Mohamed Sabry Soliman, 45, told investigators he wanted to "kill all Zionist people" but had delayed committing the attack in the city of Boulder until after his daughter had graduated from high school, according to state and federal court documents charging him with attempted murder, assault and a federal hate crime.
Police and FBI affidavits quoted the suspect as saying he had learned to shoot a gun in a class he took hoping to get a concealed-carry permit but ended up using Molotov cocktails because of his immigration status.
Soliman told investigators that he had learned how to make the fire bombs from YouTube.
Todd Lyons, acting director of US Immigration and Customs Enforcement, said Soliman had overstayed a tourist visa and had an expired work permit.
Trump administration officials immediately seized on Sunday's violence as an example of why they are cracking down on illegal immigration.
A police affidavit filed in support of Soliman's arrest warrant said he was born in Egypt, lived in Kuwait for 17 years and moved three years ago to Colorado Springs, about 60km south of Boulder, where he lived with his wife and five children.
"In light of yesterday's horrific attack, all terrorists, their family members, and terrorist sympathizers here on a visa should know that under the Trump administration we will find you, revoke your visa, and deport you," US Secretary of State Marco Rubio said on X.
According to the Boulder police affidavit, Soliman had planned for a year to carry out the attack, which unfolded on the Pearl Street Mall, a popular pedestrian shopping district near the University of Colorado.
The victims were taking part in an event drawing attention to the hostages seized in the aftermath of Hamas' 2023 attack on Israel.
Four additional victims were identified on Monday, bringing the number of injured to 12.
The attack was the latest act of violence aimed at Jewish Americans linked to outrage over Israel's escalating military offensive in Gaza. It followed the fatal shooting of two Israel Embassy aides that took place outside Washington's Capital Jewish Museum last month.
Authorities said they found 16 gasoline-filled Molotov cocktails near where the suspect was detained.
The federal affidavit references a video posted on social media during the attack showing Soliman "shirtless, pacing back and forth while holding what appear to be Molotov cocktails".
During a brief court appearance on Monday, Soliman appeared via a video feed from the Boulder County Jail.
Soliman's lawyer said she would reserve any arguments regarding his bond conditions until a future date.
The suspect faces a maximum sentence of life in prison if found guilty on the federal hate crime charge because he was also charged with attempted-murder charges in state court.
A Department of Homeland Security spokesperson previously said Soliman had entered the US in 2022 and filed for asylum the following month.
"The suspect, Mohamed Soliman, is illegally in our country," the spokesperson said.
"There are millions of individuals like this that we are attempting to locate from the past administration that weren't properly screened that were allowed in," Lyons, the acting ICE director, said during a press conference in Boston.
"I will tell you that's a huge effort for ICE right now." US President Donald Trump said in a social media post that such attacks would not be tolerated.
"This is yet another example of why we must keep our Borders SECURE, and deport Illegal, Anti-American Radicals from our Homeland," he said.
