Flash Report: India-Pakistan Tensions Likely to Escalate

Key Findings

• A military escalation between India and Pakistan is likely in the coming weeks after gunmen likely affiliated with a Pakistani-based terror group targeted a tourism hotspot in Kashmir.
• Indian Prime Minister Narendra Modi has exerted a large amount of political capital since 2019 to ensure the public Kashmir was safe, while also establishing a military precedent that Pakistan can be held responsible for jihadist attacks in the region.
• Hacktivist groups on both sides of the conflict have begun targeting public and private entities in India and Pakistan, while social media users have been sharing incendiary posts that will likely worsen tensions and contribute to public pressure on both governments to take retaliatory actions.

Background

On April 22, 2025, gunmen in the Indian territory of Kashmir killed at least 26 civilians and injured 17 near the tourist hotspot of Pahalgam, outside the capital of Srinagar. The Resistance Front, an offshoot of Pakistani-based Islamist terror group Lashkar-e-Taiba, initially claimed responsibility for the Pahalgam attack but retracted its claim a few days later. While Pakistani-based Islamist groups have targeted India repeatedly over the last 25 years, this is the first major attack since a suicide bomber targeted a military convoy in 2019 in Pulwama, Kashmir, killing dozens. It is also the deadliest attack targeting Indian civilians since the Lashkar-e-Taiba-instigated Mumbai shootings of 2008.

While Hindu-majority India and Muslim-majority Pakistan each control part of Kashmir, both claim it in full and have fought several wars over the region since their mutual independence in 1947. 

• In the last 25 years, there have been a spate of high-profile terror attacks against Indian interests by Pakistan-based jihadist groups that reject India’s presence in Muslim-majority Kashmir.
• India has accused Pakistan of supporting terrorist groups active in the portion controlled by India but has largely refrained from attacking Pakistan in response to jihadist attacks that likely originated from its territory.

That changed in 2019, when Indian jets targeted positions inside Pakistan following the Pulwama attack. 

• At that time, Pakistan responded with its own airstrikes, which marked the first retaliatory airstrikes since 1971. An Indian pilot was briefly captured, and, historically, both sides have managed to negotiate diplomatic off-ramps to avoid further confrontation.
• Indian Prime Minister (PM) Narendra Modi expanded upon this military precedent when his government incorporated Kashmir into the new union territory of Jammu & Kashmir in 2019, asserting greater federal control by controversially revoking the autonomy the region had enjoyed since India’s independence. In addition to revoking Article 370 of the Indian constitution, India positioned thousands of additional troops in the Muslim-majority region and exerted greater control over communications and travel.
• The move has proven popular within India, partly because there has been a significant decrease in attacks, with those that do occur usually targeting security forces and causing significantly less loss of life. It also fits with Modi’s brand of Hindu nationalism, which critics claim is partially characterized by a disregard for Muslim freedoms.  The Pahalgam attack—which occurred despite years of effort to secure the region via a military buildup—is a political setback for PM Modi that will very likely prompt a military response that could destabilize the entire region.

Immediate Response

Tensions between India and Pakistan have escalated since the attack, with India publicly blaming Pakistan and accusing it of complicity. 

• India has closed the Wagah border-crossing with Pakistan and expelled Pakistani diplomats and military advisers; closing the Wagah land transit point effectively halts all land-based trade between India and Pakistan. Pakistan subsequently blocked Afghan trucks from crossing into India. This sudden move has triggered immediate disruptions and is likely to have deeper economic consequences in the medium and long term.

In addition to downgrading diplomatic ties, India has unilaterally suspended the Indus Water Treaty, which governs how upstream water is allocated between the two countries. Pakistan labelled the treaty suspension “an act of water warfare,” since nearly 80 percent of Pakistani agriculture is dependent on the treaty. 

• On April 26, 2025, a flood alert was reportedly declared in Hattian Bala, located in Pakistani Kashmir, after India unblocked a tributary releasing water into the Jhelum River without notice. There is a roughly even chance that India will not share information about future water releases.
• Pakistan has responded by suspending the 1972 Simla Agreement, a peace treaty that ended the 1971 Indo-Pakistani War.

