Attack suspect Mohamed Soliman, 45, was in the country illegally after his tourist visa expired in 2023, officials said.