The National Investigation Agency (NIA) has revealed detailed findings in its charge sheet on the April 22 Pahalgam terror attack, saying the assault was planned and directed from Pakistan by Lashkar-e-Taiba (LeT) and its proxy group The Resistance Front (TRF). The attack had killed 25 tourists and one pony operator at the Baisaran meadow in Pahalgam. The charge sheet also establishes a connection between the Pahalgam attack and an earlier terror strike on the Srinagar-Leh highway in October 2024 through a common terrorist, weapon and GoPro camera.

According to the charge sheet filed on December 15 last year, the attack was orchestrated by TRF/LeT terrorist Sajid Saiffullah Jatt, also known as Langda, who is based in Pakistan’s Kasur. NIA said Sajid Jatt shared the exact coordinates of the Baisaran meadow with the attackers a week before the incident. The agency has named seven accused in the case, including Sajid Jatt, three Pakistani terrorists involved in the attack, two local residents accused of helping them, and the organisations LeT and TRF.

The three attackers were identified as Faisal Jatt alias Suleman, Habeeb Tahir alias Jibran Bhai, and Hamza Afghani. All three were later killed in an encounter with security forces in Dachigam on July 28, 2025. The two locals named in the charge sheet are Bashir Ahmad Jothatd and Parvaiz Ahmad. They have been charged under sections related to murder, waging war against India, the Arms Act and the Unlawful Activities Prevention Act (UAPA).

The NIA said digital evidence recovered from two mobile phones used by the terrorists played a key role in the investigation. The phones contained chats with Sajid Jatt, screenshots from the Alpine Quest navigation app and directions to locations near Baisaran Park. According to the agency, records from Xiaomi confirmed that both phones were sold in Pakistan.

The charge sheet said the three terrorists reached near Parvaiz Ahmad’s dhok, or hut, on April 21. The hut was located around one kilometre from the meadow. Bashir Ahmad Jothatd, a pony operator and Parvaiz’s maternal uncle, first met the terrorists around 4 pm. The attackers allegedly demanded shelter and food “in the name of Allah”. Jothatd recognised that they were terrorists but still allowed them to stay in the hut.

Parvaiz Ahmad, his wife Tahira and their infant child were present in the hut when the terrorists arrived. The attackers asked for their weapons to be hidden and demanded food. While eating, they questioned the uncle and nephew about the Amarnath Yatra, nearby security camps and troop movement in the area. The charge sheet also stated that the terrorists remained in contact with Sajid Jatt during this period.

The attackers stayed in the hut for around five hours and left around 10 pm after asking Tahira to prepare rotis for them. They also took blankets, tarpaulin sheets, spices and a cooking pot before leaving. The terrorists paid Parvaiz Ahmad ₹3,000 before departing.

The next morning, April 22, Jothatd and Ahmad again saw the terrorists at Baisaran Park, where they had gone for work. The charge sheet said the attackers were sitting outside the fence, but the two locals did not alert security personnel, tourists or fellow pony operators. Before entering the park, the terrorists reportedly sat under a tree and had lunch. They later covered themselves with blankets and moved into positions near the entry points of the meadow to observe activities inside.

The attack began at 2.23 pm. Faisal Jatt, armed with an M4 carbine, was wearing a GoPro camera on his head. The other two attackers carried AK-47 rifles. According to the charge sheet, the terrorists split positions strategically to create what the NIA described as “an enclosed kill zone in the central meadow”.

The agency stated that the attackers “systematically verified the religious identity of the victims before killing them”. The charge sheet further said, “Victims who could not recite the kalma or who disclosed that they were not Muslims were shot at point-blank range in an execution-style manner. Throughout this sequence, the assailants told the victims ‘Modi ko bolo (Tell Modi)’, making it clear that the attack was intended to send a message to the elected Government of India, thereby evidencing the ideological intent behind the act.”

The NIA said the terrorists continued firing while escaping and even opened “celebratory” fire after leaving the meadow. During their escape, they also spotted civilians hiding behind trees outside the fence and shot them at close range.

The agency has also highlighted Pakistan’s role in the attack. According to the charge sheet, “The hierarchical command structure, cross-border encrypted coordination, weapons logistics, and handler-driven tasking, as reflected in the charge sheet and corroborated by material evidence, leave no doubt that the attack was a Pakistan-sponsored terrorist operation, executed by LeT/TRF.”

The NIA traced several social media accounts connected to the attack to Pakistan. Soon after the incident, a TRF-linked Mastodon account claimed responsibility for the attack. Later, when international pressure increased after the United Nations Security Council condemned the killings, TRF allegedly launched a Telegram bot to deny involvement. Investigators traced the IP addresses linked to the claim and denial to Khyber Pakhtunkhwa and Rawalpindi in Pakistan. Some Facebook accounts and phone numbers used to circulate attack-related images were also traced to Rawalpindi and Bahawalpur.

The charge sheet further revealed that Faisal Jatt was also involved in the October 20, 2024 terror attack on an APCO construction camp near the Z-Morh tunnel project in Ganderbal district, where seven workers were killed. Investigators recovered images of a GoPro camera from the phone of another terrorist killed after that attack. The same GoPro camera was later recovered in Dachigam after the July 2025 encounter. The NIA said the same M4 carbine used in the APCO attack was also used in Pahalgam.

“This proves that the same Pakistani terrorist module was involved in both attacks,” the charge sheet stated.

The NIA said the investigation is still ongoing. The agency is trying to trace the financial network linked to drone deliveries of cash, weapons and narcotics allegedly organised by LeT and TRF. It is also investigating links between the attackers and terror groups such as Jaish-e-Mohammad, Al Qaeda, Hamas and other international terror organisations.

During the investigation, the NIA examined 1,113 witnesses, including pony operators, dhok residents, taxi drivers, photographers, shopkeepers, dhaba workers and others connected to the area.

The attack had sharply escalated tensions between India and Pakistan. In response, India launched Operation Sindoor on May 7, targeting terror and military installations in Pakistan and Pakistan-occupied Kashmir before a ceasefire was reached on May 10.