Soon after Russian planes began dropping bombs on Islamic militants in Syria a month ago, in an effort to prop up the country’s embattled dictator Bashar al-Assad, ISIS vowed that Russia, and by extension its citizens, would be a target. Last Saturday, Russian Metrojet Flight 9268 departed Sharm el-Sheikh, Egypt, and flew directly over the homebase of an ISIS affiliate with the ambition, and perhaps the capability, to make good on that threat.

The growing fears that an explosive device may have brought down the airplane, killing all 224 on board, stems in part from the rise of the ISIS affiliate in the northern part of the Sinai peninsula.

Over the past four years, the self-proclaimed Islamic State’s branch in Egypt’s Sinai peninsula has grown into a formidable threat. It “is one of the group’s most active and potent ISIL affiliates,” a U.S. counterterrorism official told The Daily Beast, using an alternative acronym for the group.

The branch, which calls itself the Islamic State of the Sinai, or Wilayat al Sinai, has twice claimed responsibility for taking down the Russian airliner, most recently on Wednesday. But it hasn’t offered any of ISIS’ trademark evidence, such as martyr statements or videos of the plane crashing. Rather, the group said essentially: “Trust us, we did it.” And that only added to the mystery about how the plane came down.

U.S. officials said this week that some intelligence points to ISIS or its affiliate in Sinai as having detonated bomb on the Russian airliner, though the Obama administration has yet to publicly make that claim, and scant evidence has been put forward.

If Wilayat al Sinai turned its sights on foreign citizens, it would mark a significant evolution in ISIS’ regional strategy, from gobbling up territory to launching attacks on civilians beyond its holdouts in Iraq and Syria. It would also stand as one of the deadliest attack by a terror group since 9/11, and the first successful attack since then against civilian aviation.

“The group has waged a long-standing insurgency against Egyptian authorities,” the U.S. official said, emphasizing that he wasn’t commenting on the cause of the Russian Metrojet crash.

Wilayat al Sinai evolved from an indigenous terror group that joined forces with self-proclaimed caliphate and has expanded its campaign of attacks beyond Egyptian authorities towards international targets. The group may still have a focus that’s close to home.

“Terrorist groups are often focused on local grievances, which helps extremists present themselves as defenders of their communities and develop grassroots support,” the official said. “While ISIL Sinai uses the ISIL moniker, it wouldn’t be surprising if future attacks by the group feature a mix of targets to satisfy their focus on targeting the Egyptian government, while also heeding ISIL leadership calls to strike enemies of the so-called caliphate.”

It’s not clear if the group has developed the capability to smuggle a bomb aboard a plane. But it knows how to move weapons.

“The Sinai is well-known for illicit smuggling and ISIL Sinai has been able to acquire and use a range of weapons,” the official said. “As an ISIL affiliate, the group could also draw on the resources and expertise of other ISIL affiliates and supporters in the region.”

To be sure, Egyptian authorities have yet to draw any conclusions about who was responsible for the jet downing, if indeed it was not the result of an accident or some catastrophic mechanical failure.

But British Prime Minister David Cameron, on the eve of a state visit by Egyptian President Abdel Fattah el Sissi, suspended all flights from the Sinai amid growing reports that a bomb may have brought down the flight.

On Thursday, Cameron, defending his decision, said it was “more likely than not a terrorist bomb” was responsible. The same day, Germany’s Lufthansa and Turkish airlines followed suit and suspended flights. France and Belgium urged all but essential travel to the Sinai.

Sissi declined to criticize the decision while he was in London but other members of his government did not hold back. “I greatly regret the British government’s decision to halt flights,” Hisham Zaazou, Egypt’s tourist minister, told The Daily Beast on Thursday, “It seems to have been hasty and I do not understand the logic behind it.”

The ISIS Sinai branch’s operations have so far been limited to northern Sinai. It has failed to carry out sustained attacks in other parts of Egypt. A turn to Sharm el-Sheikh, in the south, would mark a significant shift in the group’s reach.

Egypt has long sought to assure the international community that the instability of the post Arab Spring period had not reached it southern oasis. Sharm el Sheikh may be technically a part of Egypt, but was always insulated from the political instability.

As it turns out, there were cracks in the southern fortress. Government workers complained of not getting paid, and if the British tourist accounts are true, the collapse of the government’s grip over the country had reached the airport there.

On Friday, British tourists stranded in the resort city after the U.K. halted all flights to and from Sharm el-Shiekh airport complained about airport security personnel playing computer games and not properly checking luggage upon their arrival.

Just 10 months ago, British officials visited the airport amid concerns about its security. Approximately 20,000 U.K. residents travel through the airport each year.On Thursday, London announced that flights from Sharm to the U.K. would resume on Friday, but that passengers will only be able to carry hand baggage and must transport luggage meant for the cargo hold separately. Flights from the U.K. to Sharm are still suspended, officials announced, following an intense day of meetings with Egyptian authorities.

Wilayat al Sinai represents an evolution of terrorism in the restive Sinai that ran parallel with Egypt’s Arab Spring. The group was born out of a group in the immediate aftermath of the 2011 uprising and was dedicated to attacking neighboring Israel.

In 2012, a new more powerful group emerged called Ansar bit al Maqdis, and it targeted Egyptian soldiers patrolling the area. During Egyptian President Mohammed Morsi’s one-year tenure, which ended in June 30, 2013, the group was relatively quiet.

But after Morsi’s ouster at the hands of the military, the group changed its focus, aiming almost exclusively at military raids in the Sinai and attacks on local police. It claimed responsibility for the killing of a top security officer as well as the beheading of scores of soldiers.

Experts believe the group was losing its ability to attack soldiers around November 2014 when it pledged its allegiance to the Islamic State and became Wilayat al Sinai. With that change, its focus no longer became just striking inside Egypt, but across the region. Members of the group traveled to Syria and brought back tactica they learned there to the Sinai.

More sophisticated weapons emerged in the region as well but its relationship with the Islamic State remained opaque. It was not making major land grabs as ISIS has done it other parts of the region.

Still, the terror group took on a new international tenor. It claimed responsibility for a rocket attack on an Egyptian ship in July of this year.

The following month, the group released a video showing the beheading of a Croatian worker, kidnapped in Cairo.

A month later, four U.S. troops and two Fijian peacekeepers serving in the long standing Multinational Force and Observers mission were injured in a bomb blast. By the fall, northern Sinai had become a no-go zone for even residents there, and many were forced to move to the city of Arish, about an hour from the Israeli border. Egyptian forces conducted several destructive attacks on northern Sinai in an effort to reclaim control, but their efforts were ultimately ineffective.