Some nights etch themselves into history with a single, unforgettable event, November 26, 2008, in Mumbai was one such night, marked by tragedy and resilience.
Ten men arrived by sea, moved ashore in a divided formation and then executed a sequence of attacks whose precision suggested rehearsal rather than impulse. Their navigation equipment carried preloaded coordinates. Their communication devices connected instantly to external controllers.
Their movements reflected a plan constructed elsewhere, long before they stepped into the inflatable vessel that brought them to Indian soil. The operation bore the stamp of a network with discipline, resources and uninterrupted direction.
As investigators reconstructed the path of the attackers, they found a trail that led repeatedly into Pakistan’s militant infrastructure. Testimony from Kasab revealed instruction sites in Muridke, Muzaffarabad and Thakot where the recruits learned weapons handling, explosives assembly and close-quarter battle in simulated urban settings.
Recovered GPS units held routes that matched a maritime path from Karachi to Mumbai. Satellite phone logs mapped an active control room in Karachi where handlers monitored Indian television coverage and adjusted instructions accordingly.
These were not speculative inferences but factual points established by forensic analysis, judicial testimony, and international intelligence collaboration.
Further details emerged through the statements of David Headley, who executed multiple reconnaissance missions in Mumbai before the attacks.
He described meetings with Lashkar planners in Pakistan, the compilation of videos and sketches of potential targets, and the supervision extended by individuals with backgrounds in Pakistan’s security establishment.
He identified the roles of Sajid Mir and Zaki-ur-Rehman Lakhvi in selecting targets and shaping the operational method. His account was later corroborated by phone intercepts, recovered emails and movement records. Headley did not invent a conspiracy. He revealed one.
What the Mumbai inquiry demonstrated was that the architecture behind such attacks had a clear recruitment pipeline moving through seminaries and local networks. There were clearly demarcated training modules and instructors with professional military experience.
There were logistical teams arranging transport, equipment, funds and forged documents. Above all, there were handlers stationed safely within Pakistan, guiding the attackers in real time. The investigation made visible a system that was not hidden. It was preserved.
Years passed, and the system did not fragment. It adjusted. It widened its reach. It altered the packaging of its front organisations while maintaining the same leadership and the same ideological aim.
Pakistan’s official narrative insisted that such groups operated independently, yet the physical locations of their camps remained under areas of firm military oversight. Their leaders continued to appear openly, addressing gatherings and issuing statements.
Their charitable fronts reappeared under new names after nominal bans. Their access to arms, communication tools, and training spaces did not diminish or remain constant; rather, it increased, according to OSINT sources, indicating that the Pakistani state was supplying them with more than required.
In the years that followed, India confronted and dealt with several major attacks, thereby proving this hypothesis true.
In January 2016, militants attempted to breach the Pathankot Air Force base. Their infiltration route crossed from Pakistan. Their calls to handlers linked back to numbers inside Pakistan. The footprints the investigators traced looked familiar, not only in method but in origin. The following September, the Uri attack targeted an Indian Army brigade headquarters.
Nineteen soldiers were killed. The attackers crossed from Pakistan-administered territory. Their recovered weapons bore Pakistani markings. GPS logs reflected starting points consistent with infiltration staging grounds used in earlier incidents. In February 2019, a suicide bomber struck a CRPF convoy in Pulwama.
The attack was claimed by Jaish-e-Mohammed. Forensic analysis linked the bomber to a module that maintained communication with operatives in Pakistan. The explosives used were consistent with materials sourced through cross-border channels.
Once more, the informational trail led to individuals situated inside Pakistan whose identities were known to Indian and international agencies. The structure exposed in Mumbai persisted across these episodes with minimal modification.
The Pahalgam ambush in June 2025 is the most recent entry in this sequence. Militants attacked an Indian Army vehicle near the traditional pilgrimage route. The strike involved assault weapons and coordinated movement in forested terrain.
Devices recovered from the site contained communication logs that matched numbers identified previously in Lashkar-linked operations. The route used by the attackers for movement across the Line of Control aligned with infiltration corridors that India has monitored for decades.
Nothing about the incident’s origins suggested a rupture with the past. It reflected direct continuity.
These operations share three common elements. First, the participants are young men recruited through networks embedded in Pakistan’s religious seminaries and militant circles.
Second, the technical training they receive is consistent in method, location and instruction style. Third, their handlers operate from locations in Pakistan that have remained active despite international scrutiny. A pattern with such consistency cannot be sustained without tolerance from institutions that administer the regions where these groups operate. The role of Pakistan’s intelligence establishment appears repeatedly across investigations.
Evidence gathered after 26/11 documented the presence of serving and retired officers who met reconnaissance operatives, reviewed plans and provided feedback.
Headley’s testimony described contact with individuals connected to the Inter-Services Intelligence directorate. Intelligence intercepts of other attacks captured handlers using communication channels that were already associated with earlier incidents.
Pakistan’s authorities denied these connections, yet the evidence accumulated over the years paints a coherent picture.
India’s security posture has shifted in recognition of this reality. The 2016 surgical strikes targeted launch pads used by infiltration teams. The Balakot operation in 2019 struck a training compound linked to Jaish-e-Mohammed. Operation Sindoor in 2025 reflects India’s assessment that the threat is ongoing and originates from infrastructure sheltered beyond the border. Each response is guided by the understanding that the challenge is not episodic militancy but a continuous system sustained by parts of the Pakistani state.
What remains consistent is Pakistan’s refusal to address the network at its core. Some leaders have been detained briefly. Some properties have been seized for a few months at a time.
Yet the essential operational capabilities of Lashkar-e-Taiba and Jaish-e-Mohammed persist. Their fundraising continues through organisations that reorganise under altered registrations. Their digital propaganda remains available.
Their training activities in Pakistan-administered Kashmir continue with minor changes in location. The anniversary of 26/11 is therefore more than a solemn remembrance. It is a reminder of the clarity that Mumbai provided.
The system that directed those attacks remains active on the other side of the border. The names of the attackers may change. The locations may differ. The devices they carry may evolve. The rooms in which these attacks are conceived, however, remain the same. Their occupants retain the same intent. Their methods reflect the same doctrine.
India’s understanding of the threat has been shaped by years of evidence. The Mumbai investigation offered a detailed map of how Pakistan-based groups plan, train and execute strikes. Every major attack since has affirmed the relevance of that map.
Pahalgam in 2025 underscores that the masterminds behind 26/11 never left their seats. They continue to direct operations with the confidence that comes from protection, not concealment. Unfortunately, until that protection ends, the pattern will continue.
Shashwat Gupta Ray is a multiple award-winning defence and strategic affairs journalist with over 20 years of experience in print and digital media. Previously Deputy Editor at Herald Group of Publications and Resident Editor at Gomantak Times, he has extensively covered major events, including the 26/11 Mumbai terror attacks and Maoist insurgencies. He is also the creator of the award-winning YouTube channel Uncovering India, which focuses on impactful social and developmental documentaries.
