For decades, India was targeted by state-sponsored terror from across the border, by a state that used proxy means and amply exercised plausible deniability to gain impunity. That scenario changed with the Surgical Strike of 2016, the Balakot airstrikes of 2019, and lately, Operation Sindoor, all of which took the Indian response not just into Pakistani territory but also hit the safe havens from which attacks were being directed, with ample backing from the Pakistani establishment, both military and political. While India’s military response had made its mark, the larger and long-running mission has been to gather and build up a trail of court records and legal documentation that substantially and indisputably evidenced the networked terror ecosystem financed, harboured and directed from Pakistani soil, explains Vipul Tamhane, as the FATF is expected to review Pakistan at its upcoming plenary and working group meetings in Paris this October.
Home page image: The ‘masterminds’ – Hafiz Mohammed Saeed of Lashkar-e-Taiba, Syed Salahuddin of Hizbul Mujahideen and Mazood Azhar of Jaish-e-Mohammed
Text page image is AI-generated for representative purposes,
Banner image is a collage of a satellite image of the Mehmoona Joya terror camp hit on the first day of Operation Sindoor and a TV report of action in Balochistan
When Prime Minister Narendra Modi told the Shanghai Cooperation Organisation (SCO) summit in Bishkek, Kyrgyzstan, early this month, that there can be “no double standards whatsoever in the fight against terrorism,” he was not merely reiterating what he said at the SCO summit in Tianjin in 2025 – that the world “cannot remain confined to an action-reaction approach” to terrorism – but was emphatically restating a grievance India has carried for four decades.
The bloc’s Tianjin Declaration did condemn the April 2025 Pahalgam massacre and called for its planners and financiers to be brought to justice. However, it pointedly declined to name Pakistan and, in the same breath, condemned attacks inside Pakistan, which, incidentally, Islamabad blames on India, thus reducing a question of sponsorship to a balancing of rival narratives.

Prime Minister Narendra Modi with other leaders of SCO at the Bishkek Summit on September 1, 2026
It was a familiar pattern: only weeks earlier India had refused to sign an SCO defence ministers’ statement that omitted Pahalgam altogether, while China, the forum’s chair and Pakistan’s patron, worked to keep its ally shielded. The episode captures the problem this analysis traces.
When the Financial Action Task Force (FATF), an intergovernmental group to tackle money laundering and terrorist financing, broke its own reticence in June 2025 to condemn the April massacre at Pahalgam, it said something that ought to be obvious and yet is routinely forgotten - that the attack “could not occur without money and the means to move funds between terrorist supporters.”
Pakistan was removed from the FATF grey list in October 2022 after completing a 34-point action plan targeting anti-money laundering and counter-terror financing deficiencies. However, this exit was not an endpoint; Pakistan remains under follow-up monitoring, with the next review of Pakistan slated for the upcoming plenary and working group meeting in Paris from 26-30 October, 2026.
Incidentally, the Indian representative, Vivek Agarwal, is the vice-president of the FATF from July 2026 to June 2027.
Following the Pahalgam massacre and Operation Sindoor, India had presented fresh evidence of Pakistan's terror infrastructure. In June 2025, the FATF condemned the Pahalgam attack, stating it “could not occur without money and the means to move funds.” FATF officials have since warned that grey list exit is “not bulletproof” against terror financing.

MEA's post on X on Vivek Agarwal's (right) appointment as vice-president of FATF
It was only the third time in a decade the global watchdog had condemned a specific attack. The sentence is the whole problem in miniature. Behind three decades of jihadist violence against India lies not spontaneous rage but a financed, harboured, professionally run enterprise, and the Pakistani state being its most consistent sponsor.
That is not merely political rhetoric or strategic slogan. It is, increasingly, a documented finding, assembled chargesheet-by-chargesheet and deposition by deposition, in Indian courts and international dossiers.
The task here is to trace the machine: how the factions interlock, how money and command flow from Pakistani soil, and how the Indian nodes that detonate the bombs lead back, every time, across the same border.
One roof, many franchises
The first thing to understand is that the alphabet soup - Lashkar-e-Taiba (LeT), Jaish-e-Mohammed (JeM), Hizbul Mujahideen (HM), Al-Badr, and the other 289 active groups is less a set of rival outfits than a set of franchises under one corporate roof.
That roof has a name and a designer. The United Jihad Council, assembled in the mid-1990s and chaired by Hizbul’s Syed Salahuddin, was built to impose discipline on the groups operating against India: to allocate targets by capability and to pool arms, funds and propaganda.

