India’s shadow war against terrorism is the most consequential covert campaign of the twenty-first century, and it is being waged in plain sight. Since mid-2021, a procession of India’s most-wanted terrorists has been gunned down across Pakistani cities by assailants who arrive on motorcycles, fire at close range, and vanish into congested streets without leaving a trace of their identity or allegiance. The targets share three characteristics: they appear on Indian government designation lists, they belong to organizations responsible for mass-casualty attacks on Indian soil, and they live in a country that India has accused for decades of providing them sanctuary. The killers share two: they are never identified, and they never claim responsibility.

This is not a series of coincidences. The pattern of targeted killings in Pakistan reveals a systematic doctrine, one that follows a consistent modus operandi, an escalating target hierarchy, and a geographic expansion that stretches from Karachi’s commercial districts to Lahore’s residential neighborhoods to the tribal regions of Khyber Pakhtunkhwa. India’s shadow war is the defining counter-terrorism campaign of this era, and every eliminated target exposes the network that produced them, the state that protected them, and the doctrine that hunted them.

The scale of the campaign is difficult to overstate. In less than five years, the covert operation has reached into at least seven Pakistani cities, targeted members of at least four distinct organizational categories, eliminated individuals ranging from mid-level recruiters to co-founders of Pakistan’s most dangerous militant groups, and survived both international exposure and a four-day conventional military conflict between two nuclear-armed states. No previous Indian government possessed either the intelligence infrastructure or the political will to sustain such a campaign. The fact that it has continued uninterrupted through a national election cycle, through international accusations from Western allies, and through the most dangerous India-Pakistan military confrontation since 1971 suggests that the campaign has become a permanent feature of Indian counter-terrorism doctrine rather than a temporary response to a specific provocation.

The argument of this analysis is straightforward: the shadow war and the open war are not separate categories. They are phases of a single campaign. The motorcycle-borne assassins who killed Zahoor Mistry in his Karachi furniture shop in March 2022 and the precision missiles that struck Jaish-e-Mohammed’s Bahawalpur headquarters during Operation Sindoor in May 2025 are instruments of the same strategic logic. Every terrorist eliminated on foreign soil is simultaneously the closing chapter of one story and the opening chapter of another. Every attack on Indian soil generated a response; every response exposed a target; every target, when eliminated, revealed a network; every network, when mapped, pointed to the next name on the list. Understanding this chain is the only way to understand what India is doing, and why Pakistan cannot stop it.

The Campaign No One Claims

The shadow war has no official name, no declared beginning, and no acknowledged author. No Indian official has confirmed the existence of an organized campaign to eliminate terrorists on Pakistani soil. No intelligence agency has taken credit for a single killing. No government spokesperson has connected one death to the next or acknowledged the pattern that now spans more than thirty confirmed cases across at least seven Pakistani cities. Indian Ministry of External Affairs responses to Pakistani allegations have been consistent and categorical: the claims are dismissed as false propaganda. Prime Minister Narendra Modi has neither confirmed nor denied the covert campaign directly, though his public rhetoric has grown increasingly explicit. At a Bihar rally shortly after The Guardian published its April 2024 investigation into the killings, Modi told his audience that India now enters the homes of its enemies and strikes them there, a statement Pakistani officials interpreted as a tacit admission wrapped in plausible deniability.

Pakistan’s position has shifted four times since the killings began. In 2021, Islamabad largely ignored the incidents or attributed them to criminal disputes. By January 2024, Foreign Secretary Muhammad Syrus Sajjad Qazi was holding press conferences accusing India of orchestrating assassinations on Pakistani soil and claiming that Islamabad possessed evidence linking India’s Research and Analysis Wing, commonly known as RAW, to specific killings. The evidentiary material Pakistan has presented publicly, including financial transaction records from Dubai, WhatsApp communications, and arrested suspects’ confessions, points toward a network of sleeper cells operating primarily out of the United Arab Emirates, recruiting local criminals and Afghan nationals to carry out the shootings. Pakistani investigators allege that RAW handlers coordinate operations from Nepal, the Maldives, and Mauritius, funneling payments through informal hawala channels and occasionally recruiting radicalized individuals by convincing them they were killing apostates rather than designated terrorists.

The absence of official acknowledgment from either side is itself analytically significant. India benefits from ambiguity because it allows diplomatic engagement to continue on other tracks while the campaign operates in the background. Pakistan benefits from ambiguity because publicly admitting that Indian intelligence is conducting assassinations inside its borders would expose a catastrophic security failure. The result is an open secret, a campaign visible to every intelligence analyst, defense journalist, and social media user in both countries, operating beneath a formal layer of deniability that neither government has incentive to pierce. The ambiguity is not a bug in the system; it is the system.

The Twenty-Six Year Backdrop: From Kandahar to Pahalgam

The shadow war did not emerge from a vacuum. It is the product of a twenty-six-year arc of provocation, restraint, capability-building, and eventual retaliation that begins on the tarmac at Kandahar airport in December 1999 and runs through every major India-Pakistan crisis since.

The IC-814 hijacking is the origin event. On December 24, 1999, five armed terrorists seized Indian Airlines flight IC-814 shortly after takeoff from Kathmandu, Nepal, and forced it to Kandahar, Afghanistan, then under Taliban control. They held 178 passengers and 11 crew members hostage for a week, demanding the release of thirty-five imprisoned terrorists and two hundred million dollars in cash. The crisis ended on December 31, 1999, when a team of Indian negotiators, including Ajit Doval, who would later become India’s National Security Advisor, agreed to release three prisoners: Masood Azhar, Ahmed Omar Saeed Sheikh, and Mushtaq Ahmed Zargar. The decision to capitulate, made under immense public pressure with hostage lives at stake, was the most consequential counter-terrorism failure in Indian history. Azhar founded Jaish-e-Mohammed within weeks. Ahmed Omar Saeed Sheikh went on to orchestrate the kidnapping and murder of American journalist Daniel Pearl in 2002. The three men India released would collectively be responsible for thousands of deaths over the following two decades. India’s shadow war against JeM is, at its root, the effort to reverse the consequences of what happened on that Kandahar tarmac.

The December 2001 attack on the Indian Parliament, in which five JeM and LeT terrorists stormed the complex in Delhi and killed nine people before being shot dead, brought India and Pakistan to the brink of war. India mobilized nearly half a million troops along the border in what became known as Operation Parakram, the largest military mobilization in Indian history. The standoff lasted ten months. India did not strike. The restraint was not the product of strategic patience so much as strategic incapacity: India lacked the conventional military options that would allow it to punish Pakistan without risking full-scale war under the nuclear umbrella. The Parliament attack produced humiliation, not retaliation, and the lesson was absorbed by both sides. Pakistan learned that terrorism below a certain threshold would not trigger Indian military action. India learned that it needed capabilities that did not yet exist.

The November 2008 Mumbai attacks were the most devastating single act of Pakistan-based terrorism against India. Ten LeT operatives launched a coordinated assault on multiple targets across Mumbai, including the Taj Mahal Palace Hotel, the Oberoi Trident Hotel, the Chhatrapati Shivaji Terminus railway station, and the Chabad House Jewish center. The siege lasted three days and killed 166 people, including 28 foreign nationals from ten countries. India again exercised restraint. There was no military response, no surgical strike, no covert retaliation. The restraint was widely interpreted in Pakistan as confirmation that India’s threshold for military action was effectively unreachable. Husain Haqqani, Pakistan’s ambassador to the United States at the time, later wrote in “Magnificent Delusions” that the Indian response to 26/11 reinforced the Pakistani military establishment’s confidence that proxy warfare could be sustained without consequence.

Christine Fair, whose scholarship on the Pakistan Army’s strategic culture is among the most cited in the field, argued in “Fighting to the End” that Pakistan’s military doctrine treats the use of proxy militant groups as a rational instrument of state policy, one that allows Pakistan to impose costs on India in Kashmir and elsewhere without triggering the conventional military imbalance that India’s larger economy, larger population, and larger armed forces would bring to bear in open conflict. Fair’s framework explains why Pakistan’s safe haven infrastructure persists: it is not a failure of governance but a feature of strategy. The shadow war, in this analytical frame, is India’s response to a strategic calculation that decades of diplomacy, international pressure, and limited military responses failed to alter. If the safe haven is a feature rather than a bug, it must be attacked directly.

The Pulwama attack of February 14, 2019, killed forty Central Reserve Police Force personnel when a JeM suicide bomber drove a vehicle-borne improvised explosive device into a military convoy in Kashmir’s Pulwama district. India responded twelve days later with the Balakot airstrike, sending Mirage 2000 fighter jets across the international border to strike what it described as a JeM training facility near Balakot in Khyber Pakhtunkhwa. The Balakot strike was the first time India had used air power across the international boundary since the 1971 war. Pakistan retaliated the following day, leading to an aerial engagement in which both sides lost aircraft. The February 2019 escalation established that India was prepared to use air power inside Pakistan and that Pakistan would retaliate, but that the escalation could be managed short of full-scale war.

Indian intelligence officials told The Guardian in April 2024 that the Pulwama attack was the specific trigger for the shift to an offensive covert posture. The reasoning was blunt: India could not stop the attacks because their safe havens were in Pakistan, so the decision was made to go to the source. The Balakot airstrike was a one-time punitive response. The shadow war, which began two years after Balakot, was designed to be continuous, indefinite, and cumulative. It did not seek to punish a single attack. It sought to degrade the organizational capacity that produced the attacks. This distinction, between episodic retaliation and sustained attrition, is the doctrinal innovation that separates the shadow war from everything India tried before it.

Phase One: The Initiation, 2021 to 2022

The shadow war’s opening phase can be traced to three foundational events that established the campaign’s existence before media or analysts recognized the pattern.

The first was the car bomb that exploded on June 23, 2021, in the Johar Town neighborhood of Lahore, less than two hundred meters from the residence of Hafiz Muhammad Saeed, co-founder of Lashkar-e-Taiba and the man India and the United States hold responsible for masterminding the November 2008 Mumbai attacks that killed over 166 people. The blast killed three people and wounded more than twenty. No group claimed responsibility. Pakistan’s National Security Advisor Moeed Yusuf accused RAW of planning and financing the bombing, identifying the alleged mastermind as an Indian national. The car bomb did not kill Saeed, who was already in Pakistani custody on terrorism financing charges at the time, but its proximity to his residence carried a message that required no translation: India could reach the doorstep of Pakistan’s most protected terrorist. The car bomb was not a failed assassination. It was a declaration of intent.

