Indian investigations Based on eyewitness testimonies and details given by the survivors of the attack the
Jammu and Kashmir police revealed the identities and sketches of four of the terrorists. Police confirmed that all of them have been linked to previous militancy-related incidents in the
Poonch region. Following the attack, hundreds of former
overground workers and ex-militants were interrogated in Kashmir. On 24 April, the J&K Police announced a bounty of () for information leading to the identification, arrest, or elimination of each of the individuals responsible for the Pahalgam attack, promising to protect the informant's identity. The
National Investigative Agency (NIA) later released that the initial sketches of the militants were wrong. NIA arrived at the site to assist Jammu and Kashmir Police on 23 April. It formally took over the investigation from the J&K Police on 27 April following an order from the counter terrorism and counter radicalisation (CTCR) division of the
ministry of home affairs. A case was registered under relevant sections of the
Indian Justice Code and the
Unlawful Activities (Prevention) Act. Indian authorities linked the Pahalgam attack to Pakistan, with digital traces leading to
safe houses in
Muzaffarabad and
Karachi. They concluded that forensic evidence and intelligence intercepts suggest potential support from operatives based in Pakistan. Authorities conducted extensive searches in Indian-administered Kashmir, questioning more than 2,800 people and taking more than 150 into custody. In a preliminary report, the NIA concluded that the attack was committed under directives issued by senior operatives of Pakistan's intelligence agency, the
Inter-Services Intelligence (ISI). At least 15 locals were identified who helped facilitate the attack. Indian officials later said that the attackers belong to a TRF unit known as the "Falcon Squad". The
Minister of Home Affairs Amit Shah explained in the Parliament that the
Intelligence Bureau and the security forces in the region tracked the terrorists for over two months using a number of methods. In December 2025, NIA charged Pakistan-based militant groups
Lashkar-e-Taiba and
The Resistance Front, along with six individuals. The charges, submitted in a 1,597-page filing to a special court in
Jammu, alleged that the groups planned, facilitated, and carried out the attack, tracing the conspiracy to Pakistan following an eight-month investigation. Three Pakistani men killed during an Indian security operation in July were charged posthumously.
Treatment of potential witnesses According to former
chief minister of Jammu and Kashmir Mehbooba Mufti, locals were "rounded up by security agencies and kept in custody for hours and sometimes the entire day without food" in what she saw as a form of
collective punishment. Mufti stated that the locals "unanimously came out against this gruesome attack and unequivocally condemned it" and that "the blanket criminalization of locals not only alienates our people but also sows seeds of resentment and mistrust".
Masterminds behind the attack Security agencies have identified three terrorists behind the Pahalgam terror attack. Two of them — Lashkar-e-Taiba chief
Hafeez Saeed and his deputy
Saifullah Khalid Kasuri — are in Pakistan, while the third, Hashim Moosa alias Suleiman Shah, is believed to be hiding in the forests of south Kashmir. An extensive operation is underway to capture him, with concerns that he may attempt to flee to Pakistan. Hashim Moosa, a former para-commando in Pakistan's
Special Service Group, joined Lashkar-e-Taiba and has been involved in several terror attacks since infiltrating India in 2023. Authorities aim to capture him alive to confirm Pakistan's involvement in the attack. He was involved in a deadly October attack in
Ganderbal that killed seven and another in
Baramulla where four security personnel died. In total, he has been linked to at least six terror attacks in Jammu and Kashmir. The head of TRF, Sajad Ahmad Sheikh alias Sajad Gul, has also been named as a mastermind. He resides in Pakistan. The NIA designated Gul a terrorist in April 2022. Property in Kashmir belonging to Sajad Gul was attached following the Pahalgam attack. The duo were produced before a special NIA court on 23 June 2025. During questioning, Parvaiz and Bashir disclosed details about the terrorists. Shafat Maqbool Wani was taken into custody by the NIA in July 2025 under the
Unlawful Activities (Prevention) Act in Handwara. It is believed that he received money from TRF to support terrorism.
