Delhi Blast: How Terrorists Used Session App and Codewords to Plan Explosive Movement

In a chilling revelation, intelligence agencies have uncovered that members of the Faridabad-Saharanpur module of the terror group Jaish-e-Mohammed (JeM) used an encrypted communication app called Session to stay in touch with their foreign handlers. The app was also used to discuss the movement of explosives, which were codenamed as "shipment" and "package" to evade detection.

Session App Used for Clandestine Communication

According to security sources, the arrested doctors Dr Muzammil and Dr Umar relied on Session - a highly secure, decentralized messaging platform - to communicate with their handlers. The app does not require a mobile number for registration, stores no metadata, and hides IP addresses by routing messages through multiple servers. This level of encryption makes tracing or identifying users almost impossible, investigators said.

Prior to switching to Session, the accused reportedly used WhatsApp with a Turkish virtual number beginning with the country code +90. Their handler, who went by the alias "Abu Ukasa," instructed them to move to Session for higher secrecy after initial contact.

Turkey Chosen to Avoid Indian Surveillance

Reports have also revealed that Turkey played a crucial role in JeM's operational planning. In 2022, both doctors allegedly travelled to Turkey to meet senior JeM operatives, including Abu Ukasa. Intelligence officials said Turkey was strategically chosen as the meeting point to avoid Indian monitoring and to mask any direct connection between the group's operatives and Pakistan-based handlers.

By using a Turkish virtual number and operating from a neutral location, JeM aimed to create a buffer between its leadership and ground modules in India.

Hybrid Doctor Module and Online Radicalisation

Further probe indicates that the "hybrid doctor module" was active on two Telegram channels - Umar Bin Khattab and Farzand Darul Uloom - both suspected to be linked to JeM's online propaganda network. These channels circulated speeches by JeM founder Maulana Masood Azhar and content glorifying jihad, designed to indoctrinate new recruits under the guise of religious discussion.

Investigators are currently analysing cross-border digital activity, travel logs, and financial trails to trace the module's connections with JeM's central command in Pakistan.

Lucknow Connection: Doctor Shaheen Under Scanner

Meanwhile, the investigation into the Delhi Red Fort blast has brought another name into focus - Dr Shaheen Saeed, a Lucknow-based physician who was arrested following a massive explosives haul in Faridabad, just hours before the blast.

According to officials, Dr Shaheen visited Lucknow in August 2025, but notably did not meet any family members during her stay. Investigators now believe the purpose of her visit was to meet members of a sleeper cell linked to the same JeM network. Multiple raids are currently being carried out across Lucknow to trace possible operatives connected to her movements.

National Security Agencies Step Up Vigilance

With the discovery of encrypted communications, international linkages, and medical professionals being drawn into terror networks, the case has triggered high-level coordination among central agencies. The National Investigation Agency (NIA) and Intelligence Bureau (IB) are jointly monitoring encrypted channels and travel histories to map the full extent of JeM's presence within India.

Officials said the revelations underscore the growing sophistication of terror networks, which are increasingly using anonymous, decentralized apps to evade detection while maintaining operational control through innocuous-sounding codewords.