Operation Mahadev:
How India Tracked the Pahalgam Attackers and Closed the Hunt
By
Mitin Sheth (Shanilohit)
Originally Published: April 22, 2026 | Revised: August 22, 2026
Estimated
Reading Time: 10–12 minutes
The Pahalgam attack of April 22, 2025 triggered more than one Indian response. Operation Sindoor struck terror infrastructure across the border in May. Operation Mahadev pursued the men identified by Indian authorities as directly involved in the Baisaran killings. The subsequent NIA investigation added a third dimension: building the evidentiary chain behind the attack. Together, these operations reveal an evolving Indian counter-terror model built around intelligence, joint operations, forensic attribution and calibrated military response.
On April 22, 2025, Baisaran Valley near
Pahalgam became the scene of one of India's most consequential terrorist
attacks in recent years. Twenty-six people—25 Indian nationals and one Nepali
citizen—were killed. The attack struck at civilians in one of Kashmir's
best-known tourist destinations and immediately transformed what should have
been an ordinary spring day into a national security crisis. The consequences
would extend far beyond Pahalgam, triggering a chain of military, intelligence,
diplomatic and investigative responses whose significance became clearer only
over the following months.
When I originally wrote about Operation
Mahadev on the first anniversary of the Pahalgam attack, the article
concentrated on the long pursuit of the attackers and India's determination to
bring the hunt to an end. The original version described the operation as a
93-day, 250-kilometre pursuit through South Kashmir. Subsequent access to
official accounts makes it possible to tell the story more precisely. The
publicly confirmed record establishes an extended intelligence effort, a joint
operation led by the Army's 4 Para with CRPF and Jammu & Kashmir Police,
forensic identification of the recovered weapons, and a continuing NIA
investigation that by July 2026 had reached senior Pakistan-based
Lashkar-e-Taiba leadership.
The result is a story larger than a single
encounter. Operation Mahadev needs to be understood alongside Operation Sindoor
and the NIA investigation. One addressed terror infrastructure beyond India's
borders, another closed the hunt for the gunmen identified by Indian
authorities, and the third sought to establish the wider conspiracy through
evidence that could withstand judicial scrutiny.
Executive Summary
The response to the Pahalgam attack
unfolded along three distinct but interconnected tracks. Operation Sindoor,
launched during the night of May 6–7, 2025, targeted nine terror infrastructure
sites in Pakistan and Pakistan-occupied Jammu and Kashmir. Operation Mahadev
culminated on July 28, when a joint Army, CRPF and Jammu & Kashmir Police
operation killed three Lashkar-e-Taiba terrorists whom Indian authorities
identified as being involved in the Baisaran attack. The NIA investigation
subsequently built the legal and forensic case, culminating in a December 2025
chargesheet and a supplementary chargesheet in July 2026 naming Pakistan-based
LeT chief Hafiz Saeed.
This distinction is essential. Operation
Sindoor was not subsequent to Operation Mahadev, as the earlier version of this
article suggested. The chronology was Pahalgam on April 22, Operation Sindoor
in early May, and Operation Mahadev's decisive encounter on July 28. Together
they illustrate an Indian counter-terror approach in which external deterrence,
domestic intelligence operations and forensic investigation increasingly
function as separate components of a wider response.
April 22: The Attack That Changed the Security
Equation
Baisaran's attraction lies precisely in its
distance from the imagery normally associated with conflict. Surrounded by
mountains and reached by tourists seeking Kashmir's natural beauty, it
represented the civilian and economic normalcy that had gradually returned to
the Valley. The attack therefore carried significance beyond the immediate loss
of life. Terrorists had targeted civilians in a tourism zone, striking at
families while simultaneously attacking the perception that Kashmir was
becoming safer and more accessible.
The NIA's later chargesheet described the
attack as involving religion-based targeted killings by Pakistan-sponsored
terrorists and charged the banned Lashkar-e-Taiba/The Resistance Front as an
entity for its alleged role in planning, facilitating and executing the attack.
The agency's December 2025 chargesheet ran to 1,597 pages and named seven
accused, including a Pakistan-based handler.
That investigation is important because
counter-terrorism cannot end with the death of the gunmen. Neutralizing
attackers closes an immediate operational threat; establishing who planned,
financed, facilitated and directed an attack addresses the network behind it.
That distinction would eventually become
central to the Pahalgam response.
The First Response: Preventing Escape and Building
Intelligence
The immediate security challenge was
straightforward to describe but exceptionally difficult to execute: identify
the attackers, prevent them from escaping and find them in terrain capable of
concealing small armed groups for extended periods.
