By Roy Denish.
Easter Sunday attackers are traced through Hadiya’s testimony, from Zahran’s rise to safe houses, bombs and Sainthamaruthu.
The Easter Sunday attackers did not fully enter the public record through an intelligence file. Their secret world emerged in the sterile office of a Judicial Medical Officer, where Abdul Cader Fathima Hadiya identified the remains of her husband, Mohamed Hashim Zahran.
There, amid the clinical smell of formaldehyde and the remains of a national catastrophe, Hadiya confirmed what was left of the man investigators later placed at the centre of Sri Lanka’s deadliest terror cell.
She testified that officials recovered his body, including his head, from the Shangri-La Hotel in Colombo. On April 21, 2019, Zahran entered the luxury oceanfront hotel’s restaurant and detonated a backpack packed with military-grade explosives. The blast killed him, along with dozens of tourists and Sri Lankans.
His attack formed part of a carefully coordinated wave of suicide bombings against three churches and three luxury hotels on Easter Sunday. The attacks killed 269 people, left hundreds wounded or mutilated, and shattered Sri Lanka’s fragile post-war peace.
Easter Sunday Attackers And Hadiya’s Testimony
Zahran stood as the ideological anchor and operational mastermind of the National Thowheed Jama’ath, a homegrown extremist cell that pledged allegiance to the Islamic State group.
Investigators tried to understand how a self-taught provincial preacher avoided state intelligence and helped execute one of South Asia’s deadliest terrorist atrocities. However, the most intimate map of the conspiracy sat inside a 196-page transcript.
Hadiya gave that testimony before the Presidential Commission of Inquiry that investigated the attacks. Her account offered a rare view into the internal life of Sri Lanka’s deadliest terror cell.
Her narrative traced a decade-long fall from provincial hardship into safe houses, encrypted foreign communication, bomb-testing accidents, and finally a violent family suicide pact.
The path to the Easter Sunday carnage began in Kaththankudi, the conservative, predominantly Muslim town on Sri Lanka’s eastern coast. Hadiya grew up in Kekunagolla in the Kurunegala District. She met Zahran through traditional channels and married him on Oct. 16, 2009.
At that time, Zahran was a qualified Maulavi, or Islamic scholar. He already had a forceful and charismatic speaking style. In the early years of marriage, Hadiya described a life that looked ordinary from outside. It revolved more around financial strain than open religious militancy.
From Provincial Poverty To Religious Influence
Zahran earned a modest income by conducting religious lectures and managing local mosque work. To support his income and help his parents, he bought a three-wheeler. He used the motorized rickshaw to transport local schoolchildren through the dusty roads of Kaththankudi.
The couple later had two children. They moved between rented homes in Kaththankudi and Ganethenna in Mawanalla as Zahran’s religious profile expanded. Hadiya recalled that he supported his parents financially and remained active in religious work. Her account showed an attentive, though rigid, family man.
Over time, Zahran’s fiery sermons drew a loyal base of young men from several districts. Supporters saw his growing influence and pooled money to buy land and build a mosque dedicated to his movement.
Hadiya testified that foreign money also supported the project. Financial help came from sympathizers in Singapore, she said, and the funds aimed to expand the mosque’s infrastructure and create a permanent base for Zahran’s teachings.
Inside the classroom, the curriculum began to shift. Zahran taught Sharia law and Aqeeda to his followers. At the same time, he slowly folded more intolerant interpretations into those lessons.
Yet, according to Hadiya, the open move toward violent jihadism began after a family reunion.
The Pen Drive That Changed The Cell
The crucial turning point came in 2016. Zahran reconciled with his relative, Naufer Maulavi, after years of estrangement.
Investigators later identified Naufer as a key ideological link between the local cell and global jihadist networks. When he returned to Zahran’s circle, he brought a silver pen drive.
Hadiya told the commission that she saw Zahran watching extremely violent videos from that drive on his laptop. The footage contained Islamic State propaganda, including battlefield executions, decapitations, combat tutorials, and theological arguments for mass killing.
The images disturbed her. She also feared their young son might enter the room and see the screen. As a result, she confronted her husband.
Zahran did not argue with her. He shut the laptop, moved his operations to the local mosque, and promised he would not bring the material into their home again.
However, the radicalization process had already taken hold. The tension between Zahran’s hyper-radicalized faction and Kaththankudi’s traditional Sufi Muslim community exploded on March 10, 2017.
Zahran had secured police permission to hold a public sermon at Aliyar Junction. During that event, he delivered a harsh speech attacking traditional practices. The provocation triggered a street brawl between rival religious factions.
Machetes, clubs, and stones appeared in the violence. Several residents ended up in hospital with severe wounds.
As police prepared to make arrests, Zahran disappeared. Hadiya recalled calling him. He briefly replied that he would call back. When he finally contacted her from an unlisted number, he gave simple instructions. He was leaving Kaththankudi immediately, and he would not reveal where he planned to go.
