularly in low-light or forested environments.

More critically, the current crop of terrorists demonstrates a marked improvement in training and operational proficiency compared to pre-2021 cadres, whose survivability and tactical discipline were relatively limited. These newer recruits exhibit enhanced capabilities in guerrilla warfare, including jungle survival, sustained movement across hostile terrain, and precise ambush planning. Their extended "shelf life" in the field and ability to adapt dynamically to evolving threats indicate a systematic shift in training standards, likely influenced by direct mentorship from Pakistan-based handlers and retired military personnel. This evolution in tactics and training makes the current generation of militants more resilient, lethal, and tactically elusive than their predecessors.

Indian security agencies have expressed growing concern over the indirect yet consequential role of China in supporting Pakistan-sponsored terrorism. Intelligence officials are currently examining the presence and usage of Huawei satellite phones in the vicinity of the recent terror attack, raising suspicions about their possible smuggling routes from Pakistan or other foreign sources. These phones, along with encrypted messaging platforms, are believed to have played a crucial role in enabling secure, undetected communication among terrorists, helping them avoid interception by Indian surveillance systems.

Further compounding the issue is the infiltration of Chinese-manufactured military-grade equipment, originally intended for the Pakistani armed forces, now being used by terror operatives. Notably, China’s BeiDou satellite navigation system and encrypted telecommunications tools, such as ‘Ultra Set’ communication devices, are reportedly in operational use by terrorist groups. This convergence of state-origin Chinese technology and non-state violent actors is raising alarms among Indian intelligence circles for its implications on asymmetric warfare and technological enablers of terrorism. In the aftermath of April 09 encounter, security forces uncovered a KT terrorist hideout in the Chatroo forests, revealing a range of items that clearly indicate the group had been stationed there for an extended period and had established it as a base of operations. Among the seized materials was Chinese “ultra-sets.” We covered this development in our last report too.

The "Ultra Set" is a specialized Chinese-manufactured communication device reportedly used by the Pakistan Army and associated non-state actors in Jammu and Kashmir. Unlike standard mobile phones, Ultra Sets combine cellular capabilities with specialized radio equipment, operating on radio frequencies for message transmission and reception. Each device is linked to a control station located across the border, and messages are compressed and transmitted via Chinese satellites to a master server in Pakistan for onward transmission. These devices do not rely on traditional mobile technologies like GSM or CDMA, making them difficult to intercept. The use of such encrypted communication tools poses significant challenges to security forces in monitoring and countering infiltration attempts. The Indian Army is reportedly working on methods to crack the encryption used by these devices to better counter the security threats they pose. While specific frequency bands used by the Ultra-Set are not publicly disclosed, it's noteworthy that Ultra-Wideband (UWB) technology, which operates over a wide frequency range, is known for its low power consumption and high data rates. UWB's characteristics make it suitable for secure, short-range communication, which could be advantageous for covert operations.

Role of the Overground Worker (OGW) Network

The National Investigation Agency (NIA), leading the probe into the attack, has so far identified nearly 20 Over Ground Workers (OGWs) suspected of having extended support to the foreign militants involved. Several of these individuals have already been apprehended, while others remain under close surveillance by security and intelligence agencies.

Intelligence assessments indicate that at least four OGWs played a pivotal role in facilitating the attackers, particularly in conducting reconnaissance missions and providing logistical assistance. Investigators have also uncovered evidence pointing to the use of three satellite phones in the area during the lead-up to the attack. Signals from two of these devices have been successfully traced, providing crucial leads in the investigation.

In what is one of the most extensive counter-terror probes in recent years, the NIA and accompanying agencies have interrogated over 2,500 individuals. Currently, 186 persons continue to be held for further questioning, underscoring the scale and depth of the investigative effort.

In the aftermath of the attack, security forces carried out a series of synchronised raids across Jammu and Kashmir. Residences linked to members and sympathisers of proscribed groups—such as various factions of the Hurriyat Conference and Jamaat-e-Islami—were searched in multiple districts, including Kupwara, Handwara, Anantnag, Tral, Pulwama, Sopore, Baramulla, and Bandipora.