The US State Department terrorist designation (left) of Hizbul Mujahideen chief Syed Salahuddin (right)
Its second function was deniability. By interposing an umbrella body and a nominal Kashmiri chief between the Inter-Services Intelligence (ISI) and the actual killing, the state could direct a campaign while disowning it.
Pakistan has run this script before: disowning the regular troops who seized the Kargil heights in 1999 as freelance “mujahideen,” and at first denying that Ajmal Kasab, the lone gunman taken alive in Mumbai in 2008, was even its citizen, before conceding months later that he was.
This is why chasing acronyms is a treadmill. Proscribe one tanzim (an Urdu term for an organised militant outfit), and another is spawned overnight; the label is disposable, the infrastructure and the sponsor are not.
The Resistance Front (TRF), the ‘home-grown’ outfit that claimed and then disowned Pahalgam, is simply LeT in a new coat of paint. India’s own terror schedule now folds TRF into the LeT designation and the Kashmiri front People's Anti-Fascist Front into JeM. A front, in other words, is not a firewall.
The men at the top of these franchises are not interchangeable foot soldiers but durable hubs. Hafiz Muhammad Saeed built the LeT and its charitable fronts, Jamaat-ud-Dawa and the Falah-e-Insaniat Foundation, both listed by the United Nations as LeT fronts.

The dreadful three: Zaki-Ur-Rahman Lakhvi of LeT (left), Abdul Rauf Azhar/Ashgar of JeM (centre), and the US State Department notice on Sajid Mir of LeT (right)
Maulana Masood Azhar built JeM after India released him in the 1999 hijacking of an Indian Airlines aircraft to Kandahar. Now known to be ailing and rarely seen in public, Azhar leans on his brother Abdul Rauf Azhar for operational command. Salahuddin, on the other hand, runs Hizbul and the wider Kashmir umbrella.
And bridge operators - men like Farhatullah Ghori - whom India has designated as a member of both LeT and JeM, move between the boxes, which is precisely why treating each group as a sealed silo overstates the fragmentation and understates the network.
The handler’s hand
Nowhere is the ‘state’ hand better documented than in the 2008 Mumbai attacks, the template for everything since. In sworn testimony before a Mumbai court, the LeT operative David Coleman Headley described how two ISI officers, Major Iqbal and Major Ali, took him in hand and linked him to his Lashkar handler Sajid Mir, then funded months of reconnaissance across the city.
Headley told the court that he received USD 25,000 from Major Iqbal before travelling to India, with further instalments and, on occasion, counterfeit Indian rupees, from Mir. A Chicago indictment identified Major Iqbal as a serving ISI officer who helped plan and fund the plot. Mir, caught on tape, directed the slaughter by phone from a control room in Karachi.

Ajmal Kasab rampages through the CST (left) and The Hindu dossier on the perpetrators of 26/11 (right)
The cover for Headley’s travel was supplied by his school friend, Tahawwur Rana, who was finally extradited from the United States in April 2025 to face an Indian court.
The concerted terror attacks in Mumbai on November 26, 2008, also referred to as 26/11, cannot be seen as merely ‘rogue jihad.’ It was a fusion of state intelligence, a proxy army and a support network - the umbrella model in live operation.
The template repeats with grim fidelity. The suicide bomb attack on a Central Reserve Police Force (CRPF) convoy on February 14, 2019, that killed forty of its personnel was, as per the 13,800-page chargesheet of the National Investigation Agency (NIA), financed directly.
Accounting for roughly Rs 10 lakhs in Pakistani currency, the amount was credited to the bank accounts of Masood Azhar’s nephew, Mohammed Umar Farooq, in Allied Bank and Meezan Bank in the weeks before the attack. Around six lakhs was spent on explosives and the car.
The Pahalgam supplementary chargesheet of July 2026 names Hafiz Saeed himself as the overarching conspirator, in his own name and as chief of LeT and TRF.
And when India struck the JeM’s Bahawalpur headquarters and other sites in Operation Sindoor in May 2025, the proof of complicity came at the funerals, with serving Pakistan Army officers attending the last rites of the terrorists killed. Azhar himself acknowledged losing ten family members in the strike.

