at Chhatrapati Shivaji Terminus with an AK-47 in his hand. The search regarding the identity of the terrorists started during the first attacks. During the searches, an unknown group calling itself the Mujahideen Hyderabad Deccan claimed responsibility for attacks in an email, which was later traced to Pakistan and was regarded as
hoax. The Mumbai attacks were planned and directed by Lashkar-e-Taiba militants inside Pakistan and carried out by 10 young armed men trained and sent to Mumbai and directed from inside Pakistan by mobile phones and
VoIP. In July 2009, Pakistani authorities confirmed that LeT plotted and financed the attacks from LeT camps in Karachi and
Thatta. In November 2009, Pakistani authorities charged seven men they had arrested earlier, of planning and executing the assault. Mumbai police department originally identified 37 suspects—including two
Pakistan Army officers—for their alleged involvement in the plot. All but two of the suspects, many of whom are identified only through aliases, are Pakistani.
David Coleman Headley and
Tahawwur Hussain Rana, arrested in the United States in October 2009 for other attacks, were also found to have been involved in planning the Mumbai attacks. One of these men,
Pakistani American David Headley (born Daood Sayed Gilani), was found to have made several trips to India before the attacks, and gathered video and
GPS information on behalf of the plotters. In April 2011, the United States issued arrest warrants for four Pakistani men as suspects in the attack. Three men, Sajid Mir, Abu Qahafa, and Mazhar Iqbal, alias "
Major Iqbal", were believed to be members of Lashkar-e-Taiba, and helped plan and train the attackers.
Negotiations with Pakistan Pakistani Prime Minister
Yousaf Raza Gillani and President
Asif Ali Zardari condemned the attacks. Pakistan promised to assist in the investigation, and President Zardari vowed "strong action against any Pakistani elements found involved in the attack". Pakistan initially denied that Pakistanis were responsible for the attacks, blaming plotters in Bangladesh and Indian criminals, a claim refuted by India, and saying they needed information from India on other bombings first. Pakistani authorities finally agreed that Ajmal Kasab was a Pakistani on 7 January 2009, and registered a case against three other Pakistani nationals. The Indian government supplied evidence to Pakistan and other governments, in the form of interrogations, weapons, and call records of conversations during the attacks. In addition, Indian government officials said that the attacks were so sophisticated that they must have had official backing from Pakistani "agencies", an accusation denied by Pakistan. A year after the attacks, Mumbai police continued to complain that Pakistani authorities were not co-operating by providing information for their investigation. Meanwhile, journalists in Pakistan said security agencies were preventing them from interviewing people from Kasab's village. The then Home Minister
P. Chidambaram said the Pakistani authorities had not shared any information about American suspects
David Headley and
Tahawwur Hussain Rana, but that the
FBI had been more forthcoming. An Indian report, summarising intelligence gained from India's interrogation of David Headley, was released in October 2010. It alleged that Pakistan's intelligence agency (ISI) had provided support for the attacks by providing funding for reconnaissance missions in Mumbai. The report included Headley's claim that Lashkar-e-Taiba's chief military commander, Zaki-ur-Rahman Lakhvi, had close ties to the ISI.