The second foundational event was the killing of Saleem Rehmani in January 2022. Rehmani, designated as a terrorist by the Indian government and placed on its most-wanted list, was shot dead in Pakistan. Pakistani security officials, speaking to Al Jazeera on condition of anonymity, acknowledged the killing as one they believed was carried out by a hostile intelligence agency, using the standard euphemism for RAW. Rehmani’s death attracted limited media attention at the time, but it established the operational model: a designated Indian target, killed by unknown assailants, with no claim of responsibility and no arrests of the shooters.

The third event was the killing that made the pattern unmistakable. On March 1, 2022, two motorcycle-borne assailants entered a furniture warehouse inside Akhtar Colony in Karachi and shot Zahoor Mistry twice in the head at point-blank range. Mistry was not a furniture salesman. He was one of the five Jaish-e-Mohammed terrorists who had hijacked Indian Airlines flight IC-814 on December 24, 1999, forcing it to Kandahar and holding 178 passengers hostage for a week until India released three imprisoned terrorists, including Masood Azhar, who would go on to found JeM and direct some of the most devastating attacks against India in the following two decades. Mistry had been living under the false identity of Zahid Akhund, operating the Crescent Furniture company as a cover. CCTV footage showed the two assassins arriving on a motorcycle, their faces concealed by helmets and masks. They entered the shop, executed Mistry, and disappeared into the Karachi traffic.

The funeral that followed was, from an intelligence perspective, perhaps more significant than the killing itself. JeM’s operational chief Rauf Asghar, brother of Masood Azhar, attended Mistry’s funeral prayers in Karachi. Other senior JeM figures gathered openly to mourn a man whose public identity had been a furniture dealer. Pakistan’s Geo TV confirmed the death but identified the victim only as a Karachi businessman, omitting any reference to his history as a hijacker or his JeM affiliation. Pakistani media were reportedly instructed not to report the terrorist connection, an instruction that itself confirmed the significance of what had happened.

By mid-2022, the pattern existed. A car bomb near the residence of LeT’s founder. The shooting of a designated terrorist in Karachi. The execution of an IC-814 hijacker who had been living under an assumed name for over two decades. Three events, three cities, three organizations. The campaign had begun, though it would take months before media, analysts, and even Pakistani security services recognized the full scope of what was emerging.

The initiation phase reveals something important about the campaign’s strategic patience. The gap between the Lahore car bomb in June 2021 and the Mistry killing in March 2022, a span of nine months, suggests that the operational infrastructure was being tested, refined, and expanded before the pace accelerated. Intelligence networks require time to establish: safe houses must be rented, local contacts must be cultivated, communication channels must be tested under operational conditions, and the financial infrastructure for paying local assets must be confirmed as secure. The nine-month gap between the first and second confirmed events is consistent with a period of infrastructure-building rather than a period of inactivity, and it explains why the subsequent acceleration in 2023 was possible: the groundwork had already been laid.

Phase Two: The Acceleration, 2023

If 2021 and 2022 established the campaign’s existence, 2023 made its existence undeniable. The pace of killings accelerated sharply, the geographic spread widened, and the organizational range of targets expanded from JeM operatives to include LeT commanders, Hizbul Mujahideen figures, and Khalistan movement leaders.

The year opened with killings in February and continued through the spring. Bashir Ahmad Peer, a commander affiliated with Hizbul Mujahideen, was shot dead in Rawalpindi, the garrison city that serves as headquarters for the Pakistan Army. The symbolism of conducting an assassination in a city saturated with military and intelligence personnel was difficult to ignore. Additional targets fell in Karachi, extending the geographic pattern that had been established the previous year.

In April 2023, Amir Sarfaraz, known by the alias Tamba, was killed in Lahore by gunmen on a motorcycle. Sarfaraz was a former prisoner with alleged involvement in the 2011 killing of an Indian intelligence officer. Pakistani authorities publicly stated that the shooting bore the hallmarks of Indian involvement. The Lahore killing was significant for two reasons: it demonstrated operational capability in Pakistan’s second-largest city, the political and cultural capital of Punjab province, and it suggested that the campaign’s target list extended beyond currently active terrorists to include individuals with historical operational connections to anti-India violence.

The most symbolically resonant killing of 2023 occurred on May 6, when Paramjit Singh Panjwar, chief of the Khalistan Commando Force, was shot dead by two motorcycle-borne gunmen near his residence in Sunflower Society, Johar Town, Lahore. Panjwar, aged 63, had been designated as a terrorist under India’s Unlawful Activities (Prevention) Act in 2020. He was wanted in connection with multiple cases in Punjab, including the 1999 Chandigarh Sector 34 bomb blast, and was accused of running drug and weapons smuggling operations from his Lahore base. Panjwar had fled to Pakistan decades earlier and operated under ISI patronage, building connections with other Pakistan-based terror outfits. His killing expanded the campaign beyond the Kashmir-focused organizations, LeT and JeM, to encompass Khalistan separatist groups, signaling that the target list was not limited to a single category of threat.

The most operationally significant killing of the year came on October 11, 2023, when three gunmen pretending to be worshippers entered the Noor Madina Mosque in Daska town, Sialkot district, Punjab province, and shot Shahid Latif during pre-dawn prayers. Latif, aged 53, was a senior JeM commander designated as a terrorist under UAPA, wanted by India’s National Investigation Agency, and identified by Indian intelligence as the mastermind of the January 2016 Pathankot airbase attack that killed seven Indian military personnel. Latif had infiltrated Kashmir in 1993, was arrested a year later, and spent sixteen years in Indian prison, where he shared a cell with Masood Azhar at Kot Balwal jail in Jammu. After his deportation to Pakistan in 2010, he rejoined JeM and rose to become its launching commander for the Sialkot sector. The three gunmen arrived on a motorcycle, entered the mosque compound during Fajr prayers, and opened fire. Latif and his security guard Hashim Ali died instantly. A third associate, Maulana Ahad, succumbed to wounds the following day.

Pakistan’s Punjab police chief, without naming India directly, stated that a rogue nation and its hostile intelligence agency were involved. The local district police officer classified the incident as a targeted killing and an act of terrorism. Pakistani investigators later arrested suspects and alleged that a twenty-year-old Pakistani, recruited by RAW while working at an Amazon warehouse in the UAE for a meagre wage, had been paid 1.5 million Pakistani rupees to track Latif and was promised 15 million rupees and his own catering business if he carried out the assassination.

The Latif killing illustrated the campaign’s operational sophistication in several dimensions. First, the attackers infiltrated a mosque compound, a space of religious sanctuary, during the pre-dawn Fajr prayers when Latif’s presence was predictable, his guard would be partially lowered, and the darkness would aid escape. Second, they disguised themselves as worshippers to pass through the security perimeter that Latif, as a known target, had established around himself. Third, the choice of Sialkot, a city in northeastern Punjab close to the Indian border, demonstrated that the campaign could operate in areas where Pakistani security awareness was presumably heightened by proximity to the frontier. The attack on Latif was not opportunistic; it was the culmination of what Pakistani investigators described as months of surveillance, facilitation, and financial preparation stretching from Sialkot through the UAE back to alleged RAW handlers.

The final months of 2023 produced what analysts have termed the November cluster: a concentration of at least three killings within a compressed timeframe that made the campaign’s existence impossible for even skeptical observers to deny. The cluster included targets across different organizations and different cities, demonstrating a capacity for parallel operations that suggested multiple operational cells working independently toward the same strategic objective. The November cluster was the moment at which the analytical question shifted from whether a campaign existed to how it was being conducted and who was directing it. Before November 2023, a skeptic could plausibly attribute each individual killing to local violence, factional rivalry, or coincidence. After a cluster of three or more targeted killings of India-designated individuals from different organizations in different cities within a single month, the coincidence explanation required a degree of statistical implausibility that strained credulity. The November cluster was, in effect, the campaign’s announcement of itself to the analytical community, even as its authors continued to deny its existence.

By the end of 2023, Pakistani security officials speaking anonymously to Al Jazeera acknowledged at least six killings in that year alone, and two in the year before, as operations they believed were conducted by a hostile intelligence agency. The pace had shifted from isolated incidents to a recognizable tempo, and the campaign could no longer be dismissed as coincidence or internal score-settling. Two separate Pakistani intelligence agencies told Al Jazeera they suspected India’s involvement in up to twenty killings since 2020, citing witness testimonies, arrest records, financial statements, WhatsApp messages, and passports as evidence. The year 2023 marked the inflection point: before it, the campaign was deniable; after it, it was merely unacknowledged.

Phase Three: International Exposure, 2024

The shadow war entered the global public record on April 4, 2024, when The Guardian published an investigation claiming that the Indian government had orchestrated assassinations in Pakistan as part of a broader strategy to eliminate terrorists living on foreign soil. The report, based on interviews with intelligence officials from both India and Pakistan and documents shared by Pakistani investigators, provided the most detailed public account of the campaign’s operational mechanics to date.

The Guardian’s investigation described a network of RAW sleeper cells operating primarily out of the United Arab Emirates. These cells recruited local Pakistani criminals, Afghan nationals, and impoverished individuals, paying them through Dubai-based hawala channels to carry out specific killings. RAW handlers allegedly met in Nepal, the Maldives, and Mauritius to coordinate operations, keeping each element of the network compartmentalized. Pakistani investigators presented financial statements, WhatsApp communications, arrest records, and witness testimonies as evidence. The Guardian cautioned that the documents could not be independently verified.

Two Indian intelligence officers, quoted anonymously, confirmed to The Guardian that RAW had shifted to an offensive posture after the February 2019 Pulwama attack, in which a JeM suicide bomber killed forty Central Reserve Police Force personnel in Kashmir. One operative stated that the approach changed to target elements outside the country before they could launch attacks or create disturbance. He added that India could not stop the attacks because their safe havens were in Pakistan, so the decision was made to go to the source. Conducting such operations required approval from the highest level of government, and India drew inspiration from Israel’s Mossad and Russia’s KGB.

India’s Ministry of External Affairs dismissed The Guardian’s report as false and malicious anti-India propaganda, the same language it had used in January 2024 when Pakistan’s Foreign Secretary formally leveled allegations at a press conference. Pakistan’s Foreign Office called the Indian network of extra-judicial and extra-territorial killings a global phenomenon requiring a coordinated international response.

