New Delhi: Why did the Lashkar-e-Taiba (LeT) and its affiliate The Resistance Force (TRF) rush to claim responsibility for the Pahalgam terror strike and then backtrack?
The National Investigation Agency (NIA), in its chargesheet, has revealed how the two terror outfits panicked, purged the claims and launched an elaborate false-flag narrative once the United Nations Security Council (UNSC) mounted pressure on Pakistan.
Within two-and-a-half hours of the ghastly attack on April 22, 2025, the TRF boasted and took full responsibility through its social media channels. On April 25, the outfit executed a panicked digital rollback, as reported by News18.
This followed a formal UNSC statement, condemning the massacre.
On that fateful day, three heavily armed terrorists descended from the surrounding forests and started killing tourists at the Baisaran Valley in Pahalgam after ascertaining their religious identity.
The terrorists, armed with M4 carbines and AK-47s, killed 26 people. This was regarded as the deadliest attack on civilians in India since the 2008 Mumbai attacks.
After the UNSC statement, the TRF launched automated Telegram bots to distribute a denial-cum-false-flag claim, manufacturing an internal-audit narrative, alleging that Indian agencies had planted unauthorised posts, showing the outfit to be responsible.
The TRF’s formal handles cited past sensitive cases – Chattisinghpora (2000), Parliament (2001) and Mumbai (2008) – to portray the attack as a state-sponsored plot, to create psychological doubt.
According to the NIA, the operatives attempted a 72-hour clean-up to scrub the initial admission posts, but failed to wipe metadata trapped on Pakistani telecom networks.
The sequence provides digital evidence supporting Ministry of Home Affairs (MHA) assessments that TRF operates as LeT’s digital and kinetic front.
The entire narrative timeline demonstrates that kinetic strikes in J&K are tightly tied to an aggressive, Pakistan-facilitated cyber-warfare war room, the NIA has stated.
In the chargesheet, the NIA has revealed how Telegram registration logs confirmed an active Pakistan (+92) mobile contact number tied to the primary denial handler. Network resolution mapped the denial release to IP 104.28.241.184 in Punjab, Pakistan, at the exact timestamp of publishing.