Unmasking TRF: Inside the Pahalgam Terror Attack’s Masterminds

The Resistance Front (TRF) is a militant organization implicated in the deadly terrorist attack on April 22, 2025, in Pahalgam’s Baisaran Valley, Jammu and Kashmir, which claimed 26 civilian lives, primarily tourists.

This attack, one of the deadliest in the region since the 2008 Mumbai attacks, has drawn significant attention to TRF’s activities, ideology, and affiliations. This report provides a comprehensive analysis of TRF’s origins, operational history, key figures, funding mechanisms, international connections, and its role in the Pahalgam attack.

History and Formation

TRF emerged in October 2019, shortly after the Indian government’s revocation of Article 370 in August 2019, which stripped Jammu and Kashmir of its semi-autonomous status and allowed non-locals to settle and own property in the region.

The group positioned itself as a response to these policy changes, claiming to represent “Kashmiri resistance” against perceived demographic shifts and Indian control. Unlike traditional Kashmiri militant groups with overtly Islamic names, TRF adopted a secular-sounding name to project a broader nationalist appeal, though its actions and affiliations align with Islamist militancy.

Indian authorities and security analysts assert that TRF is not an independent entity but a proxy or front for Lashkar-e-Taiba (LeT), a Pakistan-based, UN-designated terrorist organization responsible for the 2008 Mumbai attacks.

The formation of TRF is believed to be a strategic move by LeT to deflect global scrutiny, especially after Pakistan faced pressure from the Financial Action Task Force (FATF) to curb terrorism financing.

TRF’s initial activities were virtual, focusing on online propaganda and recruitment through social media platforms like Telegram, where it operated under names like “Kashmir Resistance.” By 2020, it began claiming responsibility for minor attacks, including targeted killings, and escalated its operations over time.

Operational Location

TRF primarily operates in Indian-administered Jammu and Kashmir, with a focus on the Kashmir Valley.

Its attacks have targeted civilians, security forces, and non-local workers, particularly in areas with significant tourist or strategic importance.

The Pahalgam attack occurred in Baisaran Valley, a scenic meadow approximately 7 km from Pahalgam town in Anantnag district, surrounded by dense pine forests and accessible only by foot or horseback. This location was chosen for its relatively low security presence, despite Pahalgam being a high-security tourist destination.

TRF’s operations extend beyond Pahalgam to other parts of Jammu and Kashmir, including Srinagar, Kulgam, Ganderbal, and Baramulla.

For instance, it was linked to a 2024 attack near the Z-Morh tunnel in Ganderbal, where seven people, including a doctor and six non-local laborers, were killed. The group’s ability to conduct reconnaissance and operate in forested or remote areas, such as the Pir Panjal range where attackers reportedly fled post-Pahalgam, underscores its tactical adaptability.

The Pahalgam Terrorist Attack

On April 22, 2025, four to seven terrorists armed with M4 carbines and AK-47s attacked tourists in Baisaran Valley, killing 26 people, including 25 Indian tourists, one Nepali national, and one local Muslim pony handler.

The attackers, dressed in military-style uniforms, singled out non-Muslims, reportedly sparing those who could recite Islamic verses.

The attack lasted 20–25 minutes and was inadvertently filmed by a tourist, showing scenes of panic and violence. TRF initially claimed responsibility via Telegram, citing opposition to non-local settlement following the abrogation of Article 370. However, it later retracted this claim, alleging a “coordinated cyber intrusion” by Indian intelligence, a move analysts view as an attempt to avoid backlash for targeting civilians.

The attack prompted a massive response from Indian security forces, including a joint cordon and search operation by the Indian Army, paramilitary forces, and Jammu and Kashmir Police.

Over 1,500 people were detained for questioning, and the National Investigation Agency (NIA) took over the investigation, identifying links to LeT and Pakistan’s Inter-Services Intelligence (ISI). Sketches of three attackers—Adil Hussain Thoker, Ali Bhai (Talha Bhai), and Hasim Musa—were released, with two identified as Pakistani nationals.

The NIA employed 3D mapping of the crime scene, a method previously used in the 2019 Pulwama attack investigation, to reconstruct the sequence of events. They are also analyzing video footage, including a clip captured by a tourist (name not included for security concerns) on a zipline, and gathering intelligence from local tribal communities.

