New Delhi: The National Investigation Agency has filed a chargesheet against nine individuals, including two Pakistan-based operatives, in connection with the November 2025 grenade attack on the women’s police station in Sirsa.
The case, presented before the Special NIA Court in Panchkula, names alleged foreign handlers Shahzad Bhatti and Sohail Ahmad alias Sohail Baloch, along with seven arrested Indian nationals, as part of a coordinated terror module uncovered during the investigation.
According to the chargesheet, the accused Indian operatives include Dheeraj alias Dhiru, Vikas alias Vikky, Sandeep alias Daimar, another accused named Vikas, Sushil alias Sillu, Md. Sijaan alias Ghazi, and Gurjant Singh. They have been booked under provisions of the Unlawful Activities (Prevention) Act, the Bharatiya Nyaya Sanhita, and the Explosive Substances Act.
Investigators have alleged that the attack was orchestrated through a cross-border conspiracy aimed at creating fear by targeting police establishments in India. The agency stated that Pakistan-based gangster-turned-handler Shahzad Bhatti and his associate Sohail Ahmad allegedly used social media platforms and encrypted messaging applications to radicalise and recruit individuals in India.
The probe further suggests that the accused established operational networks within India, with Dheeraj playing a key coordinating role in facilitating communication between local modules and foreign handlers. After conducting reconnaissance of multiple potential targets, the group allegedly selected the Sirsa women’s police station for the grenade attack.
NIA findings also indicate that the accused travelled to Amritsar to procure the explosive device, which was allegedly sourced through Gurjant Singh before being used in the November 25, 2025 attack. Authorities further stated that the incident was recorded on a mobile device, reportedly intended for circulation and propaganda purposes.
Investigators have also claimed that communication between the accused and their foreign handlers continued even after the attack, forming part of a broader network involving recruitment, financing, procurement of explosives, and operational coordination.
The agency has emphasized that its investigation, based on digital, forensic, and documentary evidence, is ongoing, with efforts continuing to trace absconding suspects and identify wider international linkages and financial channels connected to the case.
