Stanimir Florov, chief of the directorate for combating organized crime, also said the connection between two of the suspects and Hezbollah, a terrorist organization, has been confirmed.
Several days ago, Europol reported the bomb was likely to go off by accident when passengers were putting bags into the luggage compartment, so the bomber was likely not a suicide bomber, as previously believed.
The attack in July killed five Israeli tourists and the bus driver.
Florov said four terrorists stayed in Bulgaria, one is dead, while three others are still alive, Sofia News Agency reported.
Florov said the suspects have also visited other cities in Bulgaria.
Notable deaths of 2014 [PHOTOS]
Meet the hero in attack on Canadian Parliament