Rehman Malik, head of Pakistan's Interior Ministry, said six men were being held and criminal proceedings against them had begun. Two more suspects are known, but they remain at large, Reuters reported.
The attacks in Mumbai killed 164 people and heightened tensions between India and Pakistan.
India and the United States have urged Pakistan to crack down on Lashkar-e-Taiba, a Pakistan-based militant group widely thought to have perpetrated the three-day assault.
India contends that all 10 gunmen -- only one of whom was captured alive -- were Pakistanis and that their handlers in Pakistan had kept in touch with them by cell phone during the attacks.
Malik said investigators had traced a boat engine used by the attackers to travel to India to a shop in the southern port city of Karachi. The shopkeeper then provided the phone number of the buyer, which led to a bank account in the name of Hammad Amin Sadiq, the Associated Press reported.
According to Malik, authorities arrested Sadiq and obtained information from him that led them to two hideouts used by the suspects, one in Karachi and another about two hours drive away.
Pakistani officials shared the findings of the investigation with India's High Commissioner Satyabrata Pal, and the Indian foreign ministry later issued a statement describing the Pakistani actions as a "positive development," according to Reuters.