The Guardian investigation did not exist in isolation. It landed amid a broader international reckoning over alleged Indian covert operations abroad that had been building since mid-2023 and that fundamentally complicated India’s diplomatic position.

Canadian Prime Minister Justin Trudeau had accused Indian agents of involvement in the June 18, 2023, killing of Hardeep Singh Nijjar, a Sikh separatist leader and head of the Khalistan Tiger Force, who was shot dead in the parking lot of the Guru Nanak Sikh Gurdwara in Surrey, British Columbia. Canada expelled Indian diplomats over the allegations, and the resulting diplomatic crisis between New Delhi and Ottawa became the most severe rupture in bilateral relations since Indian independence. The United States had disclosed a separate alleged Indian plot to assassinate Gurpatwant Singh Pannun, a Sikh activist and American and Canadian dual citizen, on U.S. soil. American prosecutors indicted an Indian national, Nikhil Gupta, for allegedly conspiring with an Indian government official to hire a hitman to kill Pannun in New York. These Western allegations, involving targets in Five Eyes countries rather than in Pakistan, fundamentally altered the diplomatic context. India was no longer being accused only by its adversary; it was being accused by its closest Western partners, countries whose intelligence cooperation India relies upon and whose support in international forums India values.

The convergence of the Pakistani, Canadian, and American allegations created what Daniel Byman of the Brookings Institution has described as a pattern of extraterritorial covert action that spans multiple continents. Whether these operations are connected by a single strategic directive or represent independent decisions by different branches of Indian intelligence remains analytically uncertain. What is clear is that the international allegations provided context for the Pakistani claims: when Canada and the United States alleged Indian assassination plots on their territory, Pakistan’s previous allegations, which had been dismissed by Indian media as propaganda, acquired retroactive credibility. The Guardian’s investigation landed in this environment of heightened international scrutiny, and its impact was amplified by the North American allegations that preceded it.

India’s response to the international allegations has varied by audience. In the Pakistan context, India has denied all involvement categorically. In the Canada context, India initially denied the allegations, then engaged in limited cooperation with Canadian investigators before the diplomatic relationship deteriorated further. In the United States context, India conducted an internal inquiry that reportedly identified a former intelligence officer’s involvement and took steps to address American concerns, a response that acknowledged the seriousness of the allegations without admitting responsibility publicly. The differential response pattern suggests that India calibrates its engagement with allegations based on the strategic importance of the accusing country rather than the substance of the accusations.

The Guardian investigation’s significance for the shadow war lies not in what it proved, which remains contested, but in what it did not do: it did not slow the campaign. In the months following the investigation’s publication, the killings continued and, by some counts, accelerated. The exposure produced no deterrent effect. If anything, it served India’s strategic interests by signaling to Pakistan and to potential targets that the world now knew about the campaign and lacked the collective will to stop it.

The Convergence: Pahalgam, Sindoor, and the Post-Sindoor Surge

The shadow war’s most dramatic phase began not with a covert assassination but with an act of mass murder that shattered whatever remained of India’s strategic patience.

On April 22, 2025, gunmen attacked tourists at the scenic Baisaran Valley meadow near Pahalgam in Indian-administered Jammu and Kashmir. The Baisaran Valley, known locally as mini-Switzerland, is a high-altitude meadow surrounded by pine forests that had become one of Kashmir’s most popular tourist destinations. The attackers reportedly asked victims their religion before opening fire, selectively targeting Hindus in what Indian officials described as a deliberate attempt to incite communal violence and fracture India’s social cohesion from within. Twenty-six people died, twenty-five of them Indian Hindu tourists and one Nepali citizen. A local ponywala named Adil Shah was also killed. The Resistance Front, a proxy organization that Indian intelligence considers a front for Lashkar-e-Taiba, initially appeared to claim responsibility before subsequently denying involvement. India accused Pakistan of backing the attackers. Pakistan denied involvement and proposed a neutral third-party investigation that India rejected. The attack’s targeting methodology, asking victims their religion before executing them, carried echoes of the worst communal violence in South Asian history and produced a wave of public fury across India that exceeded even the response to the Pulwama bombing.

The Pahalgam massacre triggered a cascade of Indian retaliatory measures unprecedented in the history of India-Pakistan relations. India suspended participation in the Indus Waters Treaty of 1960, the water-sharing agreement that had survived three wars and every previous crisis. India closed the Attari-Wagah border crossing, the only authorized land crossing between the two countries. India halted all bilateral trade, including exports of onions and imports of cement and textiles, severing the primary land-based commercial route and imposing immediate economic pressure on Pakistan, which was already struggling with inflation and a debt crisis. India revoked visas of all Pakistani nationals residing in the country and expelled them. By April 30, India’s Ministry of External Affairs had briefed envoys of forty-five nations on the attack, and India dispatched seven all-party delegations comprising fifty-one members of parliament and former diplomats to thirty-three capitals worldwide to convey India’s position.

On the intervening night of May 6 and 7, 2025, India launched Operation Sindoor. Between 1:05 and 1:30 a.m. Indian Standard Time, a span of approximately twenty-three minutes, Indian Air Force jets fired precision missiles at nine targets across Pakistan and Pakistan-administered Kashmir. India reportedly deployed over 125 fighter jets alongside decoy drones, anti-radiation drones like the Israeli-origin Harop, and standoff weapons including BrahMos cruise missiles, SCALP air-launched cruise missiles, and Crystal Maze and Rampage precision-guided munitions. The strike list included JeM’s headquarters at the Jamia Masjid Subhan Allah complex in Bahawalpur, LeT facilities in Muridke near Lahore, and Hizbul Mujahideen positions in Pakistan-administered Kashmir. India stated that the strikes targeted terrorist infrastructure exclusively and that no Pakistani military or civilian facilities were hit. Pakistan claimed the strikes hit civilian areas and killed thirty-one civilians. JeM chief Masood Azhar himself confirmed that ten members of his family and four aides were killed in the Bahawalpur strikes. India’s Defence Minister Rajnath Singh stated on May 8 that at least one hundred militants had been killed in the strikes, though this figure could not be independently verified.

Operation Sindoor was the first time since 1971 that India struck across the international boundary with Pakistan, as opposed to the Line of Control. It was the most significant Indian military operation against Pakistani targets in over five decades. The Carnegie Endowment for International Peace described it as perhaps the most significant and daring military strikes by India on Pakistani targets since the Bangladesh Liberation War. The conflict continued for four days. Pakistan retaliated on May 10 with an operation codenamed Bunyan-un-Marsoos, launching drone attacks and missile strikes against Indian military installations including the Pathankot airfield and targets in Punjab, Rajasthan, and Kashmir. India intercepted multiple Pakistani missiles, including a Fatah-II long-range missile near Sirsa Air Force Station. Over five days, India established what analysts at Carnegie described as complete military dominance, with at least five Pakistani jets downed and multiple air defense sites, command and control centers, and airfields destroyed. A ceasefire was agreed on May 10, 2025, when Pakistan’s Director General of Military Operations called his Indian counterpart.

The convergence of the shadow war and the open war during and after Operation Sindoor is the central insight this analysis offers. The covert campaign that had been running since 2021 and the conventional military operation of May 2025 are not separate phenomena. They are two arms of the same strategic body, employing different instruments toward the same objective: demonstrating that Pakistan’s guarantee of sanctuary for anti-India terrorists has been permanently broken. The shadow war demonstrated that India could reach individual targets inside Pakistan’s cities. Operation Sindoor demonstrated that India could reach organizational headquarters inside Pakistan’s heartland. Together, they constitute a unified doctrine: states that shelter terrorism will discover that the shelter itself becomes the threat.

The post-Sindoor period, from late May 2025 through 2026, witnessed an unprecedented acceleration of the covert campaign. With Pakistan’s security infrastructure degraded by the conflict, its intelligence agencies distracted by the aftermath, and its military capacity strained by the losses sustained during the four-day war, the operational environment for targeted killings became permissive in ways that the pre-Sindoor period had not been. Pakistan’s internal security apparatus, already stretched thin by the TTP insurgency in the western provinces, the Balochistan Liberation Army’s escalating campaign in the southwest, and the chronic urban violence of Karachi, was now simultaneously processing the aftermath of a conventional military defeat. Security cordons around designated individuals weakened. Intelligence collection shifted from counter-espionage to post-conflict assessment. The institutional attention that might have detected and disrupted covert cells was redirected to more immediate priorities.

In the months following the ceasefire, the pace of killings surged. Compilations by researchers tracking unclaimed militant deaths in Pakistan documented over thirty incidents linked to the campaign in 2025 and 2026 combined, a cadence that dwarfed the eight to twelve annual killings of the 2022 to 2024 period. The acceleration followed a recognizable geographic and organizational pattern: kills were distributed across Karachi, Lahore, Punjab’s smaller cities, and Sindh, targeting LeT, JeM, and Hizbul operatives at a frequency that suggested multiple operational cells working concurrently. East Asia Forum reported that the attacks followed a consistent pattern across this period: UAE-based Pakistani workers or Afghan nationals were recruited by RAW in return for cash, and they worked with small local cells for months to plan and execute each killing.

Notable targets in this post-Sindoor phase included LeT leaders Zia ur Rehman, killed in Punjab in March 2025, and Abdul Rehman, killed in Sindh in May 2025. Mufti Shah Mir, a member of the radical Islamist group Jamiat Ulema-e-Islam with deep ties to Pakistan’s ISI, was shot dead by motorcycle-borne unknown gunmen in Balochistan on March 9, 2025. Mir was not merely a cleric but an operative accused of complicity in the abduction of former Indian Navy officer Kulbhushan Jadhav from Iran, a case that had been litigated before the International Court of Justice and that represented one of the most significant espionage controversies between India and Pakistan. Abu Qatal, also known as Qatal Sindhi, a senior LeT operative and key aide to Hafiz Saeed who was alleged to be the mastermind of the Reasi attack that targeted pilgrims in Jammu, was shot dead by unknown assailants in Jhelum, Punjab, on March 16, 2025. Saifullah Khalid, a LeT figure linked to the 2005 attack on the Indian Institute of Science in Bangalore and the 2006 assault on RSS headquarters in Nagpur, was killed in Matli City, Badin district, Sindh, on May 18, 2025. Khalid’s operational portfolio spanned two decades and multiple Indian states, making him one of the most experienced LeT operatives to be reached by the campaign.

