The inside story of the Paris attack

Updated 8:15 AM EDT, Tue March 22, 2016
The Belgian Interior Ministry
PHOTO: Belgian Interior Ministry
The Belgian Interior Ministry's Crisis Center has released two new stills of the Paris attack suspect, Salah Abdeslam, who is still at large and is the subject of an international arrest warrant.
Now playing
01:25
Captured Paris attacker planned to 'restart something'
PHOTO: VTM
Now playing
00:59
Paris terror suspect captured, injured in raid
Now playing
02:50
Salah Abdeslam, Paris terror suspect, captured
brussels attack utah mormon family lah cnn dnt_00001005.jpg
brussels attack utah mormon family lah cnn dnt_00001005.jpg
Now playing
02:20
U.S. teen survives two terrorist attacks
Now playing
01:47
Source: Paris terror suspect captured, injured but alive
PARIS, FRANCE - MARCH 04:  French President Francois Hollande makes a statement next to German Chancellor Angela Merkel during a press conference at the Elysee Presidential Palace on March 04, 2016 in Paris, France. Angela Merkel is received by Francois Hollande to prepare the EU-Turkey summit on the crisis of migrants on March 07 in Brussels.  (Photo by Thierry Chesnot/Getty Images)
PHOTO: Thierry Chesnot/Getty Images Europe/Getty Images
PARIS, FRANCE - MARCH 04: French President Francois Hollande makes a statement next to German Chancellor Angela Merkel during a press conference at the Elysee Presidential Palace on March 04, 2016 in Paris, France. Angela Merkel is received by Francois Hollande to prepare the EU-Turkey summit on the crisis of migrants on March 07 in Brussels. (Photo by Thierry Chesnot/Getty Images)
Now playing
00:46
Pres. Hollande: I am thinking of the victims right now
Belgium Paris suspect fingerprints found elbagir _00001524.jpg
PHOTO: Belgium Interior Ministry
Belgium Paris suspect fingerprints found elbagir _00001524.jpg
Now playing
01:05
Paris suspect Abdeslam captured alive
Belgian policemen stand guard the road during a police action in the Molenbeek-Saint-Jean district in Brussels, on March 18, 2016.
A police operation was underway on March 18, in the Brussels area home to key Paris attacks suspect Salah Abdeslam whose fingerprints were found in an apartment raided this week, the federal prosecutor
PHOTO: JAN NAGELS/AFP/Getty Images
Belgian policemen stand guard the road during a police action in the Molenbeek-Saint-Jean district in Brussels, on March 18, 2016. A police operation was underway on March 18, in the Brussels area home to key Paris attacks suspect Salah Abdeslam whose fingerprints were found in an apartment raided this week, the federal prosecutor's office said. / AFP PHOTO / BELGA / JAN NAGELS / Belgium OUTJAN NAGELS/AFP/Getty Images
Now playing
02:02
2 suspects captured in Belgian terror raid
brussels belgium raid elbagir wt_00002619.jpg
brussels belgium raid elbagir wt_00002619.jpg
Now playing
01:31
Escape route 'easy' for Brussels terror suspects
brussels manhunt suspects prosecutor presser_00001014.jpg
brussels manhunt suspects prosecutor presser_00001014.jpg
Now playing
01:32
Two suspects on the run in Brussels, another hospitalized
brussels suspicious package false alarm sot_00003614.jpg
brussels suspicious package false alarm sot_00003614.jpg
Now playing
01:24
Brussels police say powder at mosque was flour
Soldiers stand guard at Brussels
PHOTO: Antonia Mortensen/CNN
Soldiers stand guard at Brussels' Jewish museum in the wake of Thursday's terror raid in eastern Belgium,
Now playing
01:54
Greece investigating ties to Belgian terror plot
lklv burns belgium terror plot_00013714.jpg
lklv burns belgium terror plot_00013714.jpg
Now playing
03:16
Belgium police foil 'imminent' terror attacks
ac belgian terror raid unedited_00013224.jpg
PHOTO: Amateur Video / Frederic Hausman
ac belgian terror raid unedited_00013224.jpg
Now playing
01:34
Belgium terror raid caught on video
ac bpr vlierden belgium terror suspects wanted to behead official_00012010.jpg
ac bpr vlierden belgium terror suspects wanted to behead official_00012010.jpg
Now playing
01:54
Report: Belgian terrorists wanted to behead official
PHOTO: YouTube/Frederic Hausman
Now playing
02:20
Witness describes filming of terror raid in Belgium
nr brooke baldwin sexton reese belgium raids_00050610.jpg
nr brooke baldwin sexton reese belgium raids_00050610.jpg
Now playing
06:33
Prosecutor: 'Major imminent attacks' foiled
lead dnt sciutto belgium raid foiled_00011108.jpg
lead dnt sciutto belgium raid foiled_00011108.jpg
Now playing
01:57
Belgium: Raid foiled imminent attack

