PESHAWAR: A First Information Report (FIR) was registered on Thursday against the four unidentified militants who attacked Charsadda's Bacha Khan University, killing 20 people and injuring at least a dozen others.

Read: New year unleashes fresh wave of violence

An injured university employee, Muhammad Fayyaz, expired this morning in the Neurosurgery Intensive Care Unit at Peshawar's Lady Reading Hospital ─ where two others wounded in the attack remain in critical condition. The death toll now stands at 21.

The FIR lodged was lodged on behalf of the Counter-Terrorism Department (CTD) by Station House Officer Irfanullah of the Serdheri police station in CTD Mardan under sections 7 and 15AA of the Anti-Terrorism Act.

Search operations in Charsadda are ongoing as police comb the area around the university. Several suspects have been arrested.

Explore: Charsadda attack: Students in the line of fire — again

During initial investigations, four grenades, 16 magazines and 240 cartridges were recovered from the site of the attack, CTD sources said.

Several schools were closed last weekend after intelligence suggested militants were planning an attack, according to Muhammad Amir Rana, director of the private Pakistan Institute for Peace Studies. A Khyber Pakhtunkhwa government spokesman said they were closed as part of a security drill.

Fazle ur-Rahim Marwat, the university's vice chancellor, said security forces alone could not keep students safe, saying it required a move away from an extreme interpretation of Islam.

After the Peshawar attack, the government promised to set up a joint Intelligence Directorate, but that has not happened yet.

“The government is trying to develop a response but is facing capacity issues,” Rana said, particularly in the area of intelligence-sharing among the powerful intelligence agencies and the police.

Rana, whose institute tracks militant movement, said the divisions in the Taliban over who carried out Wednesday's attack probably has more to do with a fear of retribution than a reflection of a deeply divided Taliban.

The backlash that followed APS attack was so severe that it probably left the Taliban “reluctant to take credit", he added, noting that Afghan security forces joined in operations against Pakistani Taliban hideouts afterward.

In a press conference after the attack, Pakistan military spokesman Lt. Gen Asim Bajwa stated the attackers carried mobile phones with Afghan numbers and “were in touch with their handlers in Afghanistan.”

He added that the militants hate education because it is a symbol of progress.

Pakistan maintains that its militants often find refuge in Afghanistan.

Know more: Breakthroughs made in identifying Bacha Khan University attackers: DG ISPR

Civil society and politicians expressed solidarity with attack victims by organising protests and vigils across the country.

Unidentified gunmen entered Bacha Khan University on Wednesday and opened fire on students and faculty members as they gathered at the school for a poetry recital to commemorate the death anniversary of the activist and leader whom the school is named after.

The co-ed Bacha Khan University in Charsadda was named for a prominent secular activist and ally of Mahatma Gandhi, and embodied much of what the extremists revile.

The attack coincided with the anniversary of Khan's death in 1988. Although Khan hailed from the religiously conservative northwest, he was a secular leftist sympathetic to communism, and an outspoken opponent of an earlier generation of jihadis.

The mastermind of the Army Public School Peshawar attack, Umar Mansoor of the banned Tehreek-i-Taliban Pakistan (TTP) Geedar group, claimed responsibility for the attack.

The breakaway Taliban faction that claimed Wednesday's attack called the university “an instrument of the government and army,” without elaborating.

Read more: Will Pakistan see more school attacks?