According to the Home Ministry's account
presented in Parliament, security agencies made sustained efforts between May
22 and July 22 to confirm intelligence concerning the terrorists' location.
Their presence was confirmed on July 22. This is a much firmer evidentiary
foundation than the earlier article's claim that Para SF personnel physically
pursued the group for 93 consecutive days over 250 kilometres.
The distinction does not diminish the scale
of the operation. It makes the account more credible.
Counter-terror intelligence in mountainous
terrain is rarely a continuous cinematic chase. It is more often a process of
collecting fragments, questioning witnesses, checking sightings, monitoring
movement patterns, eliminating false leads and waiting until intelligence
becomes sufficiently reliable to act. Patience can matter as much as speed.
The Pahalgam investigation demonstrated
this painstaking dimension. Home Minister Amit Shah told Parliament that
investigators questioned 1,055 people—including tourists, pony operators,
photographers, employees and shop workers—for more than 3,000 hours, with the
questioning recorded on video. Information obtained through this process helped
investigators prepare sketches and identify individuals accused of providing
shelter to the attackers.
That is perhaps the less dramatic but more
revealing story of Operation Mahadev: the final encounter lasted a limited
period, but the intelligence architecture behind reaching that moment was built
over weeks.
Operation Sindoor Came First
The chronology matters because Operation
Mahadev was only one component of India's response.
During the night of May 6–7, 2025—more than
two months before Operation Mahadev's culmination—the Indian Armed Forces
launched Operation Sindoor. The Ministry of Defence said nine terror
infrastructure sites in Pakistan and Pakistan-occupied Jammu and Kashmir were
targeted. The initial Indian statement characterized the action as focused,
measured and non-escalatory and said Pakistani military facilities had not been
targeted in the opening strikes.
Pakistan subsequently attempted to engage
multiple Indian military targets using drones and missiles on the night of May
7–8, according to India's Ministry of Defence. India said these attacks were
neutralized by its Integrated Counter-UAS Grid and air-defence systems, after
which Indian forces targeted Pakistani air-defence radars and systems.
Operation Sindoor therefore belonged to a
different level of the response. It was not the manhunt for the individual
gunmen at Baisaran. It was a military operation directed against terror
infrastructure that India said was used to plan and direct attacks against it.
That distinction allows the strategic
picture to be understood more clearly: Sindoor targeted infrastructure and the
external terror ecosystem; Mahadev targeted the identified attackers inside
Kashmir; the NIA investigation pursued the evidentiary chain and wider
conspiracy.
The Intelligence Breakthrough
By late July, the intelligence picture had
tightened. According to the Home Ministry's parliamentary account, the presence
of the suspects was confirmed on July 22. The operation that followed brought
together the Army, CRPF and Jammu & Kashmir Police under the leadership of
the Army's 4 Para. On July 28, the joint force surrounded the suspects and
killed all three.
Indian authorities identified them as
Suleman alias Faizal Jatt, Hamza Afghani and Zibran. Government statements
described them as Lashkar-e-Taiba terrorists and linked them to the Pahalgam
killings.
The significance of the operation lay not
simply in killing three armed men. Counter-terror operations are vulnerable to
competing narratives, particularly when attribution has international
implications. India therefore needed to establish that the men killed during
Operation Mahadev were actually connected to the Baisaran attack.
This is where forensic evidence became
central.
The Weapons Became Evidence
Three rifles were recovered after the
encounter: one M4 carbine and two AK-47 rifles, according to the Home
Ministry's account. Cartridge cases recovered from the Baisaran attack site had
already been sent for forensic examination. After Operation Mahadev, the
recovered rifles were test-fired and subjected to ballistic comparison. The
government told Parliament that the forensic matching established that these
weapons had been used during the Pahalgam attack.
This was one of the most important elements
missing from the dramatic framing of the earlier article.
A counter-terror operation can end an
immediate threat. Forensic evidence connects the operational outcome to the
original crime.
The difference is fundamental. Without
attribution, the state has an encounter. With a defensible evidentiary chain,
it can construct a case connecting weapons, attackers, facilitators and the
wider organization.
This is also why the earlier article's
claim that the recovery of an American-made M4 by itself demonstrated an
“international conspiracy” should be discarded. The origin of a weapon does not
by itself establish who supplied it or prove state sponsorship. The stronger
evidence lies in ballistic matching, witness identification, investigation of
facilitators, communications and the organizational trail subsequently
presented by the NIA.