The damaged LeT headquarters in Muridke on the first day of Operation Sindoor (left), and satellite image of a terror camp being hit on the same day
The comfort of sanctuary
Every one of these men lives, by all evidence, on Pakistani soil or in Pakistan-occupied Jammu and Kashmir (PoJ&K). That is the harbouring, the second, quieter half of sponsorship.
Saeed is nominally in Pakistani custody, convicted in terror-financing cases; Sajid Mir was sentenced, in a trial completed three weeks after his arrest and days before a US-Pakistan meeting, on financing charges, never for planning 26/11.
The choreography is unmistakable: cosmetic convictions, timed to relieve external pressure, that punish the paperwork of financing while leaving the enterprise intact. Even the international machinery is gamed. China has repeatedly placed “technical holds” at the United Nations Security Council (UNSC) to shield Pakistan-based operatives, Sajid Mir, Abdul Rauf Asghar and others, from full sanctions.
And Pakistan’s four-year stint on the FATF grey list from 2018 to 2022, which India worked to sustain, produced real economic pain and a burst of convenient designations, but no dismantling.

The plenary session of FATF in June 2026
Islamabad talked its way off the list in October 2022 by ticking the boxes of a 34-point action plan, new laws, a handful of terror-financing convictions and a passed on-site inspection, without touching the networks themselves; the grey-listing punished the paperwork, not the enterprise.
The FATF itself warned in 2025 that delisting is not a shield, amid reports of JeM funding camps through digital wallets.
The nodes inside India
If the command sits in Rawalpindi and Bahawalpur, the detonation happens here, and the newest face of it should end the madrasa stereotype for good. In November 2025, a car packed with explosives blew up near the Red Fort in Delhi, killing more than a dozen people.
The bomber was not a smuggled foot soldier but Dr Umar Un Nabi, a physician from Pulwama, part of a “white-collar” JeM module of doctors and teachers run out of a university in Faridabad, from where investigators recovered nearly 2,900 kilograms of explosive material.

The crucial detail is the wire running back across the border, meaning a Pakistan-based handler fed bomb-making videos and instructions to the educated recruits while money moved through hawala. The raw material had changed- physicians, not seminary dropouts- but the architecture had not.
This is the pattern India keeps relearning. Beneath the leadership sit sleeper cells and overground workers, some embedded for years; above them sit rebranded fronts - TRF, PAFF, Kashmir Tigers - designed and rebranded fronts that disguise Pakistan-directed attacks as spontaneous local uprisings, hiding the foreign hand behind Kashmiri resistance.
The NIA’s contemporary casework treats these newer formations as affiliates of LeT, JeM, HM and Al-Badr rather than autonomous outfits. Their modus operandi would be: a module may consume JeM propaganda, identify with Azhar, communicate with Pakistan and use the brand while retaining just enough operational latitude to give the sponsor plausible distance.
Autonomy at the edges, command at the core, that is the design - not a flaw in it.
Evidence, not grievance
Here is the shift that matters, and it is why this is more than a familiar lament. For decades, justice was impossible. India had the evidence of cross-border terror but could not arrest the Pakistani-based perpetrators.
Pakistan sheltered them, and worse, its state had actually planned and financed the attacks. Yet Pakistan refused to prosecute its own conspirators. The gap was not just geographical; it was a deliberate wall of state-sponsored impunity.
India is now closing that gap not by force but by law.
Section 356 of the Bharatiya Nagarik Suraksha Sanhita, the 2023 code that replaced the colonial-era Criminal Procedure Code (CrPC), allows the trial and sentencing in absentia of a proclaimed offender, after successive warrants, public proclamation, a waiting period and state-appointed defence counsel.

All in the family: The nephews of JeM chief Maulana Mazood Azhar
Mumbai’s prosecutors have invoked exactly this route, seeking to serve proclamation orders through Interpol on six 26/11 fugitives, including Saeed, Lakhvi and Mir, before an in-absentia trial. Against Salahuddin, a Srinagar court issued non-bailable warrants in February 2026 and a formal proclamation in June, ordering him to appear in a case dating to 1996.
The point of a summons is not a naive hope of cooperation; it is the construction of a record, proof that the accused was given notice and refused it.
And the record is vast - Ajmal Kasab’s confession, David Headley’s deposition, the Tahawwur Rana extradition, the Pulwama money trail, the Unlawful Activities (Prevention) Act (UAPA) designations of Hafiz Muhammed Saeed, Maulana Masood Azhar, Zaki-ur-Rahman Lakhvi, Sajid Mir, Abdur Rehman Makki, Farhatullah Ghori and others, standing Interpol notices, and Sajid Mir on the FBI’s Most Wanted Terrorists list with a USD 5 million bounty.
The dispute stops being India’s word against Pakistan’s and becomes India’s documented judicial process against Pakistan’s failure to facilitate accountability. These records travel through international forums in a way grievances never do.
Precision matters here, lest overclaiming feed the cynicism the strategy is meant to defeat. That the ISI personally designed any single plot is, in most cases, an intelligence assessment rather than a court-established fact, and should be labelled as one.
But the aggregate of sworn depositions, funded bank accounts, army officers at terrorist funerals, leaders living openly under state protection, is not an assessment. It is the documented behaviour of a state running terrorism as policy.