Pre-Attack Dynamics and Strategic Environment

New proxy outfits of Pakistan-sponsored terrorist organisations:

The role of Pakistan’s Inter-Services Intelligence (ISI) in fuelling unrest in Jammu and Kashmir is both widely acknowledged and deeply documented. Over the years, a substantial body of scholarly and strategic research has traced the enduring nexus between Pakistan’s military establishment and terrorist organisations such as Hizbul Mujahideen (HM), Lashkar-e-Taiba (LeT), and Jaish-e-Mohammed (JeM). These groups have been instrumental in sustaining an ecosystem of violence, often operating with ideological support and logistical backing from across the border. Their persistent incursions and radicalisation campaigns have intensified local insecurities and disrupted fragile socio-political balances. In a significant policy shift, the Indian Parliament, in August 2019, abrogated Article 370 of the Constitution—a move that revoked the special autonomous status granted to the erstwhile state of Jammu and Kashmir. This was followed by the administrative bifurcation of the region into two Union Territories: Jammu & Kashmir and Ladakh. While the move was projected by the Indian government as a step toward deeper integration and development, it also triggered a new chapter in the region’s already contentious political landscape.

In the immediate aftermath of the abrogation of Article 370, a noticeable shift occurred within the communication patterns of long-established, proscribed terrorist organisations in Jammu and Kashmir. Many of these groups went conspicuously silent across their traditional channels, creating a temporary information vacuum. However, this silence was quickly followed by a proliferation of new militant fronts—over two dozen emerging between 2019 and 2021 alone. The first among them was The Resistance Front (TRF), which strategically positioned itself as a home-grown movement, distancing its identity from Pakistan-based outfits. TRF adopted a modernised lexicon rooted in secular and global narratives, framing its actions as a "resistance" against "occupation" and branding the Indian state as "fascist"—a clear attempt to appeal to international audiences and dissociate from the jihadist rhetoric of previous decades. The emergence of such groups marked a shift not just in nomenclature but also in propaganda style, with a deliberate focus on constructing a narrative of indigenous struggle. The list that follows outlines the organisations that surfaced immediately before and after the constitutional restructuring of Jammu and Kashmir.

• The Resistance Front
• People’s Anti-Fascist Front
• Kashmir Tigers
• Jammu Kashmir Ghaznavi Force
• Tahreek-e-Sangbaz
• Al Qisas Movement Jammu & Kashmir
• Kashmir Freedom Fighters
• Islamic State Wilayat Hind (ISWH)
• United Liberation Front (ULF)
• Lashkar-e-Mustafa
• Kashmir Liberation Warriors
• Tehreek-i-Millat-i-Islami
• Mujahideen e Ghazwatul Hind
• Sayed Ali Geelani Force
• Jammu & Kashmir Freedom Fighters
• Kashmir Revolution Army
• Kashmir Janbaj Force
• Muslim Jaanbaz Force
• The Elite Liberation Force

Multiple intelligence inputs during this period suggested that Pakistan’s Inter-Services Intelligence (ISI) was actively coordinating with various tanzeems—militant outfits—to consolidate their resources and create a new generation of proxy organisations. This strategy was driven by several converging factors. Foremost among them was Pakistan’s placement on the Financial Action Task Force (FATF) grey list in 2018, which placed international pressure on Islamabad to demonstrate concrete efforts in curbing money laundering and terror financing. With many older tanzeems already under global surveillance, the creation of new proxy fronts served as a tactical manoeuvre to bypass international scrutiny and maintain plausible deniability. Furthermore, the elimination of Hizbul Mujahideen’s poster figure, Burhan Wani, in 2016 triggered a decisive counter-terrorism campaign by Indian security forces, which systematically targeted militant infrastructure and disrupted recruitment networks. This intensified crackdown led to a marked decline in local recruitment and diminished popular support for militancy. In response, these newly formed outfits adapted their rhetoric to align with prevailing political sentiments within Jammu and Kashmir and across India. By reframing their narrative through secular and socio-political lenses, they aimed to resonate with a conflict-fatigued Kashmiri populace—one increasingly weary of sustained violence, disillusioned by persistent instability, and tired of Pakistan-sponsored militancy that had brought decades of bloodshed to the region.