Restraint in wording makes the case
stronger, not weaker.
Operation Mahadev - From Pahalgam to the Pursuit of Justice: The intelligence, investigation, joint security operation and forensic process that followed the April 22, 2025 Pahalgam attack.
The NIA Investigation Extended
Beyond the Encounter
Operation Mahadev ended the immediate hunt,
but the investigation continued.
In December 2025, the NIA chargesheeted
seven accused, including LeT/TRF as an entity and Pakistan-based handler Sajid
Jatt. The agency said its 1,597-page chargesheet detailed the conspiracy, roles
of the accused and supporting evidence.
The investigation moved further in 2026. On
July 6, the NIA announced a supplementary chargesheet naming Pakistan-based
LeT/TRF chief Hafiz Saeed in the Pahalgam terror attack case.
That development changes the way the first-anniversary
article should now be read.
By April 2026, Operation Mahadev could
reasonably be presented primarily as the story of the hunt. By August 2026,
however, the investigation had moved deeper into the alleged command and
organizational structure. The story had evolved from Who pulled the
trigger? to the much larger question of Who
enabled, directed and supported the attack?
That is why the investigative phase
deserves equal weight with the military operation.
Technology Matters ,but We Should
Not Invent It
The original version described HALE drones,
electro-optical sensors and a newly acquired AI-driven surveillance system
allegedly capable of analysing thermal signatures beneath dense forest canopy. These
details made for compelling prose, but I have not found authoritative public
documentation supporting those specific claims in relation to Operation
Mahadev.
They should therefore not appear as
established facts.
This does not mean technology was irrelevant.
Modern counter-terror operations routinely draw upon communications
intelligence, surveillance, drones, imagery, forensic science and human
intelligence. But responsible defence analysis must distinguish what is
technologically plausible from what has actually been publicly confirmed for a
particular operation.
In Operation Mahadev, the strongest
publicly documented technological contribution is forensic rather than
cinematic: cartridge cases recovered from Baisaran were compared with weapons
recovered after the encounter. That scientific chain helped connect the July
operation with the April crime.
For a serious strategic article, that
verified fact is more valuable than an impressive but unsupported description
of secret surveillance technology.
Jointness Was the Operational
Strength
Another important lesson lies in the
composition of the force.
Operation Mahadev was not presented by the
government as an Army-only mission. It involved the Army, CRPF and Jammu &
Kashmir Police, with the final operation led by 4 Para.
This matters because counter-terrorism in
Kashmir requires capabilities that no single institution possesses in
isolation. The Army brings military and specialized operational capability;
central forces contribute security depth and counter-terror experience; local
police possess terrain knowledge, human networks and investigative reach; while
the NIA brings a national-level investigative and prosecutorial function.
The success of the operation therefore
offers a broader lesson about modern internal security. Sophisticated threats
increasingly require institutional integration rather than institutional
competition.
The same principle appeared at a different
scale in Operation Sindoor, which the Ministry of Defence described in terms of
multi-agency intelligence and tri-service coordination.
Across the two operations, jointness
emerges as one of the most important themes.
From Tactical Action to Strategic
Signalling
The Pahalgam response also illustrates the
evolution of India's counter-terror doctrine, although terms such as “strategic
pre-emption” should be used carefully.
Operation Sindoor demonstrated India's
willingness to use overt military force against identified terror
infrastructure across the border following a mass-casualty attack. The initial
May 7 statement nevertheless deliberately characterized the strikes as focused,
measured and non-escalatory.
That language is strategically important.
Deterrence is not synonymous with
uncontrolled escalation. A state seeking to impose costs while limiting a
conflict must demonstrate both capability and calibration. Operation Sindoor's
significance therefore lies not simply in the fact that force was used, but in
the attempt to define the target set and communicate limits even while executing
the operation.
Operation Mahadev served a different
signalling function. It demonstrated persistence: the passage of time after an
attack did not mean the search had ended.
Taken together, the two operations conveyed
two messages reach and endurance.
Justice Is Larger Than
Retaliation
There is, however, another dimension that
military analysis can too easily overlook.
Twenty-six lives were lost at Baisaran. For
the families, the elimination of attackers and the filing of chargesheets
cannot restore what was taken from them. Security success and personal closure
are not the same thing.
The original article used the phrase
“rehabilitation justice” to describe the continuing responsibility toward
survivors and victims' families. The phrase remains useful, provided we avoid
making unsupported claims about particular families being trapped in
bureaucracy.