Key Suspects

The NIA and Jammu and Kashmir Police identified three primary suspects linked to the attack, with a possible fourth accomplice whose identity remains unclear:

Adil Hussain Thoker:

• Background: A local operative from Bijbehara, Anantnag, Jammu and Kashmir, and a former schoolteacher who turned to terrorism after training with LeT in Pakistan. He crossed the Attari-Wagah border into Pakistan in 2018 and infiltrated back into the Valley in 2024.
• Role: Believed to have played a significant role in aiding Pakistani terrorists in executing the attack. His residence in Bijbehara was demolished by security forces using improvised explosive devices (IEDs) on April 25, 2025, as part of efforts to disrupt terror networks.

Ali Bhai (alias Talha Bhai):

• Background: A Pakistani national and LeT member who infiltrated Jammu and Kashmir approximately 18 months prior to the attack through the Samba-Kathua border.
• Role: Identified as one of the key attackers in the Pahalgam incident.

Hashim Musa (alias Suleiman):

• Background: Another Pakistani national and LeT operative who also infiltrated via the Samba-Kathua border around the same time as Ali Bhai.
• Role: Named as the mastermind of the attack by some sources.

Unidentified Fourth Accomplice: Information suggests a fourth terrorist was involved, but their identity has not been confirmed.

• Additional Names in X Posts: Asif Fauji and Ahsan as additional suspects, with Asif Fauji identified as a Pakistani national and Ahsan as a Pulwama resident suspected of aiding the attackers. However, these names are not consistently corroborated by official sources and should be treated as inconclusive.

Key People Associated with TRF

It absorbed cadres from LeT, Hizbul Mujahideen, and other groups like Tehreek-e-Millat Islamia and Ghaznavi Hind. In January 2023, India banned TRF under the Unlawful Activities (Prevention) Act (UAPA), labeling it a terrorist organization for recruiting youth online, smuggling weapons and narcotics, and facilitating cross-border terrorism.

TRF’s leadership and operatives are closely tied to LeT and other militant groups, with several key figures identified:

• Sheikh Sajjad Gul: A 50-year-old Kashmiri from Srinagar, Gul holds a BSc from Srinagar and an MBA from Bengaluru, and pursued a lab technician course in Kerala. He joined LeT in the early 2000s, was arrested, and released in 2016. He fled to Pakistan in 2017, reportedly settling in Rawalpindi. Appointed TRF’s supreme commander in 2019, allegedly under ISI guidance. Designated a terrorist by the NIA in April 2022 with a ₹10 lakh bounty, Gul is accused of masterminding the Pahalgam attack and orchestrating targeted killings, grenade attacks, and recruitment drives from 2020 to 2024. Believed to be hiding in Rawalpindi, Pakistan. Gul is linked to attacks on civilians, security forces, and minorities, including the 2024 Ganderbal attack. His sophisticated education and strategic role highlight TRF’s use of educated operatives for planning and propaganda.
• Saifullah Kasuri (alias Khalid): A senior LeT commander and deputy chief, Kasuri is a close aide of LeT founder Hafiz Saeed. He operates from LeT’s Peshawar headquarters and has served on Jamaat-ud-Dawa (JuD)’s Coordination Committee for Central Punjab, Pakistan. In 2017, he was introduced as president of Milli Muslim League (MML), LeT’s political front. Identified as the mastermind behind the Pahalgam attack, Kasuri allegedly planned the operation, leveraging LeT’s infrastructure and ISI support. Reports suggest he gave inflammatory speeches against India in early 2025, vowing to intensify attacks in Kashmir. Kasuri’s role reveals TRF’s dependence on LeT’s logistical and financial networks. His involvement in MML indicates a blend of political and militant strategies to sustain insurgency.
• Asif Fauji: A Pakistani national and LeT operative, Fauji is identified as the field commander who led the Pahalgam attack. Some reports suggest ties to the Pakistan Army, hence the moniker “Fauji” (soldier). However, other sources indicate he may be a local terrorist, creating ambiguity about his origins. Led the group of four attackers, including Ali Bhai, Adil Hussain Thoker, and Ahsan. Eyewitnesses reported two attackers speaking Pashto, supporting claims of Pakistani involvement. Named in police sketches with a ₹20 lakh bounty for information leading to his capture. Digital footprints traced to safe houses in Muzaffarabad and Karachi suggest cross-border support.
• Adil Hussain Thoker: A local operative from Bijbehara, Anantnag, Jammu and Kashmir, Thoker was a former schoolteacher who joined LeT after training in Pakistan in 2018. He infiltrated back into Kashmir in 2024. One of the four attackers, Thoker’s local knowledge likely aided the operation. His home in Bijbehara was demolished by security forces on April 25, 2025.
• Ali Bhai (alias Talha Bhai), a Pakistani national and LeT member, he infiltrated Jammu and Kashmir via the Samba-Kathua border approximately 18 months before the Pahalgam attack.
• Hasim Musa (alias Suleiman): A Pakistani national and LeT operative, Musa infiltrated via the Samba-Kathua border around the same time as Ali Bhai. He was active in Jammu and Kashmir for a year before the attack and is linked to at least three prior attacks on security forces and non-locals
• Hafiz Saeed: The LeT founder, while not directly involved in TRF’s day-to-day operations, is implicated as a key figure behind its formation and support structure. The founder of LeT and co-founder of JuD, Saeed is a UN-designated terrorist based in Pakistan. He is infamous for orchestrating the 2008 Mumbai terrorist attacks, which killed 166 people. While not directly managing TRF’s operations, Saeed is implicated in its formation and support structure. TRF is described as a proxy of LeT, relying on its financial and logistical networks. Saeed reportedly lives under Pakistan’s protection, despite international sanctions.
• Abbas Sheikh: A former TRF commander killed in a 2021 encounter in Srinagar, indicating early leadership within the group. He was a veteran Kashmiri militant who joined the insurgency in 1996, Sheikh was one of TRF’s earliest commanders. His leadership focused on urban attacks, contributing to TRF’s early visibility.
• Basit Dar: An ‘A’ category militant killed in May 2024, involved in over 18 cases, from Kulgam. Dar served as TRF’s chief operational commander at its inception in 2019. He was involved in over 18 cases, including attacks on civilians and security forces