Hadiya packed her belongings, took their children, and returned to her parents’ home in Kekunagolla. For nearly two years, Zahran lived like a ghost inside a hidden network of safe houses across Sri Lanka.
A Fugitive Network Built Online
During that time, Zahran changed from a rogue local preacher into an operative managing a secretive, high-tech network.
He visited Hadiya only a few times. He arrived at night and kept his whereabouts hidden. Instead of direct contact, he relied heavily on digital communication.
He abandoned normal cellular networks and shifted his command structure to Facebook and the encrypted messaging platform Telegram. Hadiya entered the digital circle when Zahran added her to a restricted Telegram group called Anasar Cilafat.
The group contained about 200 vetted members. Hadiya told the commission that members considered Telegram safer than WhatsApp. She said the group distributed Zahran’s audio sermons, which openly called for the destruction of the secular state.
By then, Zahran’s worldview had hardened into absolute militancy. He told his wife that Sri Lanka had to become an Islamic nation. He also claimed that compulsory conversion under his rigid interpretation of Sharia law was a divine mandate.
Hadiya tried to reason with him. She testified that she preferred a society where Buddhists, Muslims, and Hindus could live together peacefully. Zahran dismissed her objections and refused the idea of coexistence.
Inside the network, order replaced disorder. Every operative admitted into the inner circle had to swear Bay’ah, a formal oath of allegiance, to Abu Bakr al-Baghdadi, then the leader of the Islamic State.
Cell members abandoned their birth names and adopted the prefix Abu to mark their new identities inside the caliphate. Zahran claimed total command and styled himself as the official leader of ISIS in Sri Lanka.
From hidden locations, Zahran ran what Hadiya described as a multinational switchboard. She recalled overhearing conversations and seeing encrypted data transfers involving two mysterious handlers known as Abu Bara and Abu Hind.
Foreign Contacts And Missed Warnings
The cell was also sending money toward conflict zones in Syria. Hadiya remembered discussions with Abu Bara about moving large sums through illicit maritime routes to avoid international banking scrutiny.
At the same time, Zahran maintained near-constant contact with Abu Hind, whom state intelligence identified as an India-based handler. Abu Hind exchanged encrypted voice notes with Zahran and demanded frequent updates.
Those demands included Sinhala-to-Tamil translations of extremist texts and reconnaissance information about possible targets.
As the cell expanded its activity, Sri Lankan law enforcement agencies began to notice fragments of the threat. However, they failed to understand its full scale.
Investigators from the Terrorism Investigation Division followed leads to Hadiya’s family home in Kekunagolla. According to her account, couriers had already relayed strict instructions on what she should tell the state.
When detectives showed her clips of Zahran’s internet sermons and asked for his location, she denied having any contact with him since his disappearance in March 2017. She also promised to inform police if he returned.
By February 2019, pressure on the network intensified. Officers from the elite Criminal Investigation Department began aggressive questioning of Hadiya’s relatives. Zahran sensed that a raid could come soon.
He then bypassed his normal couriers and sent an urgent order. Hadiya and the children had to leave their home immediately and disappear into the underground network.
Hadiya first resisted because she feared dragging her children into life as fugitives. But the network kept pressing. Two main operatives, a man named Hasthun and a woman named Sara Jasmine, coordinated the extraction with military precision.
Safe Houses, Surveillance And Sudden Moves
The family moved through a complicated route designed to defeat any law enforcement tail. They switched between several three-wheelers, hid briefly inside provincial hospitals, changed vehicles in remote areas, and followed real-time telephone instructions from handlers.
Their destination was a secure house in Katuwapitiya, outside Negombo. When Hadiya entered, the security rules started immediately.
Operatives seized every mobile phone in the house. They disabled identifying phone components, physically destroyed parts, and discarded the remaining plastic shells to prevent geolocation through cell-tower tracking.
That move marked the start of a nomadic life. Over the next two months, the families of the bombers moved through safe houses across western Sri Lanka. They stayed in Katuwapitiya, Panadura, Enderamulla, and a high-rent apartment inside Colombo’s Lucky Plaza.
The properties functioned like tactical outposts. After entering a new rental, the cell installed internal and external closed-circuit television cameras to watch the perimeter.
If a landlord arrived without warning, or if an unfamiliar vehicle lingered outside, the cell abandoned the property. They packed their weapons and moved to another pre-arranged site.
Inside those suburban houses, Hadiya said the air often carried the chemical smell of volatile compounds. She testified that she watched Zahran and his inner circle stockpile agricultural fertilizers, mainly urea, along with commercial acids and detonators.
Operatives bought the chemicals in small quantities across multiple agricultural districts to avoid attracting attention. The process remained volatile and amateurish. Its danger became clear when Zahran’s brother, Rilwan, suffered severe burns and injuries.
Hadiya described the aftermath of a bomb-testing accident in a remote field. An experimental device exploded too early. Rilwan lost parts of his fingers and suffered serious facial trauma.