LeT associates Ab Majid Gojri and Ab Hamid Dar were apprehended by J&K Police on 17 August 2025. They were in possession of two Chinese
grenades, two
UBGL grenades, and ten rounds of
AKs. NIA raided their homes on 20 August 2025, discovering records of foreign funding. NIA has recovered information from mobile data, social media chats,
bank transactions, and
call logs during raids in Srinagar and Handwara about TRF receiving approximately
₹9
lakh in funding through Malaysian resident Yasir Hayat, who has connections to Sajid Mir's network, a LeT most wanted terrorist who is suspected of planning the 2008 Mumbai attacks. 463 phone calls connected to anti-India groups and
extremist followers regarding the financing of TRF from Pakistan,
Malaysia, and
Arab states of the Persian Gulf were revealed by NIA on 3 September 2025. On 24 September, Srinagar Police arrested a key LeT operative from South Kashmir's
Kulgam district for providing logistical support to terrorists killed in the Operation Mahadev. The accused has been identified as 26-year-old Mohammad Yousuf Kataria, a seasonal teacher and resident of Kulgam. According to police, Yousuf was actively associated with LeT/TRF and had supplied equipment and other logistical support to terrorists operating in Pahalgam. Forensic examination of a phone charger proved vital to his arrest. Kataria revealed that he met with the terrorists at least four times in the Zabarwan hills.
Indian operations Operation Mahadev Operation Mahadev was launched on the day of the Pahalgam attack. Baisaran Valley is at least 220 km from the
Line of Control. On 28 July 2025, in a joint operation under Operation Mahadev, security forces including
CRPF,
J&K Police, and the
army, killed three terrorists, namely Suleman Shah alias Faizal Jatt, Abu Hamza and Yasir in the Harwan jungles close to Mahadev Ridge in
Dachigam.
Rashtriya Rifles and
Para Special Forces personnel ascended Mahadev hill and took up positions. Three hours later and following visual identification, shots were fired at the terrorists. Three mobile phones and two communication sets were retrieved; additionally, a
GoPro body camera harness, a 28-watt solar charger, three mobile chargers, a
Swiss military power bank, needles and threads, medicines,
stove, dry food, tea and two
Aadhaar cards belonging to two local residents of
Ganderbal and
Srinagar were also recovered. The Pakistani identity of the three terrorists was alleged by the Indian
Home Minister Amit Shah in the
Parliament. The three slain attackers that carried the alias—Suleiman, Hamza Afghani, and Jibran—were identified by detained individuals who had previously supplied them with food. Further confirmation came from the recovery of Pakistani voter identity cards and Pakistan-manufactured chocolates Candyland and Chocomax found in their possession. The batch numbers were traced to a May 2024 consignment shipped to
Muzaffarabad. On the bodies of Suleman Shah and Abu Hamza, two laminated voter ID slips from the
Election Commission of Pakistan had serial numbers connected to the
Lahore (NA-125) and
Gujranwala electoral rolls (NA-79). Biometric information from Pakistan's
National Database and Registration Authority was found on a
micro-SD card that was recovered from a broken satellite phone. Facial templates,
fingerprints,
family tree, registered addresses in Koiyan village, and
Changa Manga, were recovered. The allegations of attackers being of Pakistan-origin were denied by the
Ministry of Foreign Affairs of Pakistan as 'replete with fabrications', as Pakistan does not issue voter-ID cards and instead requires voters to carry
CNICs to participate in any given election.
The Wire questioned the presence of Pakistani chocolates considering that an official had stated that the terrorists had entered India from Pakistan three years ago. Suleiman Shah was labelled as the mastermind of the Pahalgam attack. Following the deaths of the terrorists, their weapons were sent to
Central Forensic Science Laboratory for
forensic firearm examination. The
striation patterns on the three
AK-103s recovered from the terrorists matched the
7.62×39mm round casings that were analyzed and discovered at the Baisaran Valley.
Independent investigation Following India's allegations of Pakistani involvement in the attack, Pakistan proposed the establishment of a neutral, independent, third-party investigation, to be conducted by an impartial body, while condemning the attack as a tragedy. Simultaneously, it accused India of exacerbating regional tensions. Pakistan's call for an unbiased inquiry received backing from
Turkey, China, Malaysia's
Anwar Ibrahim, Switzerland and Greece. However, India categorically rejected the proposal, dismissing the notion of an independent investigation. Meanwhile, a
Public Interest Litigation (PIL) was filed in India which sought a judicial investigation. The
Supreme Court justice
Surya Kant rejected the calls, stating that the court's role was to decide disputes, not to conduct investigations. Independently, investigative journalists from
ThePrint found that the demand for the high-resolution satellite imagery of Pahalgam area surged at
Maxar two months before the Pahalgam attack. The period of the surge coincided with the joining of a Pakistani geospatial firm, Business Systems International (BSI), as a 'partner' with Maxar. The firm's owner Obaidullah Syed was previously convicted for illegally exporting computer equipment and software to Pakistani government agencies. == Response ==