Following the suspension of the Simla Agreement, India announced a total cancellation of all types of visas issued to Pakistani nationals, including business visas and visitor permits. According to the Indian government, nearly all Pakistani nationals on visas exited the country by April 27, 2025. The Indian government has also issued travel advisories urging Indian citizens to avoid all non-essential travel to Pakistan, while tightening monitoring of dual nationals.

• The United States and the United Kingdom issued travel advisories warning its citizens not to travel to Jammu and Kashmir and to stay at least 10 kilometers (6.21 miles) away from the India-Pakistan border due to risks of terrorism and armed conflict.
• Due to Pakistan's closure of its airspace to Indian airlines, Air India announced that some flights to North America, the United Kingdom, Europe, and the Middle East will take longer, alternative routes.

Military Actions

Both India and Pakistan are likely to increase their military preparedness, including readying artillery, naval and aerial resources, and weaponry. Small-scale retaliatory actions have already begun—especially around the Line of Control (LoC), a military control line that passes through Kashmir that is generally understood to be a ceasefire line between the two countries. Though offensive and defensive actions from both countries have been limited to date, shifts toward active retaliation are likely that threaten wider and more violent military escalation. 

• Between April 24 and April 28, Indian and Pakistani forces exchanged fire across the LoC, with Indian authorities reporting that Pakistani forces initiated the attacks and recorded no casualties. On April 26, Indian law enforcement (LE) authorities demolished houses allegedly belonging to several terrorists involved in the attack. Prior to 2019, this type of retaliation, primarily concentrated around the LoC, was common; however, it is unlikely to suffice currently.

The military preparations, small-scale attacks across the LoC, and transportation of resources very likely indicate that the two countries are positioning themselves for potential large-scale hostilities. If the countries engage in an escalated form of fire exchange, it is likely to lead to regional instability, riots, adverse impacts on the economies of both countries, road blockades, and travel restrictions. 

Local and Global Protest Activity 

Widespread demonstrations have erupted in India since the attack. These demonstrations and shutdowns are likely to expand to more disruptive displays of dissatisfaction, like blocking key highways and roads.

• On April 24, the towns of Idar and Vadali in the Indian state of Gujarat observed a shutdown wherein business associations and local communities voluntarily closed shops, urging the government to take decisive counter-terrorism action. On the same day, the city of Palitana in the Bhavnagar district observed a shutdown to pay tribute to the father and son who lost their lives in the attack.
• On April 24 in Assam (another Indian state), widespread protests erupted in which protesters burnt Pakistani flags, held silent marches, and submitted memorandums to the Prime Minister demanding justice and strong action against the perpetrators of the terror attack.
• On April 24, Delhi saw political figures taking to the streets in protest. Bharatiya Janata Party’s Virendraa Sachdeva (Delhi Chief) was removed by police from a protest near the Pakistan High Commission over the attack.
• On April 23, the people of Kargil condemned the attack by observing a peaceful shutdown. Shops and businesses across the district remained closed in support of the victims.
• On April 22, the Kashmir Valley experienced a complete shutdown in protest of the attack, marking the first such closure in 35 years.

Security has been heightened in Delhi and the National Capital Region (NCR), as demonstrations are being planned by religiously motivated groups, and a self-proclaimed leader of Pakistani Kashmir Anwarul Haq threatened “repercussions” against Delhi from Kashmir in a video. A religiously motivated group, Hindu Raksha Dal, has made threats against Kashmiri Muslims and students residing in the northern state of Uttarakhand, asking them to leave the state.

• There is a roughly even chance of demonstrations turning violent and leading to riots in parts of North India—especially in the Indian capital of New Delhi and surrounding areas, given the city’s political importance.
• If violent demonstrations do occur in North India, the sentiment is likely to spread to other parts of India, upsetting law and order in various cities.
• Bomb threats have been made already in some South India states against hotels, with one at Thiruvananthapuram International Airport in the state of Kerala. Investigations have found them to be hoaxes. The spate of hoax emails likely indicates an intent to cause fear and provoke unrest.

India has a recent history of exerting internet blackouts during periods of mass protests or unrest. After Article 370 was revoked, there was an 18-month internet shutdown in Kashmir. The following year, in 2020, India ranked number one for internet shutdowns with 109 different instances, most of which occurred in Kashmir but also occasionally impacted Delhi.