Editor’s Note: This story is based on French police documents on the investigation into the attacks obtained by CNN and interviews with investigators over the last four months, as well as the public statements of Belgian and French prosecutors. “Terror in Paris,” a CNN documentary reported by Chris Cuomo, will air on March 29 at 9 p.m. ET.
The story was published before the bombings in Belgium took place on Tuesday. For latest news on those attacks click here.

(CNN) —  

The night that shook Paris started with three rental cars: three cars with three teams of terrorists maneuvering through the Friday evening traffic, armed with the weapons of war.

A little before 9 p.m., a Renault Clio driven by Salah Abdeslam, the Paris plotter captured on March 18 in Brussels, pulled up outside the national stadium. An international soccer friendly match between France and Germany was just kicking off and 80,000 fans, including French President Francois Hollande, were already inside. Three men got out of the car and headed toward the stands.

One of them – Bilal Hadfi, a young French citizen living in Belgium – can be seen on surveillance video speaking into a cell phone. The other two were Iraqis who had slipped into Europe weeks before by posing as refugees. One of the trio was dressed in a Bayern Munich football team jogging suit. Concealed underneath their clothes were shrapnel-filled suicide vests held together with tape.

A few miles away, a black Seat Leon weaved toward the busy cafe district of Paris. The man behind the wheel, an already notorious Belgian ISIS operative named Abdelhamid Abaaoud, was on the phone speaking to Hadfi at the stadium to make sure everything went according to plan. In the passenger seats, two of his childhood friends, Chakib Akrouh and Salah Abdeslam’s older brother, Brahim, clutched their Kalashnikovs, readying themselves.

Not far away, a black Volkswagen Polo with another trio of heavily armed terrorists headed toward the Bataclan concert hall, where hundreds had gathered to hear the American rock band Eagles of Death Metal. The French ISIS fighters in the car – Ismael Omar Mostefai, Samy Amimour and Foued Mohamed-Aggad – had all recently been on the front lines in Syria, and were moments away from carrying out the worst massacre in the modern history of France.

A night of terror

It is still not clear why the stadium attackers arrived slightly late for the game, but eyewitness accounts suggest they did not have tickets. A security guard at Gate R told French police that starting at 9.05 p.m., he blocked a man resembling one of the Iraqi stadium attackers four times from trying to trick his way in, according to French police documents. One eyewitness interviewed by police remembered seeing three attackers, including Salah Abdeslam, talking to one another after being refused entry into the stadium.

Interrogated after his capture four months later, Abdeslam claimed he had been assigned to blow himself up at the stadium but backed out, according to Paris prosecutor Francois Molins, who said the claim should be treated with caution.

The French police reports make clear that eyewitness accounts are not always reliable and, in the case of the many interviewed after the Paris attacks, were sometimes contradictory. What is clear is that at a certain point after dropping off the stadium attackers, Salah Abdeslam drove away with his suicide vest.

MORE: Six questions about Paris suspect’s arrest

Explosion at the Stade de France

At 9:20 p.m., the first of what would be several large bangs thundered across the stadium. The Iraqi suicide bomber – who according to the security guard had been trying to sneak in – blew himself up outside Gate D, killing one other person. A doctored Syrian passport in the fake name of Ahmad al Mohammad would later be found near what remained of his right foot.

At the moment of the first blast, Bilal Hadfi, the young Belgian member of the stadium attack team, was still on the phone with Abaaoud, the plot ringleader, who was impatiently maneuvering his Seat rental car through the traffic on Rue Bichat to get to the cafe district. Inside the car were his childhood friends Brahim Abdeslam and Chakib Akrouh. The elder Abdeslam brother had traveled from Belgium to Syria in January 2015, where like Akrouh he had joined ISIS.