A democratic state's response to terrorism
has several dimensions. It must prevent further attacks, identify and prosecute
those responsible, strengthen security failures exposed by the attack and
support the people whose lives were permanently changed.
Counter-terror success cannot be measured
only in militants killed or camps destroyed.
It must also be measured in whether
ordinary citizens can return to public spaces without allowing terrorism to
dictate their lives.
Kashmir After Pahalgam
This is particularly important for Kashmir
because tourism has economic as well as symbolic significance. Terrorism seeks
not only to kill but to alter behaviour to make citizens afraid to travel,
invest, work or live normally.
The appropriate response therefore cannot
be permanent militarization of civilian life. Security has to become more
effective while allowing normalcy to recover.
The objective is not to pretend that the
threat has disappeared. It is to prevent the threat from defining Kashmir's
future.
That balance—between vigilance and normal
civilian life—is considerably harder to achieve than either triumphalism or
fear would suggest.
What Operation Mahadev Actually
Teaches
The most important lesson of Operation
Mahadev is not that modern technology makes terrorists impossible to hide. The
weeks required to confirm their location demonstrate precisely the opposite.
Nor is the lesson that every attack can be
answered through a dramatic special-forces pursuit.
The deeper lesson is persistence.
Witness interviews, sketches, local
intelligence, surveillance, inter-agency coordination, patient verification,
the final joint operation and forensic matching formed parts of one chain.
Break any important link and attribution becomes weaker.
Operation Mahadev therefore belongs as much
to the history of intelligence-led policing and investigation as it does to the
history of special operations.
That is what makes it strategically
interesting.
From Pahalgam to Sindoor to
Mahadev and Then to the Courtroom
Viewed from August 2026, India's response
to Pahalgam can now be understood as a sequence rather than a single act of
retaliation.
The first imperative was security: contain
the situation and prevent the attackers from escaping. The second was external
military response: Operation Sindoor targeted nine terror infrastructure sites
on May 7. The third was the intelligence-led hunt culminating in Operation
Mahadev on July 28. The fourth was forensic and judicial: build the case
against facilitators, organizations, handlers and alleged senior conspirators.
The December 2025 NIA chargesheet and July
2026 supplementary chargesheet show that the fourth phase is still
consequential.
This four-stage sequence is arguably more
important than any dramatic description of a mountain pursuit. It suggests a
counter-terror architecture in which military action does not replace
investigation, and investigation does not eliminate the need for deterrence.
Each performs a different function.
Conclusion: Persistence, Evidence
and Deterrence
Operation Mahadev should be remembered as
the closing of an operational hunt, but not as the end of the Pahalgam story.
The attack on April 22, 2025 was followed
by Operation Sindoor in May, the joint Operation Mahadev encounter in July, an
extensive NIA chargesheet in December and further investigative action in 2026.
The chronology reveals a response that operated across military, intelligence,
forensic, diplomatic and legal domains.
The strongest lesson is also the least
theatrical. Intelligence requires patience. Attribution requires evidence.
Joint operations require institutional trust. Deterrence requires both
capability and control. And justice requires more than the elimination of the
men who carried weapons.
The original article carried the line, “Every
Drop of Blood Accounted For.” I would retain its emotional
meaning, but reinterpret it for this revised edition. Accountability should not
be measured only by retaliation. It should mean identifying the attackers,
establishing the network behind them, disrupting the infrastructure that
enables terrorism, building evidence capable of surviving scrutiny, and
ensuring that the victims are never reduced to statistics in a strategic
narrative.
Operation Mahadev closed one hunt.
The investigation into the architecture
behind Pahalgam has shown why the larger fight against terrorism does not end
when the gunfire stops.
Selected References
Ministry
of Defence / Press Information Bureau — “Operation Sindoor: Indian Armed Forces
Carried Out Precision Strike at Terrorist Camps,” May 7, 2025
Official Operation Sindoor announcement
Disclaimer
This article is an independent strategic
analysis based on publicly available government records, official investigative
releases and open-source information. Operational details that have not been
publicly verified have deliberately not been presented as established facts.
Discussion of terrorism and counter-terrorism is for journalistic, historical
and analytical purposes and does not glorify violence.
"Independently authored work. AI tools were used only for supportive tasks (research, translation, editing, image generation, and grammatical/punctuation correction). Final content and creative direction are the author’s own".
Copyright Notice
Copyright
© 2026 Mitin Sheth (Shanilohit). All Rights Reserved. No part of this article
may be reproduced, distributed or transmitted without prior written permission
from the author, except for brief quotations permitted under applicable
copyright law.
No comments:
Post a Comment