Within approximately a year of their emergence, the majority of these newly floated militant outfits dissolved or became inactive, leaving only a handful operational—namely The Resistance Front (TRF), People’s Anti-Fascist Front (PAFF), Kashmir Tigers (KT), and Jammu & Kashmir Ghaznavi Force (JKGF). Among them, TRF and PAFF are widely recognised as front organisations of Lashkar-e-Taiba (LeT), while KT operates as a proxy for Jaish-e-Mohammed (JeM). TRF and PAFF rose to prominence around 2020, with PAFF notably being introduced through TRF’s Telegram channel, which has since been banned. KT, on the other hand, was established in 2021. All three—TRF, PAFF, and KT—initially concentrated their operations within the Kashmir Valley. By 2021, PAFF had expanded its operational footprint to the Poonch-Rajouri-Reasi belt in the Jammu division. KT followed a similar trajectory, extending its attacks into the Doda-Kathua-Kishtwar-Udhampur (DKKU) region by 2024.

Infiltration and Training:

Since late 2024, there has been a marked intensification in infiltration attempts orchestrated from across the Pakistan border into Jammu and Kashmir. While initial focus in 2023 and early 2024 remained on pushing armed militants through the Jammu sector—particularly via areas such as Rajouri, Poonch, Samba, Doda, and Kishtwar—a discernible strategic shift emerged by November 2024. Operational focus began reverting to the Kashmir Valley, with heightened infiltration activities noted in traditionally vulnerable sectors like Gurez, Keran, and Uri, as corroborated by field intelligence. By December, over 167 terrorists had been positioned at cross-border launch pads, and this number sustained with over 120 operatives reportedly stationed monthly in January, February, and March 2025. These cadres were not merely foot soldiers; they had received advanced combat training under the supervision of Pakistan Army elements, ISI operatives, and Pakistan’s elite Special Services Group (SSG). The training modules covered an extensive range of skills, including weapons proficiency, guerrilla tactics, survival in jungle terrain, map reading, GPS navigation, basic field medicine, and data handling.

A key environmental enabler for this heightened infiltration effort was the unusually low snowfall during the winter of 2024–25. With snow cover minimal along high-altitude ridgelines and key infiltration routes, traditional natural barriers were neutralised, offering unprecedented ease of movement for militant groups attempting to enter the Valley undetected.

Shift in Target Profile: Non-Locals and Soft Targets

Another strategic evolution in terrorist targeting patterns has been the calculated pivot towards non-locals, particularly migrants and tourists. This trend began gaining traction around 2021, with targeted killings of migrant workers and government employees from minority communities in the Valley. These attacks marked a departure from the earlier focus on direct engagements with security personnel and signalled an intent to sow communal discord and societal instability.

Groups like The Resistance Front (TRF), a proxy of the Pakistan-based Lashkar-e-Taiba, exploited social media platforms—particularly the “Kashmir Fight” blog—to threaten and intimidate non-local officials, particularly Kashmiri Pandits employed under government schemes. One individual from Srinagar was even chargesheeted for allegedly leaking sensitive personal information of migrant employees to handlers in Pakistan, an act police described as a significant milestone in combating cyber-terrorism. The goal was clear: to create an atmosphere of fear that would push these families out of the Valley and undermine state-sponsored reintegration efforts.

In recent months, this campaign of psychological warfare has broadened to include tourists. Militants have increasingly identified travellers as vulnerable soft targets whose victimisation garners wide media coverage and instils broader public anxiety. A defining moment of this shift was the 2024 Reasi terror attack, wherein a tourist bus was ambushed, resulting in numerous civilian fatalities (BBC). These incidents underscore an operational strategy designed to cripple Kashmir’s tourism economy—an essential pillar in the region’s post-370 economic stabilisation narrative—and reverse public perception of peace and normalcy.

