KABUL, Afghanistan (AP) — A militant arrested in the attacks on the Afghan capital and three other cities has confessed that the 18-hour assault was carried out by the Haqqani network, a lethal group of fighters with ties to the Taliban and al-Qaeda, a top Afghan security official said Monday.

Thirty-six insurgents were killed during the brazen attacks that also claimed the lives of eight policemen and three civilians, said Interior Minister Besmillah Mohammadi.

Though the death toll was much lower than other attacks, the dramatic assault on multiple targets showed that militants are far from beaten and can still penetrate Afghan security — even in the heart of the capital — after 10 years of war. The attack also underscored the security challenge facing government forces as U.S. and NATO troops draw down and prepare to leave by the end of 2014.

It was the most widespread assault in the Afghan capital since an attack on the U.S. Embassy and NATO headquarters last September — also blamed on the Haqqani network, which commands the loyalties of an estimated 10,000 fighters considered one of the most serious threats to NATO in Afghanistan.

Afghan and U.S. officials are trying to coax the Taliban — who are not as closely linked with al-Qaeda as the Haqqanis — to negotiate a political resolution to the 10-year-old war. If the Haqqani faction of the insurgency is behind the recent attacks, it could be easier to sell the idea of making peace with the Taliban to skeptics who say it amounts to making a deal with the enemy.

At the same time, international forces have been working to build up the Afghan army and police — a goal threatened by a growing number of insider attacks this year. In the latest such attack, an Afghan soldier opened fire on Bulgarian troops at his base Monday.

The soldier fired from a guard tower down on the Bulgarians at a joint base in Kandahar city, said Col. Mohammad Mohsin, a spokesman for the Afghan army in Kandahar. The Bulgarian troops fired back, killing the Afghan soldier, Mohsin said. He said the attacker was from northern Takhar province.

A coalition spokesman, U.S. Army Maj. Jason Waggoner, confirmed there was an incident in Kandahar. He said no NATO troops were killed but did not provide further details.

In Kabul on Monday, residents awoke to loud explosions and the crackle of gunfire. The attacks on the Afghan capital ended when insurgents who had holed up overnight in two buildings were overcome by heavy gunfire from Afghan-led forces and pre-dawn air assaults from U.S.-led coalition helicopters.

Rocket-propelled grenades were fired one after another into a building in the center of the city where insurgents began their attack Sunday. The building, which is under construction, overlooks the presidential palace, Western embassies and government ministries. The U.S., German and British embassies and some coalition and Afghan government buildings took direct and indirect fire, according to Lt. Col. Jimmie Cummings, a spokesman for the U.S.-led coalition.

Shortly before 3 a.m., coalition helicopters began flying over the structure. At 4:23 a.m. a religious cleric began calling Muslim worshippers to prayer over a loudspeaker in the area. During the next 15 minutes, troops launched five rocket-propelled grenades into the building. More followed.

Red and white flashes could be seen inside the various floors of the multistory building. By about 6:30 a.m., the blasts and shooting had stopped. Fighting there and at another building under construction near the Afghan parliament building on the southwest side of the city ended just before 8 a.m.

“The terrorists tried to harm the process of transferring security to the Afghan forces, but they are not able to do it,” Mohammadi told reporters in Kabul. “They want to create fear among the people.”

On Monday, Afghan security forces arrested a suicide bomber in eastern part of the capital before he was able to carry out an attack, according to a statement from the Kabul police.

Two suicide bombers and another insurgent arrested on Sunday on the west side of the city have confessed to being members of the Haqqani network, said Lutfullah Mashal, a spokesman for the Afghan intelligence service. He said the three are suspected of plotting to kill Karim Khalili, one of Afghanistan’s two vice presidents.

Apart from Kabul, the eastern capitals of Paktia, Logar and Nangarhar provinces also came under attack Sunday as suicide bombers tried to storm a NATO base, an airport and police installations there.

“One terrorist who was arrested in Nangarhar province confessed, saying ‘It was the Haqqani network that launched these attacks,'” Mohammadi said.

Eight members of the Afghan police, army and intelligence service were killed and 40 others were wounded in the attacks. Three civilians were killed and 25 others were wounded, he said.

“A Haqqani connection is a possibility, but still too early to determine for sure,” said Cummings, the NATO spokesman. “We will look strongly at that.”

In the streets of Kabul’s Wazir Akbar Khan neighborhood, where a NATO base and a number of embassies, including the U.S. Embassy, are located, residents scrambled for cover as gunfire rained down from all directions.

“I saw two Land Cruisers pull up and two militants jumped from the car,” said Mohammad Zakar, a 27-year-old mechanic who has a shop near the building commandeered by the militants. “They opened fire on an intelligence service guard … They also fired and killed an Afghan policeman and then they jumped into the building. All the shops closed. I ran away.”

Militants also attacked a NATO site on the outskirts of Kabul, where a joint Greek-Turkish base came under heavy fire and forces responded with heavy-caliber machine guns, according to an Associated Press reporter at the scene.

Taliban spokesman Zabiullah Mujahid said dozens of suicide attackers and gunmen were involved in attacks that had been planned for two months to show the insurgency’s power after NATO officials called the Taliban weak and said there was no indication they were planning a spring offensive.

Mujahid told the AP on Monday that the attacks did not mark the start of the insurgents’ spring offensive, which would begin shortly.

“It is a message for the spring offensive but it has not yet started,” Mujahid said. “The offensive will start shortly and it will be announced with its name and the purpose of the operation.”

Last year, the Taliban code-named their spring offensive “Badr” after one of the Prophet Mohammad’s decisive military victories.