The most audacious strike of the post-Sindoor phase came on April 16, 2026, when unidentified gunmen shot Amir Hamza, a co-founder of Lashkar-e-Taiba and one of its most senior surviving leaders, outside a news channel office in Lahore. Hamza, born in 1959 in Gujranwala, Punjab province, had co-founded LeT alongside Hafiz Saeed in the mid-1980s. He served on the organization’s central advisory committee, managed its external relationships, headed its special campaigns department, and edited its weekly newspaper. The United States Treasury had designated him as a sanctioned terrorist. He was rushed to hospital with critical injuries and survived, but the fact that the campaign had reached a co-founder of LeT, a man at the very apex of the organizational hierarchy, in Pakistan’s second-largest city, represented a threshold moment. The campaign was no longer picking off mid-level operatives. It was reaching into the founding generation of the organizations that had waged war against India for four decades.

The Organizations Under Siege

The shadow war’s target list spans four distinct organizational categories, each representing a different dimension of the threat India faces and a different strategic rationale for inclusion.

Lashkar-e-Taiba has lost more commanders to the campaign than any other organization. Founded by Hafiz Saeed and Zafar Iqbal in the late 1980s as the armed wing of the Markaz-ad-Dawa-wal-Irshad, LeT evolved into the most operationally capable anti-India terror organization in Pakistan. It planned and executed the November 2008 Mumbai attacks that killed 166 people across the city, the single deadliest terror attack on Indian soil. LeT’s operational reach extends from Kashmir through Punjab to Sindh, and its front organizations, particularly Jamaat-ud-Dawa and Falah-e-Insaniat Foundation, provide a recruitment and fundraising infrastructure that spans Pakistan. Stephen Tankel, who documented LeT’s organizational architecture in “Storming the World Stage,” described it as a parallel state within Pakistan, possessing its own education system, healthcare network, disaster-relief apparatus, and military wing, all sustained by state patronage and public donations. This institutional breadth is what makes LeT both strategically dangerous and operationally vulnerable: the organization is too large to hide and too embedded in Pakistani society to dismantle without disrupting the social fabric that surrounds it.

The shadow war has targeted LeT personnel across this geographic breadth. Sheikh Yousaf Afridi was killed in Landi Kotal, deep inside Khyber Pakhtunkhwa, approximately 250 kilometers from Islamabad, in territory where the Pakistan Army maintains a heavy presence. His killing broke a geographic barrier that previous operations had not crossed, penetrating into tribal regions where different ethnic, linguistic, and security dynamics prevail. Abu Qasim was shot at point-blank range inside a mosque in Rawalakot, in Pakistan-administered Kashmir, during prayers. Mufti Qaiser Farooq, an aide to Hafiz Saeed, was gunned down near a religious institution in Karachi’s Samanabad area. Ziaur Rahman, an LeT operative involved in radicalization activities, was shot during his evening walk in Karachi, a killing that demonstrated the attackers knew his daily schedule down to the hour and the route he followed through his neighborhood. Sardar Hussain Arain, a Jamaat-ud-Dawa operative responsible for the organization’s madrassa network in Sindh, was shot dead by unknown gunmen in Nawabshah, and his death exposed the extent of JuD’s educational infrastructure in southern Pakistan. The April 2026 shooting of co-founder Amir Hamza in Lahore represented the campaign’s highest-profile LeT target to date. The fact that a man who had co-founded LeT alongside Hafiz Saeed, who sat on the organization’s central advisory council, who was designated by the United States Treasury as a global terrorist, could be shot in broad daylight outside a Lahore news channel office despite enhanced security measures represented the campaign’s starkest demonstration that no level of organizational seniority guarantees protection.

Jaish-e-Mohammed holds a particular place in the campaign’s logic because it is the organization India created by accident. JeM’s founder, Masood Azhar, was released from an Indian prison in December 1999 during the IC-814 hijacking negotiations, a decision India has been paying for ever since. Azhar founded JeM within weeks of his release in January 2000, and the organization went on to attack the Indian Parliament in December 2001, bringing India and Pakistan to the brink of nuclear confrontation. JeM struck the Pathankot airbase in January 2016, killing seven Indian military personnel, and carried out the February 2019 Pulwama convoy bombing that killed forty CRPF personnel and triggered the Balakot airstrike. The shadow war’s JeM targets trace the organization’s entire history. Zahoor Mistry was one of the original IC-814 hijackers, the men who created the conditions for Azhar’s release and thus for JeM’s founding. Shahid Latif was the Pathankot mastermind, the man who translated JeM’s organizational ambition into specific battlefield casualties on Indian soil. Ibrahim Mistry was killed during prayers at a mosque, maintaining the pattern of targeting predictable routines. The connective tissue binding these cases is the IC-814 decision itself: India released Azhar in 1999 and has spent twenty-six years dealing with the consequences, and the shadow war against JeM is, in the starkest analytical sense, India cleaning up its own catastrophic mistake. Operation Sindoor’s strikes on JeM’s Bahawalpur headquarters, which killed members of Azhar’s family and several aides, collapsed the boundary between the covert and conventional campaigns. The same organization was being dismantled from above by missiles and from below by motorcycle-borne gunmen, and neither approach alone would have been sufficient.

Hizbul Mujahideen, the oldest active militant group in the Kashmir insurgency, has lost key operatives including Bashir Ahmad Peer, killed in Rawalpindi in February 2023, and Imtiaz Alam, killed during prayers. Hizbul’s Pakistan-based leadership, directed by supreme commander Syed Salahuddin from Rawalpindi, has been systematically degraded by eliminations that targeted the mid-level commanders responsible for planning cross-border infiltrations and coordinating attacks in Kashmir. Hizbul occupies a different organizational niche than LeT or JeM: it is rooted in the indigenous Kashmiri insurgency rather than the pan-Islamic jihadi movement, and its operatives tend to have personal connections to the Kashmir Valley. The shadow war’s targeting of Hizbul commanders in Rawalpindi, the seat of Pakistan’s military establishment, carries a specific symbolic weight: it demonstrates that even in the garrison city where the Pakistan Army’s General Headquarters is located, Indian operatives can identify, surveil, and reach designated targets.

The inclusion of Khalistan separatist groups, represented most prominently by Panjwar’s killing, signals that the shadow war is not limited to the Kashmir theater. Panjwar had been operating from Lahore for decades, receiving ISI support while running drug and weapons smuggling operations alongside his role as KCF chief. His killing by two motorcycle-borne gunmen while he walked in his housing society at 6 a.m. on May 6, 2023, exactly replicated the modus operandi used against Kashmir-focused targets in other cities. The Khalistan dimension connects to the broader international controversy over alleged Indian operations against Sikh separatists in Canada, where Hardeep Singh Nijjar of the Khalistan Tiger Force was killed in British Columbia in June 2023, and the United States, where an alleged plot to assassinate Sikh activist Gurpatwant Singh Pannun was exposed. The geographic breadth of targets, from Karachi to Lahore to British Columbia, suggests that the target list is defined not by geographic theater but by organizational threat to Indian security as assessed by Indian intelligence agencies.

The master campaign overview, viewed across all four organizational categories, reveals a coherent strategic architecture. The campaign can be divided into four phases by tempo and scope: the initiation phase from June 2021 through mid-2022, which established the operational model with approximately four to six confirmed cases; the acceleration phase of 2023, which expanded the target set to include all four organizational categories and produced approximately seven to ten confirmed cases; the international exposure phase of 2024, during which The Guardian’s investigation brought global attention while the pace held steady; and the post-Sindoor surge from May 2025 onward, which produced more confirmed cases in twelve months than the preceding three years combined. Each phase expanded the campaign’s geographic reach, organizational scope, and target seniority, following a trajectory that moved from low-ranking operatives in single cities to co-founders and masterminds across the full breadth of Pakistani territory. The progressive escalation is itself a form of communication: each phase demonstrated a capability the previous phase had not, and each new capability became a permanent addition to the campaign’s operational repertoire.

The Intelligence Architecture Behind the Campaign

The modus operandi that defines every operation in the campaign reveals an intelligence architecture of considerable sophistication. The consistency of the method, two to three assailants arriving on a motorcycle, firing at close range with pistols, escaping through congested streets, is not a coincidence but a signature. The method works because it exploits the structural characteristics of Pakistani urban environments: narrow lanes that prevent vehicular pursuit, dense traffic that absorbs fleeing motorcycles, and crowded neighborhoods where unfamiliar faces do not attract attention. The motorcycle is the perfect operational vehicle for Pakistan’s cities: it is ubiquitous (Pakistan has over twenty million registered motorcycles), it requires no license plate visibility at speed, it can navigate alleys too narrow for cars, and it allows both the shooter and the driver to wear helmets that conceal their faces without arousing suspicion.

The mosque pattern deserves particular analytical attention because it reveals the deepest level of intelligence preparation. Multiple targets, including Shahid Latif in Sialkot, Abu Qasim in Rawalakot, Ibrahim Mistry in his local mosque, and Imtiaz Alam, were killed during or immediately after prayers. Mosque attendance is the single most predictable daily routine for observant Muslim men in Pakistan: it happens five times per day at fixed times, and the most senior figures typically attend the same mosque for every prayer. Pre-dawn Fajr prayers, which occur in the darkness before sunrise, are operationally attractive because the low light reduces witness visibility and aids escape. The attackers exploit the one daily routine that is both perfectly predictable and socially undisruptable, because no target will stop attending prayers to avoid assassination, and no security detail will prevent a man from entering a mosque. The mosque pattern suggests that the targeting process begins with identifying which mosque a target attends, establishing the prayer schedule, mapping the physical layout of the mosque compound, identifying entry and exit points, and rehearsing the approach and escape route over multiple prayer cycles. Ronen Bergman, the Israeli journalist who documented Mossad’s targeted killing program in “Rise and Kill First,” described an identical pattern in Mossad operations against Palestinian targets: the intelligence cycle begins with habit mapping and ends with exploitation of the single most predictable moment in the target’s day.

The target selection reveals a level of intelligence preparation that goes far beyond identifying names on a list. The attackers consistently demonstrate knowledge of their targets’ daily routines: when they leave for mosque prayers, which route they take on their evening walk, where their furniture shop is located, which entrance they use. This specificity implies weeks of physical surveillance by locally embedded assets, the kind of sustained observation that requires safe houses, cover identities, and the ability to blend into neighborhoods where the targets live. Christine Fair, the Georgetown University scholar who has written extensively on Pakistan’s strategic culture and the organizational dynamics of groups like LeT and JeM, has argued that Pakistan’s use of these organizations as instruments of state policy created the very vulnerability the shadow war now exploits: because these organizations operate openly under state protection, their leaders’ locations and routines are not secret. They attend mosque prayers at predictable times. They live at known addresses. They run businesses and charitable fronts with public-facing operations. The very openness that state protection enabled now makes them targetable.

