Also found in the debris was a Michigan driver’s license. It was not only a fake, but similar to another Michigan license picturing a heavyset man, also wearing a bad wig, and so poorly forged it was declined by a rental car clerk elsewhere in Bulgaria a few days earlier. Investigators traced both to the same source inside Lebanon. Investigators early on located the hotel room where the bomb was made, intelligence sources tell TIME. But the breakthrough was identifying two suspects who entered the country on valid passports, one Canadian, the other Australian. Both have retreated to Lebanon and were linked to Hizballah’s military wing, Bulgarian officials told reporters.

Learning that much took months, indicating a level of tradecraft that was itself indicative of Hizballah. The disciplined group is keen to avoid being publicly linked to new terrorist plots because, unlike Washington, the E.U. has not yet labeled it a terrorist group, leaving it free to raise funds in Europe. “They’re very good at covering their traces,” says Benedette Berti, co-author of a new book on Hizballah.

Also pointing toward the Iranian proxy was an apparently parallel plot in Cyprus, where a Hizballah operative was reportedly arrested on July 7 as a result of a tip from Israeli intelligence. The man carried a Swedish passport and offered clues that — after beating its brains out trying to hit hard targets — the Iranian side was swallowing its pride and taking aim at soft ones. Police said the operative had been scouting airports and plane schedules, including charters like the ones the Sibonis would deplane in Bulgaria 11 days later, then head toward the bus that would take them to their hotel.