Pakistan's Internal Turmoil and External Displacement Strategy:

The April 2025 Pahalgam attack, which left 26 civilians dead, cannot be viewed in isolation. It appears to be deeply rooted in Pakistan’s growing internal unrest and shifting politico-military rhetoric. In the lead-up to the incident, Pakistan witnessed a spate of deadly domestic terror attacks, including the Mastung bus blast and the Darul Uloom Haqqania bombing. These incidents highlighted severe internal fissures and deteriorating internal security. With increasing domestic dissent and political instability, the Pakistani establishment appears to have reverted to its old playbook—externalising internal crises through escalated cross-border terrorism.

Statements made by Pakistan Army Chief General Asim Munir, particularly those invoking the two-nation theory and referring to Kashmir as Pakistan’s “jugular vein”, added fuel to the fire. Delivered shortly before the Pahalgam attack, these remarks served a dual purpose: rallying domestic unity through anti-India sentiment and deflecting public scrutiny from Pakistan’s internal failures. The situation escalated further when Islamabad, in the aftermath of the attack, alleged possession of actionable intelligence on a potential Indian military response. Such claims likely aimed to reinforce a national siege mentality and consolidate internal cohesion around a perceived external threat.

Undermining India’s Normalcy Narrative:

The Pahalgam attack must also be interpreted within the framework of Pakistan’s long-term information warfare strategy aimed at delegitimising India’s claims of normalcy in Kashmir. Post the abrogation of Article 370, New Delhi has consistently projected rising tourist inflows and developmental initiatives as indicators of peace and stability in the Valley. These optics are critical to India’s domestic and international messaging.

However, Pakistan has strategically sought to counter this narrative. By orchestrating a high-casualty attack in a prominent tourist destination, it not only inflicted loss of life but also sought to strike a blow at the psychological and economic pillars of India’s Kashmir policy. The message was unambiguous: Kashmir is not normal. The timing and location of the attack—during peak tourist activity—was intended to challenge the Indian state’s assertion of security and integration. Such acts of violence are designed to dissuade tourism, disrupt public confidence, and refocus international attention on the perceived volatility of the region.

In essence, the Pahalgam attack represents a multi-layered convergence of geopolitical signalling, psychological warfare, and asymmetric strategy by Pakistan and its proxy militant networks. The incident is a stark reminder of the enduring complexity of the security landscape in Jammu and Kashmir, and the imperative for India’s security apparatus to remain agile, technologically enabled, and politically resolute.

Understanding Pakistan’s proxy war against India and its tools

Multiple media outlets reported that The Resistance Front (TRF), a proxy group of Lashkar-e-Taiba (LeT), initially claimed responsibility for the Pahalgam terror attack. The claim surfaced on Chirpwire and Mastodon through a handle named ‘Kashmir Conflict’. However, three days later, TRF disowned the attack in a post shared from a newly created Telegram channel, alleging their earlier claim was the result of a “coordinated cyber intrusion.” This tactic of claiming and then retracting responsibility is consistent with TRF’s pattern of communication ambiguity. TRF, closely associated with the People’s Anti-Fascist Front (PAFF), operates under LeT's umbrella and often mirrors similar behavior.

Since 2024, TRF has not maintained a permanent presence on Telegram due to a crackdown by Indian security agencies on channels linked to TRF, PAFF, and affiliated propaganda arms such as ‘Jhelum Media House,’ ‘Kashmir Conflict,’ and ‘Kashmir Fight.’ These unofficial platforms primarily circulated TRF’s press releases and, on occasion, PAFF’s content. Following the clampdown, these groups migrated to lesser-known platforms like Nandbox, Chirpwire, and Mastodon. On April 25, TRF launched a new Telegram channel, using it to deny involvement in the Pahalgam killings.

This isn’t the first time TRF has engaged in such tactics. On June 9, 2024, terrorists opened fire on a bus carrying Hindu pilgrims in Reasi, killing nine and injuring 41. The responsibility was initially claimed by ‘Jhelum Media House’ via Telegram but was later withdrawn. Subsequently, TRF also disassociated itself from the incident through a Telegram post. Interestingly, both these attacks coincided with significant political events: the Reasi attack happened during Prime Minister Narendra Modi's swearing-in ceremony for a third term, while the Pahalgam attack occurred during a visit by the Vice President of the United States to India.

