India’s most wanted Lashkar-e-Taiba operative Habibullah alias Saifullah Sajid Jatt has been traced to Pakistan’s capital Islamabad, with fresh intelligence and forensic evidence linking him to multiple terror attacks in Jammu and Kashmir, including the recent Pahalgam strike.
Originally from Kasur district in Pakistan’s Punjab province, Habibullah operated in Jammu and Kashmir between 2005 and 2007 under the name Salim Langda alias Saifullah. During this period, he set up a base in Yaripora in Kulgam district and married a local woman. Investigators say he was involved in several targeted killings of non-locals in the region.
Saifullah Sajid Jatt Fled To Pakistan
In 2007, he fled back to Pakistan along with his wife, leaving behind his young son in Kashmir. Back in Pakistan, he reportedly ran a dairy business in Kasur while also training militants at Lashkar facilities multiple times a year. In 2012, he was elevated by top Lashkar commander Zaki-ur-Rehman Lakhvi to oversee operations in Jammu and Kashmir, with responsibilities ranging from training terrorists to coordinating attacks from across the border.
After taking on a leadership role, he adopted new aliases, including Sajid Jatt and Ali Sajid, and began directing a series of attacks in Jammu and Kashmir. One of the earliest major incidents linked to him was the 2013 attack on Indian Army personnel in Hyderpora. He is also accused of targeting political leaders, particularly those associated with the BJP.
Also Read: ABP Exclusive | One Year After Pahalgam Attack: Pakistan-Backed Plot Behind 26 Killings, Part 1
Investigators have linked him to several subsequent attacks, including strikes in Surankote and other areas. His name also figures in the June 9, 2024 Reasi attack, where militants opened fire on a bus carrying Hindu pilgrims, killing nine people.
Link To Pahalgam Attack
In the April 2025 Pahalgam attack, probe agencies found crucial digital evidence connecting him to the operation. According to investigators, the location coordinates of Baisaran Valley were sent via WhatsApp to attacker Bilal Afzal alias Faisal Jatt from a number traced to Habibullah. Screenshots of these coordinates were later recovered from the attacker’s mobile phone and were found saved on a navigation application.
The National Investigation Agency (NIA), which is probing the case, confirmed that the number used to send the coordinates belongs to Habibullah. Two mobile phones recovered from the attackers were traced to delivery locations in Karachi and Lahore, both situated close to Lashkar facilities, suggesting deliberate attempts to conceal their origin.
Following the Pahalgam attack on April 22, responsibility was initially claimed by The Resistance Front (TRF), a proxy of Lashkar-e-Taiba, through a social media account. IP tracking later revealed that the account was being operated from Pakistan’s Khyber Pakhtunkhwa region. Days later, another Telegram account denied Lashkar’s involvement, claiming the earlier account had been hacked.
Investigations have also revealed that the Telegram account was linked to a Pakistani mobile number registered to an Islamabad-based individual. Agencies have accessed a Pakistani identity document issued in 2020, indicating that Habibullah is currently residing in a posh locality of Islamabad.
According to intelligence inputs, his current base is a three-storey building in Soan Garden, Islamabad, allegedly functioning as a Lashkar command centre. He is believed to be operating alongside other wanted terrorists, including Ghulam Abbas alias Samama and Commander Huzaifa Bakkarwal.
The attackers involved in the Pahalgam incident were also identified as Pakistani nationals from Punjab and Pakistan-occupied Kashmir, further strengthening the cross-border link.
NIA Chargesheet In Pahalgam Attack Case
The NIA has filed its first chargesheet in the case and is continuing its probe into the broader terror network. The agency is also examining possible links with other groups such as Jaish-e-Mohammed, Al-Qaeda and Hamas.
Officials say further investigation is underway to uncover additional evidence and establish the full extent of the network behind the attacks, even as questions remain over how long such operatives will continue to function openly from across the border.