The financial architecture described by Pakistani investigators points to a distributed network rather than a centralized command structure. Payments flow from handlers in the UAE through informal channels to local operatives in Pakistan. The amounts are modest by intelligence standards: 1.5 million Pakistani rupees, roughly four thousand British pounds, was reportedly the initial payment to the young Pakistani who tracked Shahid Latif. The use of Afghan nationals, Pakistani criminals, and financially desperate individuals as the operational layer insulates the handlers from direct exposure and creates a system in which each element, the handler, the tracker, the shooter, the escape facilitator, can be recruited, used, and discarded without compromising the larger network. Pakistani investigators told The Guardian that millions of rupees were paid to Afghan nationals to carry out one shooting in Karachi in March 2022, and that those operatives fled over the border after the killing while their handlers were later arrested by Pakistani security agencies. The arrest of lower-level operatives, which Pakistan has accomplished in several cases, does not appear to have compromised the network’s capacity to continue operations, which suggests that the compartmentalization is effective enough that the arrest of a shooter does not expose the handler, and the arrest of a handler does not expose the strategic direction.

The campaign’s geographic expansion, documented in the full chronological record of every confirmed case, traces a systematic penetration of Pakistani territory that mirrors the progressive geographic testing observed in other sustained covert campaigns. The earliest confirmed killings occurred in Karachi, Pakistan’s largest city and its commercial capital, where the density and anonymity of the urban environment provide the most permissive operational conditions. Karachi’s population of over sixteen million, its ethnic diversity, its high background rate of gun violence, and its sprawling informal settlements create conditions in which unfamiliar faces do not attract attention and gunshots do not automatically produce police responses. The campaign then expanded to Lahore, Punjab’s provincial capital and Pakistan’s second-largest city, a more challenging environment due to tighter security and greater social cohesion. From Lahore, the geographic expansion reached Rawalpindi, the garrison city adjacent to Islamabad where the Pakistan Army’s General Headquarters is located, a target environment that required either exceptional confidence or exceptional local assets. By 2023, it had reached Sialkot, Nawabshah, and Jhelum. By 2025 and 2026, killings had occurred in Khyber Pakhtunkhwa, the tribal regions, and Pakistan-administered Kashmir. Each new city transformed from a safe haven into a hunting ground, progressively shrinking the territory where designated terrorists could live without fear of the unknown gunmen who had become Pakistan’s most unsettling security phenomenon.

Competing Theories and the Attribution Debate

The central question surrounding the shadow war, whether India’s intelligence apparatus is directing the killings, cannot be answered with certainty from open sources. Three competing theories have been advanced, and evaluating them against the available evidence is the analytical core of any honest assessment.

The first theory, advanced most explicitly by Pakistani officials and supported by The Guardian’s investigation, holds that RAW is directly orchestrating the assassinations through a network of sleeper cells, handlers, and hired operatives. The evidence cited includes arrested suspects’ confessions, financial records showing payments routed through Dubai, communications intercepts, and the consistent targeting of individuals on Indian designation lists. Pakistan’s intelligence apparatus, the ISI, formally accused RAW of involvement in 2024, and individual investigations into specific killings have produced arrests and convictions of lower-level operatives. The ISI Director General reportedly raised concerns about Indian assassinations with CIA Director William Burns as early as 2022, before the U.S. and Canadian allegations emerged. The Washington Post reported that a current Pakistani official stated bluntly that India cannot rise peacefully, framing the assassinations as evidence of a broader Indian strategic disposition toward aggression rather than a specific counter-terrorism response.

Pakistan’s counter-narrative has evolved through four distinct phases that track the campaign’s escalation. In the first phase, from 2021 through early 2022, Pakistan largely ignored or minimized the killings, treating them as isolated criminal incidents unworthy of diplomatic attention. In the second phase, during 2022, individual killings were acknowledged with vague references to hostile intelligence agencies, but Pakistan avoided naming India directly and preferred to handle the matter through intelligence channels rather than public diplomacy. The third phase began in January 2024, when Foreign Secretary Qazi held a press conference formally accusing India and claiming credible evidence, a diplomatic escalation that brought the allegations into the public domain for the first time. The fourth phase, from April 2024 onward, saw Pakistan attempt to internationalize the issue by calling the killings a global phenomenon requiring coordinated international response. Each phase tracked Pakistan’s diminishing ability to pretend the killings were not happening, and each shift occurred only after the evidence became too voluminous to ignore. The reactive nature of Pakistan’s counter-narrative is itself analytically revealing: a country that was genuinely orchestrating the killings through internal proxies would have no reason to evolve its public position, because it would control the narrative from the start.

The second theory, advanced as Pakistan’s alternative narrative, attributes the killings to internal Pakistani rivalries: factional disputes within terror organizations, personal vendettas, criminal score-settling, and Tehrik-i-Taliban Pakistan (TTP) operations against rival groups. This theory has the advantage of not requiring foreign intelligence involvement, and it is true that Pakistan’s security environment produces significant internal violence. Between TTP insurgent attacks, Baloch separatist operations, sectarian killings, and criminal violence, Pakistan experiences thousands of shooting deaths annually. Some of the killings attributed to the shadow war may genuinely be unrelated to Indian operations.

The third theory occupies a middle ground: that India provides targeting intelligence, perhaps identifies the location and routine of a designated terrorist, but that the actual killing is outsourced to local criminal networks or third-party contractors who operate with significant autonomy. This theory is consistent with the Guardian’s reporting on UAE-based intermediaries and locally recruited shooters, and it explains the occasional operational inconsistencies, including the outlier case of Khwaja Shahid, a former LeT operative linked to the 2018 Sunjuwan Army camp attack, who was found beheaded in Pakistan-administered Kashmir rather than shot in the standard motorcycle-borne pattern. The beheading method is anomalous for the campaign’s signature methodology and may represent either a different operational unit with different methods, a locally improvised execution by contractors who deviated from instructions, or a genuinely unrelated killing that has been folded into the campaign narrative by analysts seeking a comprehensive explanation.

The analytical challenge is distinguishing the signal from the noise. The position that this analysis defends is that the pattern is too consistent, too target-specific, and too organizationally coherent to be coincidental, while acknowledging that certainty is not possible without official confirmation that will likely never come. Consider the specifics: every confirmed target appears on Indian government designation lists or is affiliated with organizations that have conducted attacks on Indian soil. No target has been a Pakistani civilian with no connection to anti-India militancy. The modus operandi is consistent across cities separated by hundreds of kilometers. No group has ever claimed responsibility, which is anomalous for internal factional violence, where credit-claiming is a standard practice. And the timing of the campaign’s initiation, in the aftermath of the Pulwama attack and the Balakot airstrike, aligns precisely with what Indian intelligence officials told The Guardian about a post-2019 shift to an offensive posture.

Abdul Sayed, a Sweden-based researcher on Pakistani armed groups, has tracked the campaign closely and identified the June 2021 Lahore car bomb as the foreshadowing event. He told Al Jazeera that Pakistani authorities attributed the car bomb to Indian intelligence and that subsequently there was an escalation in attacks from early 2022 onward targeting key commanders of various former Kashmiri armed groups. Sayed’s analysis is significant because it comes from an independent researcher rather than from either government, and it corroborates the chronological framework that both Pakistani officials and Indian intelligence officers have described from their respective positions.

The evidentiary gap between pattern evidence and legal proof is the space within which the campaign operates. No Indian court has tried a case related to the killings. No international tribunal has reviewed the evidence. No United Nations investigation has been launched. Pakistan has presented its evidence at press conferences rather than in international legal forums, suggesting either that the evidence is insufficient for legal proceedings or that Pakistan calculates that a legal challenge would expose uncomfortable facts about the targets’ identities and activities. India has not been forced to defend its actions because no institution with jurisdiction has demanded a defense. The shadow war exists in a twilight zone between acknowledgment and denial, where the evidence is strong enough for analytical assessment but insufficient for judicial determination, and where neither side has incentive to seek clarity.

The Shadow War and the Open War: Two Arms of One Doctrine

The relationship between the covert campaign and India’s conventional military responses is the most analytically productive lens through which to understand the shadow war’s strategic logic. The two are not parallel tracks. They are sequential phases of an escalating doctrinal commitment to the principle that Pakistan’s tolerance of anti-India terrorism will be met with consequences that are progressively harder to ignore.

The doctrinal escalation follows a recognizable arc that can be mapped across five distinct phases, each representing a new capability threshold that India crossed and then incorporated permanently into its strategic repertoire. The first phase was strategic restraint, the default Indian posture from 1999 through 2016. After the IC-814 hijacking, the Parliament attack, and the Mumbai siege, India absorbed devastating provocations without military response. This was not cowardice; it reflected a genuine strategic calculation that the costs of military escalation under the nuclear umbrella outweighed the benefits of punishment. The problem with restraint as strategy is that it teaches the adversary the wrong lesson: Pakistan’s military establishment, as Fair documented in “Fighting to the End,” interpreted each episode of Indian restraint as confirmation that proxy warfare could continue without consequence. The restraint era produced seventeen years of relative impunity for Pakistan-based terrorist organizations.

The second phase was the September 2016 surgical strikes. After the Uri Army camp attack that killed nineteen Indian soldiers, India responded with ground-based special forces operations across the Line of Control, destroying forward operating bases used by militant groups in Pakistan-administered Kashmir. The strikes were limited to a few kilometers inside the LoC and used special forces rather than air power. They crossed one threshold, ground incursion into Pakistani-controlled territory, while staying within geographic and methodological bounds that Pakistan could absorb without escalating. India’s DGMO publicly announced the strikes, a departure from the covert tradition, and the public acknowledgment itself became part of the deterrent message.

The third phase was the February 2019 Balakot airstrike. After the Pulwama attack that killed forty CRPF personnel, India escalated to airstrikes, sending Mirage 2000 jets across the international border to strike what it described as a JeM training camp near Balakot in Khyber Pakhtunkhwa. The Balakot strike crossed two thresholds that the surgical strikes had not: it used air power rather than ground forces, and it struck inside Pakistan proper rather than in the contested territory of Pakistan-administered Kashmir. Pakistan retaliated the following day, and the resulting aerial engagement, in which both sides lost aircraft, demonstrated that escalation could be managed but was not risk-free.