Contradiction in Pakistan’s public stance on terrorism, showing a video of a man publicly advocating for violence against India, which contrasts with Pakistan’s international claims of being a victim of terrorism rather than a sponsor.

Funding and Support

LeT as the Primary Backer: TRF, established in 2019 after the abrogation of Article 370, is widely regarded as a front for LeT, a Pakistan-based terrorist organization designated by the United Nations, United States, India, and others. Indian intelligence and global watchdogs, including the UN Security Council’s Analytical Support and Sanctions Monitoring Team, confirm that TRF operates under LeT’s command hierarchy, relying on its financial and logistical infrastructure. LeT provides TRF with funds, weapons, and trained operatives, enabling high-profile attacks like the April 22, 2025, Pahalgam attack that killed 26 civilians.

The ISI is accused of creating TRF to give cross-border terrorism a “home-grown” appearance, especially under pressure from the Financial Action Task Force (FATF), which placed Pakistan on its grey list for terror financing in 2018. The ISI’s annual expenditure on terrorist groups, including LeT, is estimated at $125–250 million, covering salaries, incentives for high-risk operations, and support for guides and informers, according to the European Foundation for South Asian Studies (EFSAS).

Pakistan denies direct support for TRF or LeT, claiming it only provides “diplomatic and moral” backing for the Kashmiri cause. Pakistani officials, including Deputy Prime Minister Ishaq Dar, have suggested that attackers like those in Pahalgam could be “freedom fighters.” However, Indian intelligence points to digital footprints traced to safe houses in Muzaffarabad and Karachi, indicating ISI coordination. Pakistan’s Defense Minister Khawaja Asif offered cooperation with international inspectors, but India and Western analysts view this as a tactic to deflect responsibility.

Smuggling of Weapons and Narcotics

• Cross-Border Smuggling: TRF is suspected of smuggling weapons and narcotics from Pakistan into Jammu and Kashmir, a key revenue source. The Indian Ministry of Home Affairs (MHA) has accused TRF of coordinating the transportation of weapons, including American-origin M4 carbines and sophisticated improvised explosive devices (IEDs), across the Line of Control (LoC). Narcotics smuggling, particularly heroin, charas, and brown sugar, is a significant funding mechanism. A 1997–1998 report cited by the Institute for Defence Studies and Analyses (IDSA) noted 19,450 kg of narcotics valued at ₹20 crore seized in Kashmir, indicating the scale of narco-terrorism.
• Operational Details: TRF operatives, including initial cadres trained in Pakistan, infiltrate via the LoC or travel through the Wagah border on passports. These operatives, such as Adil Hussain Thoker, are trained in LeT camps in Pakistan-occupied Kashmir (PoK) and return to execute attacks. The use of encrypted platforms like Telegram, WhatsApp, and Signal facilitates coordination of smuggling operations, with TRF leveraging LeT’s established supply chains.
• Narco-Terrorism Nexus: The term “narco-terrorism” describes the link between drug trafficking and terrorism in Kashmir. The Golden Crescent (Pakistan, Afghanistan, Iran) is a major source of narcotics, with Afghanistan’s opium production (4,600 tonnes in 1999, 3,200 tonnes in 2000) generating significant revenue. The ISI is accused of facilitating this trade, with seized counterfeit Indian currency notes (FICNs) worth ₹3.56 crore in 2001 revealing its role in sabotaging India’s economy while funding terrorism Juno terrorism.

