The investigation into the terrorist attack near Delhi’s Red Fort in November 2025 is still part of the ongoing legal process being conducted by India’s National Investigation Agency (NIA). However, the United Nations Security Council’s monitoring team has now recorded an important fact about the attack at the international level.
The 38th report of the Security Council’s “Analytical Support and Sanctions Monitoring Team” stated that the attack on Delhi’s Red Fort in November 2025 was “officially attributed to AQIS”, meaning that it was officially attributed to Al-Qaeda in the Indian Subcontinent (AQIS). More importantly, the United Nations has highlighted AQIS not as a weakened and fragmented network, but as a regional terrorist organisation developing in South Asia.
According to the report, the organisation is developing small, decentralised cells, logistical networks and financial mechanisms, and is suspected of using conditions in Bangladesh to expand its network.
The 38th report submitted to the United Nations Security Council analyses terrorist activities and trends between 16 December 2025 and 9 June 2026. The report relates to the monitoring of ISIL (Da’esh), Al-Qaeda and associated individuals, groups, undertakings and entities under the Security Council’s 1267/1989/2253 regime. The report was placed before the Security Council with a letter dated 6 August 2026 and circulated on 10 August 2026 as document number S/2026/651.
The significance of this report for India has increased because it directly links the Delhi Red Fort attack to AQIS, stating:
“The attack on the Red Fort in Delhi in November 2025 was officially attributed to AQIS.”
In other words, the United Nations monitoring team has recorded AQIS’s name in its official analysis in connection with the attack. However, this should not be regarded as a substitute for the final findings of the criminal investigation and judicial process underway in India. The NIA filed a detailed chargesheet in the case in May 2026 and linked the conspiracy behind the attack to the AQIS-affiliated Ansar Ghazwat-ul-Hind (AGuH) network.
The car blast that took place around the Red Fort in November 2025 was among the most serious terrorist incidents in the capital in recent years. A large number of people were caught in the blast after the vehicle exploded. The incident also caused widespread concern because the attack took place in an area of the national capital that is historic, heavily visited by tourists and highly sensitive.
According to facts that emerged during the National Investigation Agency (NIA) investigation, the links of several accused, including the deceased attacker, were connected to the AQIS-affiliated AGuH network. In May 2026, the agency filed a 7,500-page chargesheet naming ten accused. According to the NIA, the investigation extended across Jammu and Kashmir, Haryana, Uttar Pradesh, Maharashtra, Gujarat and Delhi-NCR, and involved the examination of hundreds of witnesses, documents and seized materials. This is where a significant similarity can be seen between the United Nations report and the findings of the Indian investigation. In fact, both regard AQIS and networks associated with it as significant in the context of the attack.
The most serious indication in the United Nations report is not merely its reference to the Red Fort attack. The real concern relates to the changing organisational structure of AQIS. The report states: “AQIS continued to evolve from a fragmented group into a regional terrorist organization, establishing logistical and financial networks and operating through small, dispersed cells rather than larger units.”
This means that AQIS is moving away from operating as a large terrorist group in the traditional sense and towards conducting its activities through small and dispersed cells. Such a structure is challenging for security agencies because targeting a single large organisational structure is comparatively easier, whereas small, autonomous or semi-autonomous cells operating in different locations remain less visible.
The reference in the report to the establishment of logistical and financial networks is also of particular significance. It indicates that the organisation is not confined merely to ideological or propaganda activities, but is also working towards mobilising the resources required to sustain its operational capabilities.
The report makes special mention of Bangladesh in connection with the potential expansion of AQIS in South Asia. According to the report, there are concerns that AQIS could seek to exploit the prevailing circumstances there to establish its cells. This observation is significant in the context of terrorists being apprehended in India and across the Indian subcontinent, as well as the expansion of their organisations, because the activities of terrorist organisations in South Asia are no longer confined to the borders of any one country.
Cross-border contacts, digital propaganda, the transfer of funds and the operation of small cells are reducing the significance of geographical distance for terrorists. The core objective of AQIS itself has been to expand Al-Qaeda’s ideology across the Indian subcontinent. In such circumstances, the potential establishment of networks in Bangladesh is becoming a security challenge for the entire region, including India.
The broader conclusion of the United Nations report is no less serious. According to the monitoring team’s assessment, the global terrorist threat has broadly remained as it was, but the situation in South Asia is a particular cause for concern. The report mentions an increase in cross-border attacks between Pakistan and Afghanistan. Pressure from attacks in Pakistan has increased due to the activities of Tehrik-e-Taliban Pakistan (TTP). According to the report, the terrorist threat emanating from Afghanistan has also remained largely unchanged.
