Bulgarian authorities have established that a Hezbollah terror cell orchestrated last Wednesday’s bombing on a bus at Burgas airport in which five Israelis and the Bulgarian bus driver were killed, Israel’s Channel 2 news reported on Saturday night.

There is a concern that members of the cell have fled Bulgaria, possibly overland to Turkey.

The authorities distributed an artist’s sketch on Friday of a man they believed had helped the bomber, but they now believe the man in the sketch may have been the bomber himself, the report added. The sketch has been widely distributed in Burgas, including at resort hotels.

Bulgaria’s Interior Minister Tsvetan Tsvetanov said on Saturday “there may have been a second man” directly involved in the bombing. “We have not ruled that out.”

With assistance from Israeli Mossad and Shin Bet teams, and other intelligence agencies, the Bulgarians were reported to be analyzing remnants of the bomb — a homemade device comprising 3 kg. of TNT — in order to determine its origin.

Bulgarian officials were quoted Saturday as saying they were “three or four days” away from identifying the bomber, who arrived in the area about four-to-seven days before the attack.

Bulgarian prosecutors said the attacker had short hair, not the long hair seen in the security video footage captured of him at the airport, carrying the backpack that, Tsvetanov said, held the bomb. A witness said he appeared to be wearing a wig.

Tsvetanov said the bomb had detonated in the luggage compartment of the bus carrying Israelis from the terminal on Wednesday afternoon. The bomber was believed to have been about 36 years old, he said.

The same man, according to eyewitnesses quoted on Israel’s Channel 2 news, had been seen speaking to tourists at local beaches in the days before the attack.

According to one eyewitness report, the man got talking to a group of tourists from Holland, and told them that his mother was Dutch and his father was Iranian.

Israel’s Prime Minister Benjamin Netanyahu has blamed Hezbollah for carrying out the attack, under the direction of Iran, and pledged a forceful response.

The Bulgarian news agency Sofia reported Wednesday that the bomber was carrying an American passport and Michigan driver’s license, both believed to be forgeries.

Sofia also reported that the Bulgarian Interior Ministry managed to recover the fingerprints of the bomber, which they submitted to the FBI in the United States and the international police organization Interpol. The FBI and CIA joined Israeli and Bulgarian officials in investigating the attack.

Tsvetanov told Sofia that DNA tests were being run to determine the identity of the Caucasian man, who the minister described as casually dressed with nothing suspicious about his appearance to set him apart from the crowd of people at the airport.

The ministry did not indicate how the police came to the conclusion that the man caught on airport security cameras in the clip was the suicide bomber.

In a TV interview Friday, Defense Minister Ehud Barak said he was certain who carried it out.

“Hezbollah is behind the attack, it was part of a series of attacks,” he told Israel’s Channel 2 TV. “We know that Iran is behind it all. What we don’t know is who the actual man is.”

Deputy Prime Minister Moshe Ya’alon expressed similar sentiments on Friday, warning that Israel would respond at the right time and place to the attack, which he said was perpetrated by Iran.

Though Iranian President Mahmoud Ahmadinejad gloated over the attack on Thursday, Iran denied responsibility for the attack, which threatened to further escalate a shadow war between the two countries over allegations that Tehran is trying to build nuclear weapons.

Bulgarian prosecutors said Friday that the bomber tried to rent a car in the days before the bombing but was turned down because his ID appeared suspicious.

Afrodita Petrova, the owner of the car rental company, told Bulgarian National TV that the suspect had short dark hair when visiting the office. She said he was the same person from the video camera footage and appeared to be wearing a wig.

“He spoke English with an Arab accent,” she said.

Tsvetanov said the investigation had ruled out that the bomber was a Bulgarian citizen, but did not say how authorities know that. He said the investigation had also ruled out that the bomber was Mehdi Ghezali, a Swedish citizen and former Guantanamo detainee whom authorities had previously fingered as the bomber.

“Now we are focused on finding out the identity of the suicide bomber and his possible whereabouts ahead of the blast,” Tsvetanov said.

US President Barack Obama called Bulgarian Prime Minister Boyko Borisov Friday to offer his condolences and continued support in the investigations into the terror attack.

A US official told The Associated Press on Thursday night that Hezbollah was believed to be behind the attack. The official spoke on condition of anonymity to discuss a sensitive intelligence issue.

However, Pentagon press secretary George Little said Friday the US government has not established with certainty who was behind the attack.

“The attack does bear some of the hallmarks of Hezbollah, but we are not in a position to make any final determination,” Little said.

Israel has officially issued a complaint with the UN Security Council, accusing Iran of responsibility for the attack. Israeli representative Haim Waxman wrote the Security Council president that the attack in Bulgaria was part of an international terrorist campaign against Israelis and Jews worldwide, led by Iran and Hezbollah.