The Resistance Front (TRF)’s shifting claims of responsibility for the Pahalgam and Reasi attacks illustrate a deliberate strategy grounded in the broader theoretical frameworks of proxy warfare, hybrid warfare, and strategic communication. These tactics are not isolated; they are deeply embedded in the modern evolution of conflict where state and non-state actors blur boundaries to achieve political and strategic objectives without assuming direct accountability.

TRF operates as a textbook case of a proxy actor—a non-state militant group that carries out military operations on behalf of or with the support of a state, in this case, Pakistan’s Inter-Services Intelligence (ISI). This approach aligns with the definition offered by Mumford (2013) in "Proxy Warfare and the Future of Conflict", where proxy war is defined as “the indirect engagement in a conflict by third parties wishing to influence strategic outcomes.” TRF enables Pakistan to continue its anti-India campaign while publicly denying direct involvement, a practice known as plausible deniability, first elaborated in Cold War intelligence literature and formalized in statecraft theory by Michael Poznansky (2015) in International Studies Quarterly.

Through TRF, the ISI leverages non-attributable violence—a form of coercion in which responsibility for attacks remains ambiguous, thus avoiding full-blown retaliation from the adversary. This denial mechanism is particularly effective in the age of rapid digital dissemination, where conflicting claims and retractions can muddy the waters of attribution.

TRF’s tactics also exemplify what scholars like Frank Hoffman (2007) describe as hybrid warfare—the blending of conventional military tactics, irregular warfare, terrorism, and cyber capabilities. The use of Telegram, Chirpwire, and Mastodon to claim and later retract responsibility is part of informational manipulation, a key element in hybrid conflicts.

The deliberate timing of the Reasi and Pahalgam attacks—coinciding with Prime Minister Modi’s swearing-in and the U.S. Vice President’s visit respectively—demonstrates a psychological warfare dimension, intended to embarrass India on the global stage and generate headlines during moments of high symbolic significance. This reflects the insights of Thomas Rid (2012), who argues in "Cyber War Will Not Take Place" that modern conflict is increasingly about “strategic narratives” rather than direct battlefield victories.

The dual messaging—claiming responsibility through unofficial propaganda channels (e.g., Jhelum Media House) and later denying it—constitutes what Joseph Nye (2010) describes as the use of soft power through strategic communication. This allows TRF to remain relevant in the information ecosystem while confusing counter-terror agencies and preventing clear-cut attribution.

This ambiguity plays into the concept of reflexive control—a Soviet-era theory revived by Timothy Thomas, which involves conveying carefully designed information to adversaries to manipulate their decision-making process. TRF uses retractions to deny responsibility, potentially diverting attention from their handlers and confusing Indian intelligence assessments.

Following the crackdown on its Telegram channels, TRF’s migration to fringe platforms like Chirpwire and Nandbox highlights the adaptability of networked insurgencies, a concept explored by David Kilcullen (2009) in "The Accidental Guerrilla." These migrations represent an evolution in insurgent strategy, where digital survivability and communication redundancy become as important as physical safe havens.

These fringe platforms are less regulated and provide operational cover for propaganda dissemination. The fact that TRF returned to Telegram for a denial post on April 25 shows how platform use itself can be tactical—a form of digital maneuver warfare aimed at maintaining both visibility and deniability.

The Resistance Front’s use of fluctuating claims of responsibility, strategic digital messaging, and timing of attacks reflects a highly calculated mode of warfare rooted in the doctrines of proxy warfare, hybrid warfare, and reflexive control. Its affiliation with Lashkar-e-Taiba and by extension Pakistan’s ISI, indicates a state-backed attempt to destabilize India using deniable actors who operate in both kinetic and digital realms.

By weaponizing plausible deniability, TRF ensures that accountability remains murky, retaliation becomes diplomatically complex, and global narratives about the Kashmir conflict remain contested. As warfare becomes increasingly ambiguous, state-sponsored proxies like TRF become essential tools in what Mark Galeotti calls "the shadow war"—conflicts fought in the grey zones of law, legitimacy, and attribution.