Mis- and Disinformation

ZeroFox Intelligence has observed several incendiary posts about the terror attack circulating on social media platforms, including AI-generated posts, images, fake victim stories, and mis/disinformation, which will likely provoke public outrage, trigger retaliatory violence, and deepen communal divides. The content often features imitations of credible voices, such as witnesses and affected individuals, to exploit the emotional volatility triggered by the incident.

• Several Pakistani accounts on social media and news sites were observed spreading disinformation, accusing India of staging a "false flag" operation. Hashtags like #IndianFalseFlag and #PahalgamDramaExposed have been trending, pushing narratives that the attack was orchestrated by Indian agencies.

• Several AI-generated Images, supposedly from the site of a terror attack in Pahalgam, Kashmir, are circulating online. Pakistan-based accounts have been circulating an edited sketch from the Pahalgam terror attack, falsely altered to resemble cricketer Babar Azam. A video from 2020 of a child crying over his grandfather’s body is being falsely shared as footage from the recent Pahalgam attack. A video circulating on social media falsely portrays an Indian Navy Lieutenant and his wife dancing shortly before the terror attack. The officer’s family has denied the claim, and the couple in the video has clarified that their footage is being misused.
• Pakistani officials have been observed issuing statements against India, labeling the terrorists as “mujahideen” (fighters for a religious cause) and issuing open threats. The Inter-Services Public Relations (ISPR) accounts from Pakistan are reportedly circulating widespread disinformation, claiming that Sikh soldiers in the Indian Army have refused to fight against Pakistan.

Kashmiri students are reportedly facing harassment and targeted attacks in various parts of India following the Pahalgam shootings. These incidents have fueled further tensions and are being exploited by social media users to spread disinformation. Some accounts are amplifying these reports to imply widespread state-sponsored persecution, while others are using them to justify divisive narratives. This manipulation of sensitive events is very likely to provoke outrage and deepen communal divides.

• A student’s union representative intervened when a Kashmiri student was reportedly harassed. The X post about the incident also included the representative’s comments, urging people to stay united against terrorism.
• Several posts on social media are pushing the narrative that Kashmiri students and workers are not safe in India following the Pahalgam attack. This appears to be a deliberate attempt to spread fear, sow division, and create unnecessary panic.

Cyber Landscape

The geopolitical tensions between the two countries are very likely to lead to an increase in hacktivist and state-sponsored cyberattacks. Both Pakistani and Indian hacktivist groups, along with a few other groups that are likely politically aligned with Pakistan, have already conducted attacks soon after the Pahalgam incident.  

• Pro-Pakistan hacktivist group Team Insane PK targeted the Army College of Nursing in Punjab, linking the attack to the Pahalgam terror incident. It has also allied with Akatsuki Cyber Team, stating the alliance is dedicated to “digital security” and “fighting injustice.” The alliance is very likely to target Indian entities in the near future.

• Hacktivist group Sylhet Gang has taken an anti-India stance and claimed to have targeted 15 Indian websites on April 25, stating that it will be “always against Indian actions.”

• Indian hacktivist group Dex404 has claimed to target private and public entities in Pakistan and has threatened to keep conducting more attacks.

• Another Indian hacktivist group, Indian Cyber Force, has targeted several Pakistan entities, including a bank, education institutes, and police networks. The group has further threatened more retaliatory actions against critical infrastructure, warning about a “devastating strike.”

There is a roughly even chance of Pakistan-linked advanced persistent threat group APT36—known for targeting Indian defense sectors and critical infrastructure—targeting sensitive Indian assets given the prevailing geopolitical tensions.

Conclusion

Recent history provides insight into how tensions between India and Pakistan are likely to evolve in the coming weeks. Back in 2019, Indian PM Modi established a military precedent whereby attacks by non-state actors could be attributed to the Pakistani government. However, the scale of the latest round of retaliation will likely be more significant than before. Modi’s effective control of Kashmir since 2019 was intended to put an end to the sort of attacks witnessed last week; his own Hindu nationalist base is likely to demand a heavy-handed response. The previous level is unlikely to suffice, especially since Modi spent so much political capital since 2019 assuring the public the Kashmir issue had been settled.

For its part, Pakistan’s unstable government cannot be seen as weak and will likely come under pressure to respond to any Indian military engagements. Cyber threat actors on both sides of the conflict are very likely to pressure their respective governments as well.

Appendix: ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 PM (EDT) on April 28, 2025; per cyber hygiene best practices, caution is advised when clicking on any third-party links.