The terrorist cell that killed 32 people in attacks on Brussels last month had initially intended to strike France again, but swiftly decided to target the Belgian capital because the police investigation was closing in on them, prosecutors have said.

Belgium’s federal state prosecutor said on Sunday that “numerous elements” in the investigation showed the group “initially had the intention to strike in France again” following November’s Islamic State attacks on Paris that killed 130.

The prosecutor said the group was “surprised by the speed of the progress in the ongoing investigation” and so “urgently took the decision to strike in Brussels”.

Two suicide bombers killed 16 people at Brussels airport, and moments later a suicide bomb at Brussels’ Maelbeek subway station killed another 16, on 22 March.

Investigators have found clear links between the cell behind the Brussels attacks and the group that prepared and carried out November’s attacks in Paris. Both were claimed by Isis.

Belgian prosecutors announced this weekend that Mohamed Abrini, 31, a key suspect wanted in connection with November’s Paris attacks, had confessed to being the third bomber at Brussels airport. Known from CCTV footage as “the man in the hat”, he left a large bag of explosives at the airport, then fled on foot. He was arrested on Friday in a police raid.

Before taking part in the Brussels bombings, Abrini had been on the run from police for four months after being identified on CCTV footage as a suspect at the wheel of a Renault Clio used by the gunmen in the Paris attacks.

The investigation has established connections between a large group of men – many of them childhood friends or brothers – who are suspected of playing roles in both the Paris and Brussels attacks, the two biggest terror attacks carried out in Europe by Isis.

In the week before the Brussels attacks, Belgian and French police working together to trace suspects in the Paris attacks carried out a series of raids.

Four days before the Brussels attacks, police arrested Salah Abdeslam, who was then Europe’s most wanted man after four months on the run. Abdeslam, a French national who grew up in Brussels, is thought to be the last surviving Paris attacker.

He had rented two cars involved in the attacks under his real name as well as booking hotel rooms used by the attackers. He travelled to Paris with his childhood friend Abrini, and is believed to have driven the car used to drop off the three suicide bombers who blew themselves up at the Stade de France.

Now in detention in Belgium and being prepared to be transferred to France, he is said to claim to have backed out of blowing himself up in Paris. He was found hiding in Molenbeek in Brussels, not far from the street where his parents lived.

A few days before his arrest, police arrived to search a flat in the Forest neighbourhood of Brussels which they thought was empty. They were met with gunfire from behind the door, and a police sniper shot one of the gunmen through a window.

The shot gunman was Mohamed Belkaïd, a 35-year-old Algerian living illegally in Belgium and known to police for a theft case in 2014. “Next to his body was a Kalashnikov, a book on Salafism and an Islamic State flag,” according to Thierry Werts, of the Belgian federal prosecutor’s office.

Belkaïd, who had been sought by police under a fake name, was later identified by prosecutors as “more than likely” one of the key logistics operatives behind the Paris attacks. Abdeslam’s fingerprints were found at the flat. Two other men escaped the Forest raid and went on the run.

The four identified bombers who struck Brussels – three at the airport and one in the metro – all had links to the planning and logistics of the Paris attacks four months earlier.

Khalid el-Bakraoui, 27, who blew himself up on the Brussels metro shortly after his elder brother Ibrahim had detonated a suicide vest at Brussels airport, was suspected of playing some kind of logistics role in the Paris attacks. He had rented, under a false name, the apartment in the Forest area that was raided by police. He is also believed to have rented a safehouse in the southern Belgian city of Charleroi used by more of the Paris cell before the November attacks.

Najim Laachraoui, 24, who grew up in Brussels, blew himself up at the airport. He was also a suspected Islamic State recruiter and bomb-maker whose DNA was found on two explosives belts used in the Paris attacks.

In the days after the Brussels attacks, the French president, François Hollande, said the network behind the attacks in Paris and Brussels was being “wiped out”, but he added that other networks existed and there was still a threat.

Three days after the Brussels attacks, police in Paris arrested a Frenchman, Reda Kriket, 32, who they said had been in the “advanced stages” of a plot to attack France. It was not confirmed whether he had links to the Brussels-Paris cell. Belgian and French police are investigating people linked to him.

The French state prosecutor said a number of weapons, including five assault rifles and handguns, as well as chemicals and explosives that could be used for a bomb, were found at Kriket’s apartment.

Police also found in his apartment five fake passports, mobile phones and two computers which contained information about bomb-making and jihadist groups.

“Everything suggests that the discovery of this cache avoided an act of extreme violence by a terrorist network,” the French prosecutor told a news conference.

Kriket, who was sentenced in absentia to 10 years in prison by a Belgian court last July for recruiting Islamist fighters for Syria, said in questioning by French investigators that he was not a terrorist but also gave up little information.