Gulf-Based Terror Financing

• Gul’s Brother and Gulf Networks: Sheikh Sajjad Gul’s brother, a former doctor turned militant based in the Gulf, is reportedly involved in terror financing. Indian intelligence alleges that he channels funds through Gulf-based fugitives, including operatives in Dubai, Sharjah, Muscat, and Qatar. A 2009 Jamestown Foundation report detailed LeT’s Gulf-based financial networks, noting operatives like Muhammad Omar Madni, arrested in 2009, who revealed Dubai as a hub for planning attacks and funneling funds.
• Historical Context: LeT’s Gulf financing dates back decades. For example, the 2006 Mumbai train bombings were funded with approximately 37,000 Saudi Riyals through hawala networks operated by LeT operatives like Faizal Ataur Rehman Sheikh and Rizwan Ahmed Davre, based in Riyadh. Funds were transferred from Saudi Arabia to Pakistan and then to India via hawala, with operatives like Azam Cheema designated as “amir-e-baitulmaal” (chief exchequer).
• Current Operations: TRF likely benefits from similar networks, with Gulf-based LeT operatives such as Wali, Muslim Basheer, Sarfaraz Nawaz, and Abu Haroon handling fundraising and operations. These operatives, often of Pakistani origin, use Gulf cities as financial hubs to support attacks in India, leveraging the region’s lax financial regulations and hawala systems.

The ₹21,000 Crore Mundra Port Connection

• Drug Trafficking Link: The National Investigation Agency (NIA) uncovered a connection between the Pahalgam attack and a ₹21,000 crore financial network traced from Gujarat’s Mundra port to Kashmir. This network is allegedly tied to drug trafficking and other illicit activities, such as hawala transactions and counterfeit currency smuggling. The Mundra port, a major hub for international trade, has been flagged for narcotics smuggling, with a 2021 seizure of 2,988 kg of heroin (valued at ₹21,000 crore) linked to Afghanistan via Iran. Indian authorities suspect this network funds TRF and LeT operations, with proceeds laundered through complex financial channels.
• Mechanism: The heroin trade, facilitated by the ISI and LeT, generates significant revenue. The 2001 IDSA report noted that FICNs, sold at a 60–70% discount, are used to fund terrorism while destabilizing India’s economy. The Mundra port case suggests TRF’s reliance on this ecosystem, with funds moving through Pakistan and Gulf-based hawala networks to Kashmir.

Additional Funding Mechanisms

• Zakat and Charity Fronts: Pakistan’s state-administered zakat system, which collected over ₹600 billion in 2024, is a significant source of terror funding. The EFSAS report suggests that a portion of these funds is diverted to terrorist groups like LeT and TRF through charity fronts like Jamaat-ud-Dawa (JuD), LeT’s political arm. JuD, led by Hafiz Saeed, has been accused of funneling zakat and donations from the Pakistani diaspora in the Gulf and Europe to terrorist activities, often under the guise of welfare programs.
• Hawala Networks: Hawala, a traditional South Asian money transfer system, is a key conduit for TRF and LeT funds. Operatives in the Gulf, such as Rizwan Ahmed Davre, facilitate transfers from donors in Saudi Arabia and other countries to Pakistan, then to Kashmir. These transactions leave minimal digital footprints, complicating tracking efforts.
• High-Denomination Currency: A 2024 Jamestown Foundation report noted that terrorist groups in Pakistan use high-denomination currency to transfer large sums without digital traces. Pakistan’s underutilized electronic payment systems enable this practice, with operatives like LeT’s Tunda using large bills to fund operations.

The NIA has uncovered links between the Pahalgam attack and a broader financial network, including a Rs 21,000 crore connection traced from Gujarat’s Mundra port to Kashmir, suggesting drug trafficking and other illicit activities as funding mechanisms.

Pakistan’s official stance denies direct support, claiming only “diplomatic and moral” backing for Kashmiri causes, but Indian and international analysts point to ISI’s role in orchestrating TRF’s operations.

International Connections

TRF’s international connections are predominantly tied to LeT and Pakistan’s ISI.

LeT, designated a terrorist organization by the United States and the United Nations, provides TRF with operational, logistical, and ideological support. The group’s formation coincided with Pakistan’s efforts to evade FATF sanctions, suggesting a deliberate strategy to rebrand LeT’s activities under TRF’s name for plausible deniability.

