Analysis of surveillance footage has led Greek police to a primary suspect, who is believed to have placed a backpack containing a bomb outside Hellenic Train late Friday night (April 11), as well as to a second suspect whose face was uncovered.

In the footage, the first man is seen walking down Syngrou Avenue wearing a hooded sweatshirt. He appears calm as he places the backpack against a pillar. A second man, walking in the opposite direction and speaking on a mobile phone, passes the scene with his face fully visible.

Greece’s Counterterrorism Unit has identified at least two suspects, and their full identification is believed to be imminent. Authorities are working to determine their precise escape route and whether other individuals were involved.

Responsibility for the bombing at Hellenic Train, as well as for an earlier attack on the Ministry of Labor on February 3, 2024, has been claimed by a group calling itself “Revolutionary Class Self-Defense.”

In a lengthy manifesto, the group officially took responsibility for both the recent bombing and the one at the Ministry of Labor last year. The attacks were dedicated to the Palestinian people and to their comrade who died in a bomb explosion while assembling a device in an apartment in the downtown Athens area of Ampelokipi.

According to sources, authorities believe that the same organization is behind two other incidents which occured in Ampelokipi and in Goudi, even though the failed Goudi attack was claimed by a newly-emerged group called “Armed Proletarian Justice.”

Investigators suspect that the alternative group name was used to avoid linking the “Revolutionary Class Self-Defense” group to the failed attack. They also believe that individuals connected to the Ampelokipi apartment were involved and that there are two bomb makers—one highly skilled, responsible for precise detonations like those on Stadiou and Syngrou, and a less experienced one, possibly the individual who died in the explosion.

In their manifesto, the group refers to the Tempi train disaster and the mass protests that followed in February and March, accusing the government of attempting to cover up the “crime,” which they describe as a political responsibility. The group also discusses labor issues, workplace deaths, and the structural failings of the Greek railway operator, concluding with a direct reference to the October 31, 2024, explosion in Ampelokipi.

It is noted that the explosive device, placed in a locked backpack outside the offices of Hellenic Train, detonated shortly after 9:30 p.m. on Friday, April 11. A warning call was placed to news websites at 8:54 p.m., stating that a bomb had been planted at the company’s offices. The caller gave a 35–40 minute warning before detonation, allowing police time to cordon off the area. The caller warned that the threat was not a hoax.