Using a SIM card recovered from the site of the attack on March 26, police traced the suicide bomber’s movements from Khost city in eastern Afghanistan to the Chaman border crossing in Pakistan’s western Balochistan province.

Police believe the attacker was an Afghan national, but are carrying out DNA testing to confirm their suspicions.

From Chaman, he is thought to have driven more than 1,000km north to the town of Chakdara, passing through a number of security checkpoints in areas that have long been plagued by attacks without the explosives-laden car once being searched.

Police say the bomber was met at a car showroom in Chakdara by Shafiq Ahmed, who worked at a government school in Kohistan. On March 15, Ahmed accompanied the bomber from Chakdara to Besham, near where the attack was later carried out.

Parking the vehicle overnight at a local petrol pump, they drove the next day to Oghi district, a neighbouring remote area notorious as a hideout for criminals and terrorists, to meet terrorism cell chief Hazrat Bilal, another Kohistan native.

Bilal was also involved in the July 2021 attack, police said, but he has evaded arrest by regularly changing his appearance.

The suicide bomber and his guide drove back into Besham at 6.17am on March 26 and lay in wait for the CGGC convoy, which they knew was coming because workers had been transported between Dasu and Islamabad every second day at fixed times, police said.

Ahmed, acting as a spotter, saw the convoy arrive in Besham at 12.49pm and informed the bomber, who launched his attack at Lahore Nullah, some 3.5km ahead, around 11 minutes later.

The impact of the explosion instantly killed the driver of the bus, which careered off the highway and dropped about 50 metres into a ravine, setting bushes alight.

Two men – believed to be Bilal and Ahmed – could be heard exchanging congratulations and discussing the lethal outcome of the bombing in a monitored mobile phone call that took place immediately after the attack on the outskirts of Besham.

The man identified as Bilal voiced his disappointment that one of the two buses carrying CGGC employees had only sustained minor damage.

Arriving on the scene minutes later with the emergency services, This Week in Asia found the Chinese occupants of the second bus hidden under a truck some 500 metres from the highway in the same ravine. They were deeply traumatised and unable to speak.

Afghanistan: terrorists’ refuge

The findings have convinced police investigators that both attacks involved suicide bombers who were trained in eastern Afghanistan by a faction of the Pakistani Taliban, or Tehreek-i-Taliban Pakistan (TTP), previously led by Tariq Rafiq until his reported assassination in Kunar province in July 2022.

Tariq, also known as “Button Kharab” (broken switch), was given his strange nickname by TTP colleagues after a suicide bomber’s jacket that he once made failed to detonate during an attempted attack. Bilal was a close associate of Tariq, police said.

The TTP has repeatedly denied any involvement in either of the two attacks that were carried out against Chinese nationals on Pakistan’s Karakoram Highway.

China views the Taliban as an important security partner against Uygur separatists aligned with al-Qaeda and Isis-K cells based in Afghanistan. In February, Beijing recognised the diplomatic credentials of the Taliban’s first official envoy to China.

‘Vested interests’: why China is backing Taliban regime in Afghanistan

Terrorism researcher Riccardo Valle described the so-called Button Kharab group as part of a “freelance jihadist, semi-independent network” that operates with the TTP and other associated groups.

“It maintains a degree of independence when it comes to its own planning of attacks,” he said.

Valle believes that Button Kharab himself may have survived the assassination attempt in July 2022 and gone into hiding, so could still be managing the network.

The TTP didn’t confirm his death at the time, saying only that the group had lost contact with him and did not know his whereabouts.

But even if he was killed, official investigations into the 2021 attack revealed that Button Kharab and his associates had built a militant network “running on family lines which facilitated the movements of vehicles and explosives through legal ways”, said Valle, who is director of research for The Khorasan Diary, an Islamabad-based security news and analysis platform focused on Afghanistan and Pakistan.

“Hence, whoever may have replaced Button Kharab might be using the same network,” he said. The police officers who spoke to This Week In Asia have come to the same conclusion.

They also complained about a lack of coordination on the part of security agencies tasked with protecting Chinese nationals working on projects in Pakistan.

How to stem terrorist attacks on the China-Pakistan Economic Corridor

This was evident at the site of the March 26 blast, where This Week in Asia saw the security detail that had been assigned to protect the CGGC workers rejecting a police officer’s plea to relocate the cowering survivors, citing the threat of a follow-up attack.

Official blame for the security failures that led to the March 26 attack has fallen on the region’s top three police officers, all of whom were suspended on Tuesday.