The report states: “The terrorist threat emanating from Afghanistan remained largely unchanged.” It further highlights that several terrorist organisations active in Afghanistan continue to pose a persistent threat to neighbouring countries and Central Asia. TTP also underwent an organisational restructuring following its annual Rahbari Shura. The report mentions new divisions covering Balochistan and the central region, as well as Kashmir and Gilgit, along with a division described as the TTP’s “air force”.
The report also views AQIS in connection with terrorist networks operating in Pakistan’s Khyber Pakhtunkhwa region. In the context of attacks linked to Ittehad-ul-Mujahideen Pakistan (IMP), it mentions a suicide attack near a security post in Bannu. This entire scenario shows that terrorism in South Asia is no longer merely the activity of a single organisation. Ideological, logistical or operational links, as well as competition between different terrorist organisations, exist simultaneously.
The report is not limited to AQIS. It also analyses the activities of Al-Qaeda and ISIL (Da’esh) at the global level. It mentions violent rivalry between JNIM and ISGS in the Sahel region. In Somalia, Al-Shabaab appeared to be moving towards more targeted and strategic operations. In southern Yemen, AQAP took advantage of gaps in the security arrangements to strengthen its capabilities.
According to the report, both Al-Qaeda and ISIL have continued to prioritise kidnapping for ransom as a means of generating financial resources and undermining the credibility of local security forces.
Another concerning aspect of the report relates to the use of Artificial Intelligence and digital technology by terrorist organisations. The report states that terrorist elements are attempting to use publicly available AI tools to make bombs and obtain information about targets. It also mentions the use of AI by ISIL-K to rapidly produce or translate propaganda material into different languages.
This shift points to a new challenge in the nature of terrorism. The internet had already made terrorist propaganda, recruitment and radicalisation easier; AI could further enhance the ability to produce such content rapidly and disseminate it in multiple languages.
The report also highlights the continued interest of Al-Qaeda and ISIL in chemical and biological weapons. However, the report also states that these organisations have so far failed to overcome the technical challenges involved in this field.
In the words of the report: “Al-Qaida and ISIL (Da’esh) continued to express interest in developing chemical and biological weapons, although they have so far failed to overcome the technical challenges involved.”
The report further states that in February, ISIL’s English-language magazine Invade published instructions relating to botulinum toxin and cyanide. Regarding ISIL-K, the report also mentions its particular interest in developing ricin. Referring to the arrest of three people, including a doctor, by Indian authorities towards the end of 2025, it states that they were accused of being tasked by an ISIL faction based abroad with developing ricin.
This fact is significant for India because it indicates that terrorist networks are now looking beyond conventional explosive attacks and are also exploring the possibility of acquiring chemical and biological capabilities. The United Nations report also mentions changes to the sanctions list. Three new names were added and seven names were removed during the reporting period. On 27 February 2026, the Al-Nusrah Front, also known as Hay’at Tahrir al-Sham, was removed from the list.
On the other hand, the death of Abu Bakr ibn Muhammad ibn Ali al-Mainuki has been described as a setback for ISIL. According to the report, this could affect its ability to coordinate and communicate across its global network, but these developments do not alter the United Nations’ fundamental assessment. Terrorist organisations can change their leadership, structure and strategy, but the threat has not disappeared.
The United Nations’ comments in the context of the Red Fort attack are significant for India at several levels. First, AQIS has now been officially named in the United Nations’ terrorism-monitoring framework’s analysis in connection with the Delhi attack. Second, the report does not view AQIS merely as a fragmented organisation, but identifies it as evolving into a regional terrorist organisation. Third, the development of small cells, financial networks and logistical capabilities has been identified as an indication of the changing nature of terrorism in South Asia.
For Indian investigative agencies, this international assessment undoubtedly provides an important point of reference. The report once again leads to the conclusion that although the structure of terrorist organisations may be becoming smaller, more fragmented and digital, their ambitions remain regional. The changing nature of AQIS, its potential expansion in Bangladesh, tensions in the Pakistan-Afghanistan region, and terrorists’ interest in AI and chemical and biological technologies are clear warnings of the next challenges facing the security of South Asia.
The aforementioned 38th United Nations report is a serious security document on the changing face of terrorism in the Indian subcontinent (South Asia), and its most important message for India is that the threat posed by AQIS can no longer be viewed merely as that of an old and weakened terrorist network, because it now appears to be expanding in small groups at different locations across India, with Islamist extremists and jihadists continuing to be apprehended by investigative agencies, security groups and agencies.
