(CNN) London attack ringleader Khuram Butt was identified as a major potential threat, leading to an investigation that started in 2015, UK counterterrorism sources tell CNN.

British police and MI5 began investigating Butt intensively as part of a major drive to dismantle and destabilize al-Muhajiroun, a grouping of extremists in the UK supportive of ISIS, the sources told CNN.

Butt was seen as a heavyweight figure in al-Muhajiroun, whose hardline views made him potentially one of the most dangerous extremists in the UK, the sources said Tuesday. The investigation into Butt involved a "full package" of investigatory measures, the sources told CNN.

Among Butt's extremists contacts in the UK was a British al-Muhajiroun figure who helped organize training in Malakand, Pakistan, for some of those involved in a plot to bomb the UK in 2004 with fertilizer bombs and one of the 7/7 London bombers, according to the sources.

British counterterrorism officials moved more aggressively to take down al-Muhajiroun in 2014 after British extremists began to flock to Syria to join ISIS's newly declared caliphate. A significant proportion of the British foreign fighters reaching Syria had links to the group, according to the sources.

Police say Butt, 27, was one of three men who rammed a van into pedestrians on London Bridge before launching a stabbing spree in bars and restaurants at nearby Borough Market on Saturday night. All three were shot dead by police.

The assailants killed seven people and wounded 48 others.

Worries about an attack on British soil

After ISIS called for attacks in the West in September 2014, British security services grew increasingly concerned that al-Muhajiroun members who had remained in the UK would carry out terrorist attacks. One of those they were most concerned about was Butt, the sources said.

Al-Muhajiroun's roots in the UK date back to the 1990s, when it was founded by a Syrian cleric living in Tottenham named Omar Bakri Mohammed. When Bakri Mohammed was banned from the UK after the 2005 London bombings, Anjem Choudary, a British-Pakistani extremist with legal training, emerged as the group's leader in the UK.

In order to evade a series of bans by British authorities, al-Muhajiroun repeatedly changed its name, operating under a variety of guises including Shariah4UK and Muslims against Crusades. Despite openly whipping up support for al Qaeda and then ISIS amongst radical-leaning Muslims on the streets of London, Choudary's knowledge of British law allowed him to tailor his message to stay just on the right side of the law.

This made it difficult for British authorities to find grounds to charge him. Choudary's lieutenants, including Butt, were also careful in what they said in public and private.

The difficulty in building a case against al-Muhajiroun members was for years intensely frustrating to British counterterrorism officials, who were keenly aware of the effect proselytizers such as Choudary were having on a generation of young British Muslims, the sources told CNN.

Up to two-thirds of all terror plots involving UK nationals at home and overseas in the previous two decades had been linked to the group according to the sources, including the 2005 London bombings, the murder of British soldier Lee Rigby in east London in 2013 and a copycat plot in August 2014 to behead another British soldier in the capital.

Authorities scoured for any criminal behavior

Realizing a new strategy was necessary and increasingly worried by the growing threat from ISIS, British officials decided to take a zero tolerance approach to al-Muhajiroun. The new maxim was to take al-Muhajiroun members out of circulation by arresting them on whatever grounds could be found to get them off the streets.

One official involved in the effort described it as going after Al Capone for tax evasion. British counterrorrism investigators examined known supporters of ISIS to find even the smallest evidence of criminal behavior. These included traffic violations, minor fraud, and petty crime.

As part of the new proactive approach, police in London and other parts of the country arrested dozens of al-Muhajiroun members. Search warrants allowed them to search the premises and the computers of individuals British security services believed were potentially dangerous, as a result of information from their network of informants and the monitoring of social media.

In August 2015, British police arrested Choudary himself after the preacher slipped up by crossing the line and inciting support for a proscribed terrorist organization -- ISIS -- in lectures which were published online, as well as signing a document pledging allegiance to the group, also posted online. He was given a five-year prison sentence after a trial last year. Mohammed Rahman, another leading figure in the group, was charged and convicted of the same crimes.