The cell could not take him to a public hospital without alerting police. Instead, it activated its financial network. Within hours, it raised large sums of illicit cash for private medical supplies, underground treatment, and antibiotics to keep him alive inside the safe houses.
Easter Sunday Attackers Enter The Final Phase
By mid-April 2019, the logistical phase ended and the operational phase began. The cell started assembling heavy canvas backpacks and custom-made safety jackets filled with explosives and ball bearings meant to maximize casualties.
Days before Easter Sunday, Zahran approached Hadiya. His manner was cold, clinical, and detached. He spoke in vague terms about an impending Hijra, meaning a migration or separation, and told her that their time together was over.
He handed her 35,000 Sri Lankan rupees in cash.
Hadiya quoted him as saying that, if she heard they were no longer, she would need white clothes for the mourning period. Zahran never used the words “suicide attack.” He did not name the churches or hotels.
Instead, he kept the operation compartmentalized. He left his wife with money and a grim instruction to prepare for widowhood.
The commission later checked Hadiya’s account against CCTV footage from a commercial strip in Giriulla. The video showed Hadiya, Sara Jasmine, and Ferosa, the wife of another operative, entering Jayasundara Textiles.
There, using the money Zahran gave her, they bought plain white fabric for the Idda, the traditional Islamic mourning period observed by widows.
With the white clothes packed, the cell separated. The women and children moved to the Eastern Province and split across properties in Nindavur and Sainthamaruthu. The men disappeared toward Colombo.
On the morning of April 21, 2019, the quiet inside the eastern safe house broke. Nafna, the wife of the injured Rilwan, entered the room where the women had gathered. Her face looked pale. She told them to wear the white clothes because they had done the blast.
A Second Wave That Never Came
News broadcasts soon confirmed the scale of the horror. Zahran and his team had struck at several locations at almost the same time.
Yet, while the country entered emergency mode and military curfew, the surviving remnants of the cell believed their campaign had only begun.
According to Hadiya, the heavily bandaged Rilwan claimed the Easter bombings were only an opening attack. He told the terrified women that around 20 suicide bombers had originally been planned for the vanguard campaign.
He also claimed a secondary wave of younger, deeply radicalized recruits remained hidden and waited for orders to launch another offensive.
Even as security forces hunted the cell, its digital link to the global caliphate stayed open. From an overseas location, Abu Hind contacted surviving operatives on Telegram and demanded immediate proof of the operation.
He wanted media material to send to ISIS central command in Syria for official broadcast. Inside the Sainthamaruthu safe house, surviving cell members moved quickly.
They brought out laptops, hard drives, and encrypted pen drives. They edited raw footage of the bombers standing together with masked faces, raised fingers, and an ISIS black flag behind them as they swore allegiance.
The video was compressed and transmitted through Telegram. Hours later, the Islamic State’s Amaq News Agency broadcast the image globally and claimed credit for the Sri Lankan carnage.
The fugitives’ run ended on April 26, 2019. Local residents grew suspicious of the home’s occupants and passed tip-offs to authorities. Soon, a heavily armed Sri Lankan military and police contingent surrounded the Sainthamaruthu safe house.
A fierce gunbattle erupted. Gunfire cut through the concrete walls as troops pinned the cell inside. When the remaining operatives realized escape was impossible and a breach was imminent, they chose annihilation over capture.
Sainthamaruthu And The Final Explosion
Hadiya testified that she saw Sara and Rilwan wearing suicide bombs. She also said Sara urged her not to go into the room, but to join them.
Sara Jasmine demanded that Hadiya take her children, stand in the centre of the living room, and join the final explosion so the whole family could enter martyrdom together.
Hadiya refused. She turned away from the explosive vests, grabbed her young daughter’s hand, and ran into a reinforced back room. Then she pulled the door shut.
Immediately after that, a blast tore through the house.
The explosion detonated stockpiled commercial explosives and suicide vests. It brought down the roof and common walls of the villa. Fifteen people died inside, including three operational gunmen, six children, and the remaining wives of the cell.
When the smoke cleared and the ringing in her ears faded, Hadiya found herself trapped beneath chunks of concrete, bleeding but alive.
Through the darkness and dust of the collapsed building, she heard the faint voice of her daughter calling for water. Outside, scattered military gunfire continued, mixed with the shouts of advancing commandos.
Hadiya’s 196-page testimony ends in the ruins of that house. It remains a personal record of the rise, operational footprint, and violent self-destruction of the organization behind one of the century’s most devastating intelligence failures and terrorist attacks.
Still carrying blast scars on her arms, with her face blurred in public records for her protection, Zahran’s widow remains a living archive of Sri Lanka’s darkest hour.
The original story appeared in the Sri Lanka Guardian.
#EasterSundayAttackers #EasterSundayAttacks #SriLanka #SriLankaNews #ZahranHashim #NationalSecurity #TerrorismInvestigation #Sainthamaruthu #TheMorningTelegraph