Face to face with a suicide bomber

Kalashnikov fire in the cafe district

Their attack began at 9:25 p.m. when a car in front of Abaaoud blocked his path. Five shots were fired from the Seat Leon, killing the driver of the car. According to some eyewitnesses, Abaaoud stopped the car in the middle of the road, turning on the blinking hazard lights. Shouting “Allahu akbar,” Arabic for “God is great,” all three terrorists then got out of the vehicle and sprayed the terrace and windows of the Cambodge and Carillon cafes with their Kalashnikovs, killing 13 people.

At 9:30 p.m., a second bang was heard in the stadium. A second suicide bomber, dressed in the colors of Bayern Munich, detonated his vest outside Gate H. Fortunately, no one was killed. Hollande, the French president, would soon be evacuated from the stadium. The third suicide bomber detonated his explosive vest 20 minutes later, next to a McDonald’s restaurant near the stadium, injuring over 50, including seven seriously.

By the time of the second explosion at the Stade de France, the Seat Leon was at a new location. At 9:32 p.m., Abaaoud’s team got out of the vehicle, again shouted “Allahu akbar” and opened fire at revelers at the Casa Nostra and Bonne Biere cafes near the Place de la Republique, killing five. One of the surviving eyewitnesses noticed one of the shooters was wearing orange sneakers, Abaaoud’s footwear selection that night.

The killers then jumped back in the car. At 9:36 p.m., the cafe killers opened fire on La Belle Equipe cafe, killing 19. As at the other cafes, most of those who lost their lives were sitting on the outdoor terraces. Eyewitnesses later recalled the gunmen did not speak to each other as they calmly sprayed the cafes and cars traveling down the road with bullets.

The car again sped off to a new location. At 9:40 p.m., Abaaoud dropped off Brahim Abdeslam at the Comptoir Voltaire cafe. According to eyewitnesses interviewed by police, he was wearing a hooded jacket over several layers of clothing when he brusquely entered the covered interior terrace of the establishment. He smiled at the other patrons, apologized for interrupting their dinner, then blew himself up. Their killing done for the night, Abaaoud and Akrouh drove up toward the Montreuil suburb of Paris, where they would abandon the car.

The Bataclan attack: ‘We’re starting’

At around 9:40 p.m., Bataclan attackers Ismael Omar Mostefai, Samy Amimour and Foued Mohamed-Aggad parked their Volkswagen Polo in front of the concert hall. At 9:42 p.m., one of them took out a Samsung smartphone and sent a last text to a cell phone located in Brussels: “We’re getting going; we’re starting.” They then tossed the Samsung phone into a garbage can near the entrance of the Bataclan.

The phone was later recovered and has provided key information to investigators. They believe one of the men who received the text message in Belgium outranked Abaaoud in the Paris attack conspiracy. He has been identified as Mohammed Belkaid, an Algerian confectioner turned ISIS operative who was killed on March 15 in Brussels. Investigators believe he was the overall commander of the ISIS cell behind the Paris attacks as well as the attacks that shook Belgium five months later.

MORE: New Paris attacks suspect named

In total, 21 phone calls and two text messages were exchanged between the Samsung phone and the cell phone geolocated in Belgium after the latter phone went active, 24 hours before the Paris attack.

Investigators believe Belkaid and Laachraoui provided direction to the Paris attackers from Brussels before, during and after the night of the attacks, using multiple cell phones. According to French police reports obtained and viewed by CNN, the second of those cell phones, geolocated in precisely the same area in Belgium as the first, was communicating with Hadfi at the stadium and with Abaaoud’s cafe team as the attacks unfolded, suggesting the attack was being coordinated in real time from Brussels.

The encryption app

Several hours earlier, at 2:14 p.m., the Bataclan attackers had downloaded the encryption messaging app Telegram onto their Samsung smart phone, according to police reports. No recovered content from the messaging app is mentioned in the French police documents, suggesting there were likely communications by the Bataclan attackers that will never be recovered.

As well as offering end-to-end encryption, the Telegram messaging app offers an option for users to “self-destruct” messages. At 4:39 p.m. on November 13, one of the attackers downloaded detailed floor plans of the Bataclan venue onto the Samsung phone and conducted online searches for the American rock band playing there that night, the Eagles of Death Metal.

Almost all of the 89 people killed inside the Bataclan lost their lives during the first 20 minutes of the attack. The gunmen first killed three people on the sidewalk outside the concert hall, then entered and moved to the floor area of the venue, peppering the concertgoers with automatic fire, while shouting “Allahu akbar.”

