Reporting snapshot · 21 September 2026. The initial investigation into the 18 September attack on Kohat's Old Police Lines was still developing when this article was prepared. The findings below reflect the investigation team's account as reported by The Express Tribune and the first information report described by Geo News; the identities and affiliations of all the attackers have not been independently verified.
What happened
The initial investigation into the 18 September attack on Kohat’s Old Police Lines has found that the attackers intended to hold the compound under a prolonged siege, not merely carry out a suicide bombing, according to investigative officials quoted by The Express Tribune. The investigation team’s account, reported as it emerged on 20-21 September, describes seven armed terrorists, including a sniper, entering the Police Lines after a vehicle-borne explosion and moving towards key buildings with hand grenades and sniper rifles.
The attack began during Friday congregational prayers on 18 September, when an explosives-laden vehicle resembling a rickshaw was rammed near the Police Lines and detonated, causing a powerful blast, investigators told the newspaper. Armed terrorists then entered the compound, opened fire and used hand grenades as they advanced towards several buildings. Investigators said the attackers intended to use the explosion and gunfire to scatter police personnel and remain inside the compound for as long as possible. Police officers resisted despite taking casualties, preventing the attackers from advancing according to plan.
KhabarWire reported the same-day casualties on 18 September, the confirmed toll and the responsibility claim on 19 September, and Pakistan’s demand that Kabul dismantle militant networks on 20 September.
What the investigation found
According to the investigation team’s account carried by The Express Tribune, the attackers were not limiting themselves to a single suicide blast. The terrorists brought hand grenades, sniper rifles and other weaponry and explosives into the Police Lines, opened fire after the explosion, and used grenades during the assault. The first information report (FIR) registered by police also documented the use of gunfire and hand grenades, the reports said.
The investigation’s account of the sequence is that an explosives-laden, rickshaw-style vehicle was rammed near the Police Lines, causing a massive blast; immediately afterwards, armed terrorists entered the compound and advanced on key buildings. Police said seven armed terrorists, including a sniper, entered the compound after the initial attack. The intention, investigators concluded, was to disperse the police force with the initial explosions and gunfire and then remain inside for as long as possible, but police personnel maintained their resistance despite sustaining injuries and coming under heavy fire.
A senior police officer told The Express Tribune that the use of drone technology and the timely response by police and other forces played a crucial role in monitoring the terrorists’ movements and conducting the operation. The officer said the forces quickly brought the situation under control and prevented the attackers from spreading further inside the compound. Officials reported a prolonged standoff after the terrorists entered the Police Lines buildings, and the joint clearance operation continued for around 20 to 21 hours.
The clearance operation and its cost
The overnight clearance operation was conducted by police, the Counter-Terrorism Department (CTD), Elite Force and other security forces, according to the Central Police Office, with the Pakistan Army joining after Fajr prayers. Geo News reported that security sources said army personnel killed the last two suicide bombers hiding inside the compound. The CTD’s additional inspector general was wounded by a grenade during the operation but returned to the frontline after receiving first aid, according to a police account carried by Pakistan Today.
The death toll from the attack is reported with some variation across sources and over time. The Express Tribune’s initial-probe report cited at least 21 people killed, including 15 police officials, with more than 100 injured; it noted the total had risen to 23 by the time the clearance operation concluded. Geo News, citing the FIR, reported 22 killed, including 16 police officials and six civilians, with 103 injured, of whom 73 were police personnel and 30 civilians. Pakistan Today reported 23 dead, including 17 policemen and six civilians. The discrepancies reflect updating hospital and police counts during and after the operation, and KhabarWire’s earlier report on the confirmed toll set the figure at 21 before later figures were published. The number of attackers killed was also reported differently, with KP police putting it at eight while Interior Minister Mohsin Naqvi cited seven.
The FIR was registered by the CTD police station at the complaint of the station house officer of Kohat City police station, booking unidentified militants under provisions relating to terrorism, murder and attempted murder. The assault, the FIR states, involved a suicide bombing, gunfire and grenade attacks, and damaged government and private property.
Who claimed responsibility
The attack was claimed by Ittihadul Mujahideen Pakistan (IMP), the alliance led by Afghanistan-based Hafiz Gul Bahadur, which KhabarWire reported on 19 September. The state uses the term Fitna al-Khawarij for the banned Tehreek-e-Taliban Pakistan and affiliated militant groups. Investigators said a comprehensive inquiry was under way covering terrorist facilitators, the planning of the attack, the supply of weapons and explosives, and potential links. Officials said all aspects of the attack were being examined.
Why it matters
The finding that the Kohat attackers planned a prolonged siege, rather than a single suicide bombing, points to a more ambitious assault design than initial reporting suggested: one intended to hold a large police compound for hours and draw in reinforcements. The account also indicates that surveillance, including the use of drones, was central to how security forces contained and ended the attack. The attack sharpened Pakistan’s criticism of the Afghan Taliban, with the Ministry of Information saying the assault was carried out by what it called terrorists with roots in Afghanistan and demanding that Kabul take what Islamabad described as credible, verifiable and sustained measures against militant networks, as KhabarWire reported on 20 September.
What is still uncertain
Several elements of the investigation remain open. The identities and affiliations of all the attackers have not been independently verified, and official accounts differed on the final death toll and the number of attackers killed. The reliability of the IMP claim of responsibility, and the extent of any external direction or support, are questions the investigation had not resolved when these findings were reported. The police statement attributed the role of drone technology and the plan for a prolonged siege to investigators and a senior officer; these are accounts of the investigation’s progress, not independent findings.
Sources & reporting notes
This is a synthesis of published material, not eyewitness reporting. Sources were reviewed on 21 September 2026.
- The Express Tribune — Initial probe reveals terrorists planned prolonged siege in Kohat Police Lines attackPublished 20 September 2026 · The investigation team's account of the attackers' plan, weapons and the operation; the primary report for this article.
- Geo News — Kohat mosque attack: FIR details militants' gunfire assault inside Police Lines after blastPublished 20 September 2026 · Independent report of the FIR, casualties, and the clearance operation.
- Pakistan Today — Eight terrorists killed as Kohat Police Lines clearance operation concludesPublished 19 September 2026 · Independent account of the clearance operation, the CTD officer's injury, and casualty figures.
- The Express Tribune — Kohat attackers had planned long siegePublished 21 September 2026 · Follow-up report of the initial investigation and the FIR's contents.