Pakistan’s military and intelligence establishment is implicated in TRF’s activities.

For instance, a speech by Pakistan Army chief Asim Munir in 2025, describing Kashmir as Pakistan’s “jugular vein,” and a rally in Pakistan-occupied Kashmir (PoK) by LeT commander Abu Musa calling for jihad, indicate tacit support from Pakistan’s security apparatus. Pakistan’s efforts to exclude TRF’s name from a UNSC statement condemning the Pahalgam attack further suggest diplomatic shielding of the group.

Globally, the Pahalgam attack drew condemnation from leaders like US President Donald Trump, Russian President Vladimir Putin, and EU chief Ursula von der Leyen, highlighting TRF’s actions as a concern for international security. The United States Commission on International Religious Freedom (USCIRF) specifically noted the targeting of Hindus and non-Muslims, signifies the attack’s sectarian dimensions.

Denials and Controversies

TRF’s initial claim of responsibility for the Pahalgam attack was followed by a retraction on April 26, 2025, alleging that Indian cyber-intelligence operatives had planted the claim through a “coordinated cyber intrusion.”

This retraction is viewed skeptically by analysts, who argue it reflects TRF’s attempt to mitigate political and organizational backlash for targeting civilians, which often reduces public support and invites severe military responses. Indian officials, including Foreign Secretary Vikram Misri, have dismissed these claims, pointing to TRF’s double claim of responsibility and Pakistan’s history of supporting terrorism.

Pakistan’s government, including Foreign Minister Ishaq Dar and Defence Minister Khawaja Asif, has denied involvement, with Asif suggesting the attack could be a “false flag” operation by India. However, Asif’s admission to Sky News of Pakistan’s historical role in funding and training terrorist groups undermines these denials. The international community, including the UN, has called for restraint and independent investigations, but India’s punitive measures—such as suspending the Indus Waters Treaty and expelling Pakistani diplomats—reflect its conviction of Pakistan’s complicity.

Pervez Musharraf admitting that Pakistan trained militants, referred to as “Mujahideen,” to fight against the Indian Army in Kashmir, and praises the formation of Lashkar-e-Tayyiba, a notorious terrorist group, as part of this strategy. This revelation aligns with historical evidence of Pakistan’s use of proxy warfare, as documented in studies like those by the Pakistan Institute of Peace Studies, which detail the structured training processes for militants aimed at regional destabilization.

Impact and Response

The Pahalgam attack has significantly escalated India-Pakistan tensions, with India implementing diplomatic and military measures, including closing the Attari border, suspending visa services for Pakistani nationals, and reducing Pakistani diplomatic presence.

The Indian military launched Operation Sindoor, and Army Chief General Upendra Dwivedi visited Jammu and Kashmir to oversee anti-terror operations. The attack also led to an 80% cancellation of tourist bookings in Kashmir, severely impacting the region’s tourism-driven economy.

Indian political leaders, including Prime Minister Narendra Modi and Home Minister Amit Shah, have vowed to pursue and punish the perpetrators, with Modi emphasizing justice for victims.

Local leaders like Jammu and Kashmir Chief Minister Omar Abdullah and PDP president Mehbooba Mufti have urged caution to avoid alienating Kashmiri civilians, highlighting the risk of backlash against the local population.

Conclusion

The Resistance Front (TRF) is a militant group with deep ties to Lashkar-e-Taiba and Pakistan’s ISI, formed as a strategic front to continue LeT’s operations in Jammu and Kashmir under a new guise.

Its role in the April 22, 2025, Pahalgam attack underscores its capacity for high-impact terrorism, targeting civilians to oppose Indian policies in Kashmir.

Led by figures like Sheikh Sajjad Gul and supported by LeT operatives like Saifullah Kasuri, TRF relies on cross-border funding and training, with Pakistan’s intelligence apparatus playing a central role.

The attack’s fallout has intensified regional tensions, prompting robust Indian responses and global condemnation. As investigations continue, TRF remains a significant threat to stability in Jammu and Kashmir, with its actions reflecting broader geopolitical rivalries between India and Pakistan.

A video from Piers Morgan Uncensored, where a debate about Osama bin Laden’s hiding and eventual discovery in Pakistan is discussed, highlighting a controversial claim that bin Laden was trying to hide from Pakistani intelligence, which is met with skepticism and ridicule.

The video includes subtitles indicating that 470,000 documents related to bin Laden were analyzed by Nelly Lahoud, suggesting a detailed examination of his activities and communications, which contradicts the notion that Pakistani intelligence was unaware of his location.