Inside the Bataclan

As one fired his weapon, the other reloaded so they could kill as efficiently as possible. Researching the floor plans appears to have paid off for the perpetrators. As some of those inside tried to escape through an emergency exit, they found a third terrorist waiting for them on the other side, according to the French police documents.

According to the eyewitnesses cited in the French police documents, the attackers spoke perfect French, taunting those lying wounded on the floor of the concert hall by saying, “Anybody who moves, I’m going to kill.”

’Where are those Yanks?’

After the initial wave of killing, the gunmen stopped and asked each other “Where is the singer? Where are those Yanks? It’s an American group, you’re bombing us with the Americans, so we’re going to hit the Americans and you,” according to an eyewitness cited in the police documents.

The terrorists then addressed those fighting for their lives on the floor, telling them they had been dispatched from Syria by ISIS to carry out the attack to avenge French airstrikes in Iraq and Syria.

At 10 p.m., two local French police officers arrived at the venue. Although only armed with handguns, they managed to take out Samy Amimour. As Amimour fell mortally wounded to the floor, he triggered his suicide vest. According to police documents cited by Le Monde, when the other two terrorists opened fire on the police officers from above, they were forced to retreat.

The two surviving terrorists, Mostefai and Aggad, then took some of the surviving hostages, and according to documents cited by Le Monde, herded them to an L-shaped corridor deeper inside the building. According to police documents obtained by CNN, by then the terrorists had seized several cell phones from concertgoers to try to access the Internet but could not find a signal.

Hostage rescue

By 10:45 p.m., France’s rapid response commandos, a unit known as RAID, were on the scene. According to the French police documents obtained by CNN, they started communicating with the hostage-takers from outside the corridor via cell phone. The terrorists threatened to start executing their prisoners unless they received a signed paper promising that France would leave Muslim lands.

At around that time, Abaaoud, the Paris team leader, was spotted by a witness outside the Bataclan concert hall, apparently barking orders into a hands-free cell phone to the two surviving terrorists inside. Investigators later traced the cell phone he was using that night to the area outside the Bataclan. After abandoning the Seat Leon in Montreuil, he had ridden the metro back into the center of town to coordinate the final phase of the attack.

Just after midnight, the RAID commandos stormed the corridor, rescuing all the hostages alive. According to eyewitness reports cited by Le Monde, Mostefai and Aggad were cut down by police bullets. At least one of them managed to detonate his suicide vest.

A second attack is thwarted

Seven terrorists in the 10-man attack team were now dead. Only Salah Abdeslam, Abaaoud and Akrouh remained alive. Their attack was the deadliest in Europe since the 2004 Madrid train bombings. The death toll would soon rise to 130, with hundreds of others injured. Only fast detective work over the next few days prevented the death count from increasing further.

Instead of returning to a house rented by the cell in Bobigny, Abaaoud and Akrouh set up a makeshift camp that night in a small wooded area near a highway overpass near Rue des Bergeries in Aubervilliers, not far from the national stadium.

A helpful cousin

This is when Abaaoud’s female cousin Hasna ait Boulahcen came into the picture.

According to close associates interviewed by French police, she had been in love with Abaaoud ever since nearly marrying him when she was 16 and had stayed in touch with him online after he joined ISIS in Syria. According to others interviewed by police, she had recently herself become radicalized and had started wearing a full veil.

According to French police documents, Boulahcen received several calls from Belgium between November 13 and November 16 to guide her to Abaaoud’s location. The working assumption is these calls were placed by Belkaid or Laachraoui in Brussels, asking her to help Abaaoud find a place to stay.

She met him in his hideout late in the evening of November 15, according to French police documents. Police received a tip about the meeting the following day from a female confidential witness who had accompanied Boulahcen to the hideout. When this witness was eventually interviewed, she told police she had met a man wearing orange sneakers who claimed he had taken advantage of refugees to come to France with 90 others to carry out attacks.

French police began monitoring Boulahcen’s phone and following her after the tipoff, and also put the wooded area in Aubervilliers under surveillance, according to police documents.

According to the female confidential witness, Abaaoud was planning a followup attack on the La Defence shopping district in Paris on November 19, while his accomplice was hoping to hit a police station. In order to help them carry out the attack, Boulahcen was given 4,000 euros to buy suits and shoes for Abaaoud and Akrouh.