The fourth phase is the shadow war itself, which began in 2021. Where the surgical strikes and Balakot were single, time-bound responses to specific attacks, the covert campaign is continuous and indefinite. It does not respond to a single provocation; it addresses the structural condition, Pakistan’s sanctuary infrastructure, that produces the provocations. The surgical strikes sent a message that India could cross the LoC. Balakot sent a message that India could cross the international border. The shadow war sends a message that India can reach into the daily lives of specific individuals inside Pakistani cities, persistently and repeatedly, for years. Each threshold, once crossed, became permanent: India did not revert to restraint after the surgical strikes, did not abandon air capability after Balakot, and has not suspended covert operations after the campaign became public knowledge.

The fifth phase is Operation Sindoor, launched in May 2025, which represents the convergence of the covert and the conventional. For the first time, India simultaneously maintained the covert assassination campaign and launched a major conventional military operation against the same set of organizations. The missiles that struck JeM’s Bahawalpur headquarters targeted the institutional infrastructure that produced the individuals the shadow war was picking off one by one. The two campaigns reinforced each other: the shadow war degraded organizational leadership from below, while Operation Sindoor degraded organizational infrastructure from above. The combination, sustained covert attrition plus periodic conventional devastation, constitutes a doctrine that no single approach could achieve alone.

What makes this five-phase escalation analytically significant is its irreversibility. Each capability, once demonstrated, remains in India’s repertoire. The shadow war did not replace the surgical strike option; it added to it. Operation Sindoor did not replace the shadow war; it supplemented it. India now possesses the demonstrated capacity for special forces incursion across the LoC, air-delivered precision strikes inside Pakistan, sustained covert assassination of designated targets across Pakistani cities, and large-scale conventional missile and air operations against organizational headquarters deep inside Pakistani territory. No previous Indian government possessed all four capabilities simultaneously, and the cumulative effect is a deterrent architecture that operates across the full spectrum from covert to conventional.

This doctrinal synthesis is what news outlets structurally cannot articulate. NDTV and India Today can report individual killings. Wikipedia can list them. Al Jazeera can investigate the allegations. But none of these outlets can argue that the pattern constitutes a deliberate, evolving doctrine that treats Pakistan’s sovereign territory as an operational theater for counter-terrorism, because their editorial standards require neutrality, balance, and attribution to named sources. The thesis is the analytical contribution that no neutral observer can make, and it is the reason this analysis exists.

What the Pattern Reveals About Twenty-First Century Counter-Terrorism

India’s shadow war invites comparison with the two most prominent historical precedents for state-sponsored targeted killing campaigns: Israel’s Operation Wrath of God, launched after the 1972 Munich Olympics massacre, and the United States’ post-September 11 drone campaign against al-Qaeda and affiliated groups in Pakistan, Yemen, and Somalia.

The Israeli comparison is the one Indian intelligence officials themselves invoke. Mossad’s campaign to hunt and kill the Palestinian operatives responsible for the Munich massacre established the template for state-sponsored revenge and deterrence through targeted killing. India’s campaign shares key operational characteristics with the Mossad model: the use of locally recruited assets, the emphasis on close-range killing rather than standoff weapons, the absence of official acknowledgment, and the willingness to operate inside a hostile state’s sovereign territory for years.

The differences are equally instructive. Mossad’s Wrath of God campaign produced at least one catastrophic failure, the 1973 Lillehammer affair in Norway, where agents mistakenly killed an innocent Moroccan waiter. The campaign was ultimately abandoned, not because it succeeded in eliminating all targets but because its operational tempo could not be sustained and its political costs accumulated. India’s campaign has, as of this analysis, produced no confirmed case of mistaken identity, a fact that may reflect either superior intelligence or narrower target selection. The American drone model, by contrast, relies on standoff weapons, precision munitions, and overhead surveillance rather than human assets and close-range engagement. India’s shadow war is closer to the Israeli model in its reliance on human intelligence and physical proximity but operates at a scale, geographic scope, and duration that exceeds anything Mossad sustained during Wrath of God.

What the shadow war reveals about the trajectory of twenty-first century counter-terrorism is that states confronting persistent transnational threats are increasingly willing to operate inside the sovereign territory of states that shelter those threats, without waiting for permission, without seeking authorization from international bodies, and without publicly acknowledging their actions. The Israeli precedent established the principle. The American drone campaign normalized it. India’s shadow war is extending it into a new context: two nuclear-armed states, one of which is conducting sustained covert operations inside the other’s borders while maintaining diplomatic relations, trade links, and a permanent ceasefire on their shared frontier. The nuclear dimension gives the Indian campaign a character that neither the Israeli nor the American precedent possesses. The shadow war is being waged beneath a nuclear umbrella, and its escalatory dynamics are constrained, but also potentially amplified, by the presence of nuclear weapons on both sides.

The shadow war also reveals something about Pakistan’s strategic position that Islamabad has been reluctant to acknowledge publicly. For four decades, Pakistan maintained the fiction that militant organizations operating from its soil were independent actors over whom the state exercised limited control. The shadow war has exposed this fiction by demonstrating that these organizations’ leaders live at known addresses, attend mosques at predictable times, operate businesses under thin aliases, and move through Pakistani cities with a freedom that suggests they do not fear their host state. The campaign has forced Pakistan into an impossible position: if it acknowledges the killings and their attribution to India, it must also acknowledge that Indian intelligence has penetrated Pakistani territory so thoroughly that it can execute targeted killings at will, a humiliating admission of security failure. If it denies the killings’ significance or attributes them to internal violence, it abandons its own citizens, however unsavory, to foreign assassination, an admission of sovereignty failure. Pakistan has oscillated between these positions, and neither has proven politically sustainable.

The nuclear dimension adds a layer of complexity that has no historical parallel. The shadow war is the first sustained covert campaign conducted by one nuclear-armed state inside the territory of another nuclear-armed state. Israel’s Mossad campaigns were conducted against non-nuclear adversaries. The American drone campaign in Pakistan operated with varying degrees of Pakistani consent, under the framework of the broader war on terror, and against non-state actors that Pakistan itself was nominally fighting. India’s shadow war operates without Pakistani consent, against individuals Pakistan has protected, and in a bilateral context where nuclear weapons are the ultimate constraint on escalation. India’s Chief of Defence Staff, General Anil Chauhan, speaking in August 2025 about the lessons of Operation Sindoor, articulated the framework that governs this calculation: India’s no-first-use nuclear doctrine creates space for conventional and sub-conventional operations because it places the burden of nuclear escalation on Pakistan. If India limits its actions to counter-terrorism and does not seek to capture territory or destroy Pakistani state institutions, the nuclear threshold remains distant. The shadow war operates well below any conceivable nuclear threshold, which is precisely why it is sustainable in a way that conventional military operations are not.

The question of whether the shadow war can permanently degrade the organizations it targets, or merely prune them back temporarily, is the campaign’s central unresolved strategic challenge. LeT’s recruitment infrastructure, sustained by thousands of madrassas, charitable fronts, and community organizations across Pakistan, produces new cadres faster than the shadow war can eliminate existing commanders. Arif Jamal, author of “Shadow War,” has documented how LeT’s madrassa-to-militant pipeline generates thousands of radicalized young men annually, a flow that the elimination of individual leaders cannot stanch. The campaign may be degrading operational capability, reducing the quality of planning and coordination, and imposing behavioral costs that constrain organizational effectiveness, but it is not addressing the structural drivers of recruitment: poverty, ideological radicalization, and state patronage. This is the limitation that the campaign’s architects may understand but cannot resolve through covert action alone.

Vipin Narang, whose scholarship on nuclear deterrence and South Asian security has shaped the analytical framework through which strategists understand the India-Pakistan dynamic, has argued that the combination of sub-conventional warfare (the shadow war) and limited conventional action (Operation Sindoor) represents a new model of deterrence under nuclear conditions, one in which the nuclear-armed state that sponsors terrorism discovers that its nuclear arsenal cannot protect its proxies from attrition. If Narang’s framework holds, the shadow war’s significance extends beyond the India-Pakistan bilateral relationship to offer a template for how nuclear-armed states may address sub-conventional threats from nuclear-armed adversaries in the future, a prospect that should concern every nuclear power that relies on proxies as instruments of statecraft.

Praveen Swami, one of the most closely read counter-terrorism analysts covering the India-Pakistan dynamic, has traced the operational pattern across dozens of cases and identified the consistency that separates the signal from the noise: the exclusive targeting of India-designated individuals, the absence of claims of responsibility, the motorcycle-borne method, and the geographic pattern of expanding penetration. Swami’s analytical framework treats the pattern evidence as the primary data and the competing theories as hypotheses to be tested against that data, an approach this analysis endorses. His observation that the campaign’s targeting is too specific and too consistent to be explained by random violence or internal feuds addresses the most common alternative explanation and finds it wanting.

The campaign’s impact on organizational behavior is itself evidence of its effectiveness, and this behavioral dimension deserves attention that news coverage rarely provides. Reports from Pakistani media and intelligence analysts indicate that senior figures in LeT and JeM have significantly altered their daily routines since the campaign accelerated. Leaders who once attended public events, led prayers in mosques, and moved freely through cities have retreated into guarded compounds, reduced their public appearances, changed residences multiple times, and restricted their communications. Syed Salahuddin, the Hizbul Mujahideen supreme commander in Rawalpindi, reportedly increased his personal security detail and curtailed public-facing activities. Hafiz Saeed’s custody in a Pakistani prison, while ostensibly a legal matter, also serves as an incidental form of protection: a prisoner is harder to reach than a free man walking to mosque. The behavioral adaptation that these surviving leaders have adopted imposes its own cost on their organizations. A commander who cannot meet subordinates, cannot inspect training camps, cannot address rallies, and cannot conduct operational planning in person is a commander whose organizational effectiveness is degraded by the act of staying alive. The shadow war does not need to kill every leader to achieve its strategic objective; it needs to make every surviving leader too constrained to lead effectively.