Investigation According to investigations, the attackers travelled by sea from
Karachi, Pakistan, across the
Arabian Sea, hijacked the Indian fishing trawler
Kuber, killed the crew of four, then forced the captain to sail to Mumbai. After murdering the captain, the attackers entered Mumbai on a
rubber dinghy. The captain of
Kuber, Amar Singh Solanki, had earlier been imprisoned for six months in a Pakistani jail for illegally fishing in Pakistani waters. The attackers stayed and were trained by the Lashkar-e-Taiba in a safehouse at
Azizabad in Karachi before boarding a small boat for Mumbai. David Headley was a member of Lashkar-e-Taiba, and between 2002 and 2009, Headley travelled extensively as part of his work for LeT. Headley received training in small arms and countersurveillance from LeT, built a network of connections for the group, and lead in scoping out targets for Mumbai attack having allegedly been given $25,000 in cash in 2006 by an ISI officer known as
Major Iqbal. The officer also helped him arrange a communications system for the attack and oversaw a model of the Taj Hotel, so that gunmen could know their way inside the target, according to Headley's testimony to Indian authorities. Headley also helped ISI recruit Indian agents to monitor Indian troop levels and movements, according to a US official. At the same time, Headley was also an informant for the US
Drug Enforcement Administration, and Headley's wives warned American officials of Headley's involvement with LeT and his plotting attacks, warning specifically that the Taj Hotel may be their target. Disclosures made by former American intelligence contractor Edward Snowden in 2013 revealed that the
Central Intelligence Agency (CIA) had intercepted communications between the Lashkar boat and the LeT headquarters in Pakistan-administered Kashmir and passed the alert on to
RAW on 18 November, eight days before the terrorists actually struck Mumbai. In the hours after the attack, the
New York City Police Department sent
Brandon del Pozo, an official from their intelligence division, to investigate the incident to understand what vulnerabilities its methods posed for New York City. The arrest of
Zabiuddin Ansari, alias Abu Hamza, in June 2012 provided further clarity on how the plot was hatched. According to Abu Hamza, the attacks were previously scheduled for 2006, using Indian youth for the job. However, a huge cache of AK-47s and
RDX, which were to be used for the attacks, was recovered from
Aurangabad in 2006, thus leading to the dismantling of the original plot. Subsequently, Abu Hamza fled to Pakistan and along with Lashkar commanders, scouted for Pakistani youth to be used for the attacks. In September 2007, 10 people were selected for the mission. In September 2008, these people tried sailing to Mumbai from Karachi, but could not complete their mission due to choppy waters. These men made a second attempt in November 2008, and successfully managed to execute the final attacks. David Headley's disclosures that three Pakistani army officers were associated with the planning and execution of the attack were substantiated by Ansari's revelations during his interrogation. After Ansari's arrest, Pakistan's Foreign Office claimed they had received information that up to 40 Indian nationals were involved in the attacks. In his confession,
Ajmal Kasab, the only gunman captured, shared the location of LeT's training camps in
Muridke, Pakistan, called as Markaz Taiba, and in Muzzafarabad, apart from the routine of their training, which included indoctrination, basic combat, advanced weapons and explosives, and commando tactics. On 7 May 2025, the Muridke camp was
destroyed in a missile strike by the Indian Armed Forces in retaliation for the
Pahalgam terrorist attack, which was also perpetrated by the Lashkar-e-Taiba. The strikes reportedly killed Lashkar's HQ chief Mudassar aka Abu Jundal (not to be confused with 26/11 co-conspirator
Zabiuddin Ansari who used the alias Abu Jundal) among several other terrorists.
Method The attackers had planned the attack several months ahead of time, and knew some areas well enough to vanish and reappear after security forces had left. Several sources have quoted Kasab telling the police that the group received help from Mumbai residents. The attackers used at least three
SIM cards purchased on the Indian side of the border with
Bangladesh. There were also reports of a SIM card purchased in the US state of
New Jersey. Police had also mentioned that
Faheem Ansari, an Indian Lashkar operative who had been arrested in February 2008, had scouted the Mumbai targets for the November attacks. Later, the police arrested two Indian suspects, Mikhtar Ahmad, who is from Srinagar in Kashmir, and Tausif Rehman, a resident of Kolkata. They supplied the SIM cards, one in Calcutta, and the other in New Delhi. The attackers used a satellite phone and cell phones to talk to each other, as well as their handlers who were based in Pakistan. In transcripts intercepted by Indian authorities between the attackers and their handlers, the handlers provided the attackers with encouragement, tactical advice, and information gained from media coverage. The attackers used both personal cell phones and those obtained from their victims to communicate with each other and the news media. Although the attackers were encouraged to murder hostages, the attackers were in communication with the news media via cell phones to make demands in return for the release of hostages. This was believed to be done to further confuse Indian authorities that they were dealing with primarily a hostage situation. Type 86 grenades made by China's state-owned
Norinco were used in the attacks. Also, indications arose that the attackers had been taking cocaine. The gunman who survived said that the attackers had used
Google Earth to familiarise themselves with the locations of buildings used in the attacks. Of the 10 gunmen, nine were subsequently shot dead and one was captured by security forces. Witnesses reported that they seemed to be in their early 20s, wore black T-shirts and jeans, and smiled and looked happy as they shot their victims. Initially, some of the attackers reported to be British citizens, but the Indian government later stated that there was no evidence to confirm this. Similarly, early reports of 12 gunmen were also later shown to be incorrect. On 6 April 2010, the Home Minister of
Maharashtra, informed the assembly that the bodies of the nine killed Pakistani gunmen from the 2008 attack on Mumbai were buried in a secret location in January 2010, although several organizations advocated for a sea burial. The bodies had been in the mortuary of a Mumbai hospital after Muslim clerics in the city refused to let them be buried on their grounds.