Photos: London Bridge, nearby cafe target of terror attack Forensic officers work at the scene of a terror attack at London Bridge in London on Sunday, June 4. At least seven people were killed in attacks late Saturday as a van mowed down pedestrians on London Bridge before attackers then stabbed victims at nearby Borough Market. Hide Caption 1 of 26 Photos: London Bridge, nearby cafe target of terror attack Counterterrorism officers patrol near the scene of the attack on London Bridge. When speaking to the media on Sunday, British Prime Minister Theresa May did not announce any increase in the UK terror threat level. Hide Caption 2 of 26 Photos: London Bridge, nearby cafe target of terror attack A woman reacts after asking a Police officer to lay flowers near London Bridge as a tribute to the victims of the attack. Hide Caption 3 of 26 Photos: London Bridge, nearby cafe target of terror attack UK police officers on Sunday continue their investigation into the terror attacks on London Bridge and in a nearby restaurant district. The attacks on June 3 came days before a general election and two weeks after 22 people were killed when a suicide bomber targeted an Ariana Grande concert in Manchester. Hide Caption 4 of 26 Photos: London Bridge, nearby cafe target of terror attack Prime Minister Theresa May makes a statement at 10 Downing Street, following a Cobra security meeting in response to Saturday night's terror attack. Violence must "never be allowed to disrupt the democratic process," May said, adding that Thursday's general election will go ahead. Hide Caption 5 of 26 Photos: London Bridge, nearby cafe target of terror attack Abandoned buses line London Bridge as the scene remains under investigation following the attack. Metropolitan Police Assistant Commissioner Mark Rowley said in a statement Sunday that a white van struck pedestrians on London Bridge. Attackers then left the vehicle and "a number of people were stabbed, including an on-duty British Transport Police officer who was responding to the incident at London Bridge," said Rowley. The officer received serious but not life-threatening injuries. Hide Caption 6 of 26 Photos: London Bridge, nearby cafe target of terror attack Counter terrorism officers move up an escalator under The Shard, an iconic highrise near the scene of last night's London Bridge attack. Hide Caption 7 of 26 Photos: London Bridge, nearby cafe target of terror attack A group of police forensic officers walks in the street outside Borough Market. Hide Caption 8 of 26 Photos: London Bridge, nearby cafe target of terror attack People lie on the ground after being detained by police at Elizabeth Fry apartments in Barking, east London, which officers raided Sunday, June 4, following Saturday's terror attack at London Bridge and Borough Market. Hide Caption 9 of 26 Photos: London Bridge, nearby cafe target of terror attack A bouquet of flowers left near the police cordon at London Bridge on June 4. Hide Caption 10 of 26 Photos: London Bridge, nearby cafe target of terror attack A view from above shows where a van struck pedestrians on London Bridge -- and then crashed into a barrier. Hide Caption 11 of 26 Photos: London Bridge, nearby cafe target of terror attack This image, from London's Borough Market, shows two of the attackers after they were shot by London police. The attackers drove a white van into pedestrians on London Bridge, leaving bodies lying in the roadway, a witness to the incident told CNN Hide Caption 12 of 26 Photos: London Bridge, nearby cafe target of terror attack Armed police patrol near London Bridge on Saturday, June 3. Mayor Sadiq Khan said it was a "deliberate and cowardly attack" on Londoners enjoying Saturday night out. Hide Caption 13 of 26 Photos: London Bridge, nearby cafe target of terror attack The white van used in the attack is seen near London Bridge. Hide Caption 14 of 26 Photos: London Bridge, nearby cafe target of terror attack Police carry out a search near empty buses on London Bridge, Saturday, June 3. Hide Caption 15 of 26 Photos: London Bridge, nearby cafe target of terror attack A person is treated for injuries near London Bridge. Hide Caption 16 of 26 Photos: London Bridge, nearby cafe target of terror attack Members of the public flee after reports of the incident involving a vehicle and pedestrians. Hide Caption 17 of 26 Photos: London Bridge, nearby cafe target of terror attack Police and emergency responders attend to an injured person. Hide Caption 18 of 26 Photos: London Bridge, nearby cafe target of terror attack An armed Police officer gestures after the attack in central London. Hide Caption 19 of 26 Photos: London Bridge, nearby cafe target of terror attack Guests from the Premier Inn Bankside Hotel are evacuated following the attacks. Hide Caption 20 of 26 Photos: London Bridge, nearby cafe target of terror attack A woman wearing an emergency blanket talks on her phone at London Bridge train station. London Bridge Tube station was closed and London Bridge was closed in both directions. Hide Caption 21 of 26 Photos: London Bridge, nearby cafe target of terror attack Armed police raid The Blue Eyed Maid on Borough High Street. Hide Caption 22 of 26 Photos: London Bridge, nearby cafe target of terror attack Debris and abandoned cars remain at the scene of one of the incidents. Hide Caption 23 of 26 Photos: London Bridge, nearby cafe target of terror attack Police sniffer dogs are seen at London Bridge. Hide Caption 24 of 26 Photos: London Bridge, nearby cafe target of terror attack A helicopter flies near London Bridge. Hide Caption 25 of 26 Photos: London Bridge, nearby cafe target of terror attack People are led to safety on Southwark Bridge, away from London Bridge. Hide Caption 26 of 26

London attack may have been planned only recently

"These men have stayed just within the law for many years, but there is no one within the counterterrorism world that has any doubts of the influence that they have had, the hate they have spread and the people that they have encouraged to join terrorist organizations," Commander Dean Haydon, head of the Metropolitan police's counterterrorism command said after the Choudary and Rahman verdicts.

British investigators believe Butt was the dominant figure in the plot to attack London Bridge and Borough market, the sources told CNN

British officials have said there was no intelligence as a result of their investigations into Butt to suggest that he was planning an attack and the investigation had been "prioritized accordingly." British security services had no inkling he was planning to attack on Saturday night, the sources told CNN. Investigators now believe Butt and his two co-conspirators only spent two to three weeks planning the attack, the sources told CNN.

The sources also told CNN:

-- The reason armed police were so quick to react to the attack was a mobile field unit of armed officers happened to be positioned nearby.

-- Investigators now believe Manchester attacker Salman Abedi likely built the bomb he set off at Manchester Arena last month. Investigators believe that given the power and relative sophistication of his device he likely received bombmaking training at some point in Libya. Twenty-two people were killed and dozens more injured after Ariana Grande's concert.

-- British authorities are worried more extremists in the UK will try carry out attacks in the next few weeks because of ISIS' calls to surge attacks during the Muslim holy month of Ramadan.