The geographic dimension of the campaign reveals a strategic logic that closely mirrors the organizations’ own geographic footprint across Pakistani territory. LeT’s presence spans Pakistan, from its Muridke headquarters near Lahore through its charitable network in Punjab to its operational cells in Sindh, Khyber Pakhtunkhwa, and Pakistan-administered Kashmir. The campaign has reached into every region where LeT operates. JeM is concentrated in Punjab, particularly around Bahawalpur and Sialkot, and the campaign has struck in both areas. Hizbul operates primarily from Rawalpindi and Pakistan-administered Kashmir, and the campaign has reached both locations. This geographic congruence between organizational presence and sustained campaign reach suggests that the targeting process is informed by detailed knowledge of each organization’s territorial structure, the kind of detailed, sustained knowledge that would require either sustained intelligence collection over years or access to defectors and informants within the organizations themselves.

The shadow war is not finished. The target list is not exhausted. The organizational hierarchies of LeT, JeM, and Hizbul Mujahideen retain senior figures who have not yet been reached. Hafiz Saeed remains in Pakistani custody. Masood Azhar survived Operation Sindoor’s strikes on his Bahawalpur headquarters. Syed Salahuddin continues to direct Hizbul Mujahideen operations from Rawalpindi. The campaign’s logic suggests that these individuals, the founders and supreme commanders, represent the campaign’s ultimate objectives, the targets whose elimination would signal the shadow war’s completion. Whether the campaign possesses the capability and the political will to reach them remains the central open question. What is no longer in question is that the campaign exists, that it is systematic rather than random, and that it has fundamentally altered the security calculus for anyone on India’s most-wanted list who believed that Pakistani soil guaranteed safety.

The shadow war is the answer to a question India spent twenty-six years asking: what do you do when the state that shelters the terrorists who attack you refuses to act, refuses to extradite, refuses to dismantle the organizations, and refuses to stop the pipeline of violence? For twenty-six years, from the IC-814 hijacking on the Kandahar tarmac in December 1999 to the Baisaran Valley in Pahalgam in April 2025, India tried diplomacy, tried restraint, tried international pressure, tried surgical strikes, tried airstrikes, and tried patience. The shadow war is what came after patience ran out.

Whether the campaign represents a strategic success or a dangerous escalation depends on a question that cannot yet be answered: does sustained attrition of mid-level and senior commanders degrade organizational capacity faster than the organizations can recruit replacements? The historical evidence from comparable campaigns offers ambiguous guidance. Mossad’s Wrath of God campaign against Black September operatives in the 1970s degraded the organization but did not end Palestinian terrorism. The American drone campaign in Pakistan’s tribal areas between 2004 and 2018 killed numerous al-Qaeda and Taliban commanders but was followed by the Taliban’s return to power in Afghanistan in 2021. Israel’s sustained campaign against Hamas leadership in Gaza produced tactical victories but did not prevent the October 7, 2023, attack. In each case, the targeted killing campaign imposed costs and disrupted operational capability, but the structural drivers of the conflict, territory, ideology, state sponsorship, and grievance, persisted beyond the reach of any assassination program. India’s shadow war operates under the same structural limitation: it can degrade organizations but cannot address the conditions that produce them. The campaign’s architects may well understand this, and may have concluded that permanent attrition, even without strategic resolution, is preferable to the alternative, which is the return to restraint that produced seventeen years of escalating provocation from 1999 to 2016.

Frequently Asked Questions

Q: What is India’s shadow war against terrorism?

India’s shadow war refers to a sustained campaign of targeted killings of India’s most-wanted terrorists on Pakistani soil, conducted by unidentified assailants since mid-2021. The targets are individuals designated under India’s Unlawful Activities (Prevention) Act or listed on Indian most-wanted registers, affiliated with organizations like Lashkar-e-Taiba, Jaish-e-Mohammed, Hizbul Mujahideen, and the Khalistan Commando Force. The killings follow a consistent pattern involving motorcycle-borne gunmen, close-range fire, and rapid escape through urban neighborhoods. No group has claimed responsibility for any confirmed killing, and no Indian official has acknowledged the campaign’s existence. Pakistani officials and international investigators have attributed the killings to India’s Research and Analysis Wing.

Q: Why are India’s most-wanted terrorists dying in Pakistan?

Terrorists designated by India are being killed in Pakistan because they live there under varying degrees of state protection and organizational support. Pakistani cities like Karachi, Lahore, Rawalpindi, and Sialkot have functioned as safe havens for individuals wanted by Indian authorities for decades. The shadow war has transformed these cities into active theaters of covert operations. The Guardian’s 2024 investigation reported that Indian intelligence established sleeper cells in the UAE that recruited local Pakistanis and Afghan nationals to carry out the assassinations, exploiting Pakistan’s porous security environment and the targets’ relatively predictable daily routines.

Q: When did India’s shadow war begin?

The campaign’s initiation phase spans June 2021 through mid-2022. The foundational event was the June 23, 2021, car bombing near Hafiz Saeed’s residence in Lahore’s Johar Town, which Pakistan’s National Security Advisor attributed to RAW. The first confirmed shooting-style killing attributed to the pattern was Saleem Rehmani’s death in January 2022. The killing of IC-814 hijacker Zahoor Mistry in Karachi on March 1, 2022, confirmed the pattern. By mid-2022, the campaign’s existence was analytically evident, though public recognition came later.

Q: What did PM Modi mean by ghar mein ghus ke maarta hai?

The Hindi phrase translates roughly to enters their homes and strikes them there. Modi used variations of this language at political rallies, most prominently in the period following the Guardian’s April 2024 investigation. Pakistani officials and Indian media interpreted the statement as a tacit acknowledgment that India was conducting operations on foreign soil against designated terrorists. The phrase has since become a shorthand in Indian public discourse for a forward-leaning, offensive counter-terrorism posture. It does not constitute an official confirmation of any specific operation, and the Indian government has not drawn a direct connection between the statement and the killings in Pakistan.

Q: Which terror groups has the shadow war targeted?

The campaign has targeted four primary organizational categories. Lashkar-e-Taiba has lost the most personnel, including regional commanders, senior aides, and co-founder Amir Hamza. Jaish-e-Mohammed targets include IC-814 hijacker Zahoor Mistry and Pathankot mastermind Shahid Latif. Hizbul Mujahideen commanders have been killed in Rawalpindi and Karachi. Khalistan separatist groups were brought into the campaign’s scope with the May 2023 killing of KCF chief Paramjit Singh Panjwar in Lahore.

Q: What is the connection between the shadow war and Operation Sindoor?

The shadow war and Operation Sindoor are two arms of the same strategic doctrine. The shadow war targets individual terrorists through covert assassinations. Operation Sindoor, launched on May 7, 2025, targeted organizational infrastructure through conventional missile strikes. The shadow war degrades leadership from below; Sindoor degraded infrastructure from above. After Sindoor, the pace of covert killings accelerated significantly, suggesting that the degradation of Pakistan’s security apparatus during the conflict created more permissive conditions for covert operations. The convergence of covert and conventional force represents a doctrinal maturation that neither approach could achieve independently.

Q: How has Pakistan responded to the targeted killings?

Pakistan’s response has evolved through four phases. In 2021, the killings were largely ignored or attributed to criminal disputes. In 2022, individual killings were acknowledged with vague references to hostile intelligence agencies. In January 2024, Foreign Secretary Muhammad Syrus Sajjad Qazi formally accused India at a press conference, citing what he described as credible evidence of RAW involvement. After the Guardian investigation in April 2024, Pakistan’s Foreign Office called the killings a global phenomenon requiring coordinated international response. Throughout, Pakistan has arrested lower-level operatives connected to specific killings but has not publicly demonstrated an ability to prevent future operations.

Q: What evidence links India to the killings in Pakistan?

The evidence is circumstantial but substantial. Pakistani investigators have presented arrested suspects’ confessions identifying RAW handlers, financial records showing payments routed through Dubai and UAE-based intermediaries, WhatsApp communications between operatives and handlers, and passport records of suspects who traveled between Pakistan, the UAE, and other countries. The Guardian’s investigation corroborated this evidence with anonymous interviews from both Indian and Pakistani intelligence officials. Indian intelligence officers told The Guardian that operations required approval from the highest levels of government and were inspired by Israeli and Russian models. India’s Ministry of External Affairs has categorically denied all allegations.

Q: Has any country officially confirmed India’s involvement?

No country has officially confirmed Indian involvement in the killings inside Pakistan. Pakistan has formally alleged Indian involvement, and The Guardian has published investigation-based reporting citing unnamed intelligence officials from both countries. The United States and Canada have made separate allegations regarding Indian operations against Sikh separatists on their territory, but these relate to different targets and different operational contexts. The absence of official international confirmation is consistent with the norm in covert-operations diplomacy, where allied states typically avoid publicly attributing covert actions by partners unless their own interests are directly threatened.

Q: What is the difference between the shadow war and the surgical strikes?

The 2016 surgical strikes were a single, time-bound ground operation by special forces across the Line of Control in response to the Uri Army camp attack. They targeted forward operating bases a few kilometers inside Pakistan-administered Kashmir. The shadow war is a continuous, multi-year covert campaign that targets specific individuals deep inside Pakistan’s cities, hundreds of kilometers from the LoC. The surgical strikes were publicly acknowledged by India’s Director General of Military Operations. The shadow war has never been acknowledged. The surgical strikes were a response to a specific attack; the shadow war addresses the structural condition, the sanctuary infrastructure, that enables attacks to be planned in the first place.

Q: How does India’s shadow war compare to Mossad operations?

Indian intelligence officials cited Mossad and the KGB as operational inspirations, according to The Guardian. The comparison with Mossad’s post-Munich Operation Wrath of God is particularly apt: both campaigns target specific individuals responsible for attacks against the sponsoring state, both use locally recruited assets for close-range killings, and both operate without official acknowledgment. Key differences include scale (India’s campaign has reached more targets), duration (the campaign has been sustained for over four years compared to Wrath of God’s roughly five-year active phase), and the nuclear context (Israel’s operations did not involve two nuclear-armed states).

Q: What will happen to Lashkar-e-Taiba after the leadership losses?

LeT faces a compounding leadership crisis. The campaign has targeted personnel across the organization’s hierarchy, from regional commanders to the founding generation. Co-founder Amir Hamza survived a shooting in April 2026, and multiple senior aides have been killed. However, LeT’s institutional resilience should not be underestimated. The organization maintains an extensive network of madrassas, charitable fronts, and recruitment infrastructure that operates independently of any single leader. The shadow war is degrading LeT’s operational command layer but has not yet dismantled the institutional foundation that the ISI helped build over three decades.