Attackers Only one of the attackers, Ajmal Kasab, survived the attack. He was
hanged in
Yerwada Central Jail in 2012.
Arrests Ajmal Kasab was the only attacker arrested by police. At first, he deposed to police inspector Ramesh Mahale that he had come to India "to see
Amitabh Bachchan's bungalow", and that he was apprehended by the
Mumbai Police outside the bungalow. Much of the information about the attackers' preparation, travel, and movements comes from his subsequent confessions to the Mumbai police. On 12 February 2009, Pakistani Interior Minister
Rehman Malik said that Pakistani national Javed Iqbal, who acquired VoIP phones in Spain for the Mumbai attackers, and Hamad Ameen Sadiq, who had facilitated money transfer for the attack, had been arrested. Two Pakistanis were arrested in
Brescia, Italy (east of
Milan), on 21 November 2009, after being accused of providing logistical support to the attacks and transferring more than US$200 to Internet accounts using a false ID. They had
Red Corner Notices issued against them by
Interpol for their suspected involvement and it was issued after the last year's strikes. In October 2009, two Chicago men were arrested and charged by the FBI for involvement in "terrorism" abroad, David Coleman Headley and Tahawwur Hussain Rana. Headley, a Pakistani American, was charged in November 2009 with scouting locations for the 2008 Mumbai attacks. Headley is reported to have posed as an American Jew and is believed to have links with militant Islamist groups based in Bangladesh. On 18 March 2010, Headley pleaded guilty to a dozen charges against him thereby avoiding going to trial. In December 2009, the FBI charged
Abdur Rehman Hashim Syed, a retired
major in the
Pakistani Army, for planning the attacks in association with Headley. On 15 January 2010, in a successful snatch operation,
R&AW agents nabbed Sheikh Abdul Khwaja, one of the handlers of the 26/11 attacks, chief of
HuJI India operations and a most wanted suspect in India, from
Colombo, Sri Lanka, and brought him over to
Hyderabad, India, for formal arrest. On 25 June 2012, the Delhi Police Department arrested Zabiuddin Ansari, alias Abu Hamza, one of the key suspects in the attack at the
Indira Gandhi International Airport in New Delhi. His arrest was touted as the most significant development in the case since Kasab's arrest. Security agencies had been chasing him for three years in Delhi. Ansari is a LeT ultra and the Hindi tutor of the 10 attackers who were responsible for the Mumbai attacks in 2008. He was apprehended, after he was arrested and deported to India by Saudi Intelligence officials as per official request by Indian authorities. After Ansari's arrest, investigations revealed that in 2009 he allegedly stayed for a day in a room in Old Legislators's Hostel, belonging to Fauzia Khan, a former MLA and minister in Maharashtra government. The minister, however, denied having any links with him. Home Minister P. Chidambaram asserted that Ansari was provided a safe place in Pakistan and was present in the control room, which could not have been established without active State support. Ansari's interrogation further revealed that
Sajid Mir and a Pakistani Army major visited India under fake names as cricket spectators to survey targets in Delhi and Mumbai for about a fortnight.
Sajid Mir, a Pakistani citizen and key operative of the militant
Islamic extremist group LeT, is seen as one of the main organisers of the 2008 attacks. He has been called the "mastermind" and "project manager". a reward of up to $5 million for information leading to the arrest and conviction of Mir. Mir has carried out terrorism operations in different parts of the world, including France. On April 10, 2025, the
NIA formally arrested Tahawwur Rana after his arrival from the U.S. == Casualties and compensation ==