A PIB release on the military measures as part of Operation Sindoor (left), and the briefing by the Director General of Military Operation (DGMO) along with his IAF and Indian Navy counterparts (right)
Follow the value
Why does Pakistan do it? Because grey-zone warfare is cheap. For a few million dollars moved quietly through hawala, over-invoiced cross-LoC trade, narcotics proceeds, charitable fronts, crowdfunding and now cryptocurrency, a smaller power can bleed a larger one while staying below the threshold that would invite open war.
Each channel hides a small illicit flow inside a vast legitimate one: migrant remittances, border barter, a registered charity’s turnover, which is why blunt responses that treat every Gulf remittance or mosque collection as suspect both fail and alienate the communities whose cooperation counter-terrorism depends on.
The strategically important turn is upstream. As bulk cash and fixed camps grow riskier, a lesson Operation Sindoor drove home, the sponsor invests earlier and smaller, in the preachers, networks and online grooming that manufacture a willing recruit long before any device is assembled.
Call it capability financing, money that funds the capacity to radicalise, upstream of any specific attack, and far harder to interdict, because at the moment no crime has yet occurred.
The FATF has, tellingly, begun to acknowledge state-sponsored terrorism as a financing risk in its own right. If that recognition is to mean anything, the United Nations Security Council’s 1267 regime and the FATF must price in sponsorship, not just compliance paperwork.

The FATF panels that assessed Pakistan in 2021 and 2022, interestingly, had a dominant presence of Chinese officials
The widening battlefield
There is a final dimension, and it is not military at all.
In February 2025, at a “Kashmir solidarity” event in Rawalakot, Hamas representatives appeared alongside LeT and JeM figures, including Talha Saif, brother of Masood Azhar, braiding “Al-Aqsa” and “Kashmir” into a single story of resistance.
The attempt was to recast two distinct territorial disputes – one over the contested Jerusalem holy site, and the other over Kashmir – as a single global religious war in which a Kashmiri militant is enlisted in the same cause as a fighter in Gaza.
The ambition is to convert a bounded territorial dispute into an India-versus-the-Muslim-world confrontation, a far larger and more combustible battlefield. This cognitive convergence recruits, funds and legitimises everything downstream of it.

Pakistan army officers seen at the funeral of terrorists killed on the first day of Operation Sindoor
It is arguably a more immediate threat than any cave complex, because it is the narrative infrastructure on which the physical infrastructure regenerates. Put plainly: an air strike can level a training camp, but it cannot destroy the story that keeps supplying that camp with recruits and money. This is why the narrative itself, and not just the buildings, has to be contested.
Military force can kill terrorists today; tomorrow, the same ideology will recruit new ones if the underlying story remains unchallenged. The tale of victimhood and religious duty, carefully crafted and broadcast across social media, proves more durable than any concrete bunker.
Fighting this requires counter-narratives, education, and exposing the hypocrisy of leaders who preach holy war while their own families live in comfort. Until the story is defeated, the camps will simply be rebuilt.
Put together, the phenomenon is not a series of discrete outrages but a sustained instrument of Pakistani statecraft, i.e. a networked terror ecosystem, financed and harboured from across the border, waging deniable grey-zone war against India through franchises that act autonomously at the edges and on command at the core.

India’s answer is finally multi-planar: physical reach through Operation Sindoor, financial forensics through its counter-financing regime, jurisdictional accountability through Section 356, and, belatedly, a contest for the cognitive space where an Indian doctor becomes a bomber.
Sanctuary may keep these men beyond reach. On the evidence now stacking up in Indian courtrooms, it no longer keeps them beyond judgment.
(Views expressed in this report are the author's own.)
Follow us on WhatsApp
Follow us on Facebook
Follow us on X @vudmedia
Follow us on Substack