Q: Will the targeted killings stop?

Nothing in the available evidence suggests the campaign has reached its conclusion. The pace accelerated after Operation Sindoor and has not decelerated since. Senior figures including Hafiz Saeed, Masood Azhar, and Syed Salahuddin remain alive. The organizational infrastructure of LeT, JeM, and Hizbul Mujahideen, though degraded, continues to function. As long as Pakistan-based organizations retain the capability to plan and execute attacks on Indian soil, and as long as Indian intelligence retains the operational capability to reach individuals inside Pakistan, the campaign’s strategic logic remains intact.

Q: How many terrorists have been eliminated in Pakistan?

Compilations vary depending on inclusion criteria. Pakistani intelligence officials told Al Jazeera in April 2024 that they suspected India’s involvement in up to twenty killings since 2020. Independent researchers tracking unclaimed militant deaths have documented over thirty incidents through mid-2026 that match the campaign’s operational pattern. The discrepancy reflects the analytical challenge of distinguishing shadow-war killings from the background rate of violence in Pakistan, where TTP operations, sectarian killings, and criminal violence also produce shooting deaths. The conservative estimate, limited to cases where the target appears on Indian designation lists and the method matches the established pattern, is approximately twenty-five to thirty-five confirmed operations.

Q: Why does no group claim responsibility for the killings?

The absence of claims is itself the most significant operational signature. In Pakistan’s security environment, terrorist organizations and criminal groups routinely claim responsibility for attacks to build reputation, intimidate rivals, and recruit members. The consistent absence of claims across every confirmed shadow-war killing, sustained over four years and more than thirty incidents, is anomalous for internal violence and strongly suggests state-level coordination. A state intelligence agency conducting deniable operations has every incentive to avoid claims: plausible deniability is the operational framework. Criminal gangs and factional rivals, by contrast, typically want their attacks known.

Q: In which Pakistani cities have targeted killings occurred?

Confirmed killings have occurred in Karachi (the highest concentration), Lahore, Rawalpindi, Sialkot (Daska), Nawabshah, Jhelum, Landi Kotal in Khyber Pakhtunkhwa, and Rawalakot in Pakistan-administered Kashmir. The geographic spread, documented in the complete campaign timeline, has expanded progressively from Karachi’s commercial districts to include provincial capitals, garrison cities, tribal areas, and territory across the Line of Control. Each new city in the pattern represented a geographic threshold, demonstrating that the operational capability was not limited to any single region.

Q: What weapons do the unknown gunmen use?

Open-source reporting from Pakistani police and media describes the standard weapon as a pistol or small-caliber firearm used at close range, typically within a few meters of the target. The attackers do not use rifles, explosive devices, or standoff weapons. Close-range pistol fire is consistent with a methodology that prioritizes certainty of kill, minimal collateral damage, and rapid concealment of the weapon during escape. The choice of weapon also reduces the logistical footprint: pistols are easier to procure, transport, and dispose of than rifles or explosives.

Q: Could the killings be the work of TTP or internal Pakistani rivalries?

Some killings attributed to the shadow war may indeed be the result of internal Pakistani violence, and honest analysis requires acknowledging this possibility. Tehrik-i-Taliban Pakistan, Baloch separatist groups, and criminal organizations produce significant violence across Pakistan. However, the TTP theory fails a basic test: TTP targets Pakistani security forces, government officials, and Shia communities, not India-designated Kashmiri militants affiliated with LeT and JeM. TTP has no documented history of targeting LeT or JeM personnel. The internal-rivalry theory similarly fails to explain why every confirmed target appears on Indian designation lists, why the modus operandi is consistent across organizations and cities, and why no perpetrator has ever been identified as affiliated with a Pakistani faction.

Q: How long does surveillance take before a targeted killing?

The intelligence preparation required for each operation can be estimated from the specificity of the operational detail observed in confirmed cases. The attackers knew Zahoor Mistry ran a furniture shop in Akhtar Colony. They knew Shahid Latif attended Fajr prayers at the Noor Madina Mosque in Daska. They knew Ziaur Rahman’s evening walk route in Karachi. Establishing this level of routine knowledge, confirming the target’s identity, mapping escape routes, and coordinating the operational team requires a minimum of two to four weeks of sustained physical surveillance, based on comparable timelines documented in Mossad operations and U.S. military targeting cycles.

Q: Is the shadow war legal under international law?

The legality of targeted killings on foreign soil is one of the most contested questions in international law. India has neither claimed responsibility for the killings nor offered a legal justification for them. In principle, a state’s right to self-defense under Article 51 of the UN Charter permits the use of force in response to armed attacks, but the International Court of Justice has interpreted this right narrowly when the attacks originate from non-state actors. The U.S. drone campaign established a broader precedent, arguing that states harboring terrorists who pose an imminent threat forfeit certain protections of sovereignty. Israel has invoked similar logic for its operations. India has not made any of these arguments publicly, and the absence of official acknowledgment means the legal question remains unaddressed by the state conducting the operations.

Q: What would force India to stop the campaign?

Three scenarios could plausibly end or suspend the campaign. First, a catastrophic operational failure, such as the killing of an innocent civilian in a case of mistaken identity, could generate sufficient domestic and international backlash to force a pause. Second, a diplomatic breakthrough that produced verified Pakistani action against designated organizations could eliminate the strategic rationale. Third, a nuclear crisis triggered by the combination of covert and conventional escalation could force restraint. None of these scenarios appears imminent. The campaign has avoided confirmed mistakes, Pakistan has shown no inclination toward meaningful action against the designated organizations, and the post-Sindoor ceasefire, while fragile, has held.

Q: What was the Lahore car bomb of June 2021 and why does it matter?

On June 23, 2021, a car bomb containing an estimated thirty kilograms of explosives detonated in the Johar Town area of Lahore, less than two hundred meters from the residence of Hafiz Saeed, co-founder of Lashkar-e-Taiba and the man India and the United States hold responsible for masterminding the 2008 Mumbai attacks. Three people died and more than twenty were wounded. Pakistan’s National Security Advisor Moeed Yusuf formally accused India’s RAW of planning and financing the bombing, identifying the alleged mastermind as an Indian national. The car bomb is analytically significant as the foundational event of the shadow war, a declaration of intent that demonstrated India’s ability to reach the doorstep of Pakistan’s most protected terrorist. The fact that it targeted Saeed’s residence rather than Saeed himself suggests it was a symbolic opening, a signal rather than an assassination attempt.

Q: Who was Zahoor Mistry and why is his killing significant?

Zahoor Mistry was one of the five Jaish-e-Mohammed terrorists who hijacked Indian Airlines flight IC-814 on December 24, 1999, forcing it to Kandahar, Afghanistan, and holding 178 passengers hostage until India released Masood Azhar and two other prisoners. After the hijacking, Mistry disappeared into Pakistan, assumed the false identity of Zahid Akhund, and operated a furniture business called Crescent Furniture in Karachi’s Akhtar Colony for over two decades. He was shot twice in the head at point-blank range by two motorcycle-borne assailants on March 1, 2022. His funeral was attended by JeM’s operational chief Rauf Asghar, brother of Masood Azhar, confirming his organizational connections. Mistry’s killing is significant because it connects the shadow war directly to the IC-814 hijacking, the origin event that India has been reckoning with for twenty-six years.

Q: What is the Resistance Front and how is it connected to the Pahalgam attack?

The Resistance Front, commonly known as TRF, is an organization that Indian intelligence considers a proxy or front group for Lashkar-e-Taiba, designed to provide deniability for LeT operations in Kashmir. India designated TRF under the Unlawful Activities (Prevention) Act in January 2023. TRF initially appeared to claim responsibility for the April 22, 2025, Pahalgam attack that killed twenty-six tourists before subsequently denying involvement. The apparent claim-and-denial sequence is consistent with the proxy model: the claim served LeT’s interests by publicizing the attack, while the denial provided distance from the international condemnation that followed. Indian officials maintain that TRF was created after India revoked Article 370 in August 2019 as a vehicle for LeT to continue operations under a new name that lacked LeT’s accumulated international sanctions and designations.

Q: How did Indian media cover the shadow war?

Indian media coverage has evolved from cautious reporting to near-celebration. In the campaign’s early phases, mainstream Indian outlets reported individual killings with standard caveats about unconfirmed attribution and Pakistani allegations. By late 2024 and into 2025, many Indian pro-government television channels were running programs that marveled at RAW’s extraterritorial reach and efficiency, treating the killings as evidence of Indian capability rather than as allegations to be investigated. Pakistani officials told The Washington Post that they were particularly angered by Indian news reports that emerged almost immediately after some killings, suggesting advance knowledge. The Indian media response has amplified the campaign’s deterrent effect by broadcasting the message that designated terrorists are being reached inside Pakistan, regardless of whether the Indian government officially acknowledges the operations.

Q: What role does the UAE play in the shadow war?

The United Arab Emirates features prominently in Pakistani investigators’ accounts as the primary operational hub for the campaign’s logistics and financial infrastructure. Pakistani investigators allege that RAW established sleeper cells in the UAE, staffed by Pakistani nationals working abroad, who served as intermediaries between RAW handlers and local operatives in Pakistan. The UAE’s role is attributed to several factors: its large Pakistani diaspora provides cover for recruitment, its financial infrastructure facilitates informal hawala transfers, and its geographic position between South Asia and the Gulf makes it a natural transit point. Meetings between RAW handlers and recruited operatives are alleged to have occurred in the UAE, Nepal, the Maldives, and Mauritius, with the UAE serving as the primary coordination center. India has not commented on these allegations, and the UAE government has not publicly addressed its alleged role.

Q: What is the Dhurandhar connection to the shadow war?

Dhurandhar is a Bollywood blockbuster starring Ranveer Singh that depicts a fictional RAW operative conducting covert assassinations of India’s enemies on foreign soil. The film, which became one of the highest-grossing Indian films of its release year, arrived at a moment when real-world events closely paralleled its plot. Indian media began describing actual killings as Dhurandhar-style operations, and the film’s title became a shorthand in public discourse for India’s covert counter-terrorism posture. Prime Minister Modi’s public rhetoric about entering enemies’ homes and striking them there echoed the film’s core premise. The cultural impact of Dhurandhar on public perception of the shadow war is the subject of a dedicated analytical series that examines how the film shaped, reflected, and potentially accelerated public acceptance of covert operations as legitimate instruments of national security.