The U.S. ambassador to Sri Lanka, Alaina Teplitz, said more attacks may be in the planning stages. “We certainly have reason to believe that the active attack group has not been fully rendered inactive,” Teplitz said in an interview with the Reuters news agency. “We do believe that there is active planning underway.”

The bombings on April 21, Easter Sunday, targeted worshipers at three churches, in Negombo, Batticaloa and the capital, Colombo, as well as tourists at three luxury hotels in Colombo. More than 250 people were killed.

Sri Lankan officials said a splinter faction of a local Islamist extremist group called National Thowheed Jamaath was behind the attacks. The Islamic State also asserted responsibility and released a video showing the attackers pledging loyalty to the group.

AD

AD

In a separate video released Monday, the Islamic State’s leader, Abu Bakr al-Baghdadi, said the bombings in Sri Lanka were “part of the revenge” that his group would take on the West after the loss of its self-proclaimed caliphate in Syria and Iraq. The video marked Baghdadi’s first such appearance in five years.

Investigators are working to determine how a group of previously unknown Sri Lankans pulled together the coordinated attacks and whether the perpetrators received assistance from abroad.

Authorities believe that some Sri Lankans who went to fight for the Islamic State in 2014 returned and created networks that led to the plot, said Shiral Lakthilaka, an adviser to Sri Lanka’s president. “They are the people who planted this seed,” Lakthilaka said.

AD

The alleged mastermind of the attack, Islamist preacher Zahran Hashim, also spent time in the nearby south Indian state of Tamil Nadu, Lakthilaka said. Hashim died carrying out a suicide attack at Colombo’s Shangri-La Hotel.

AD

In India, law enforcement authorities arrested a man they alleged was plotting a suicide attack in the southern state of Kerala. Authorities said the 29-year-old had followed Hashim’s radical sermons, which were posted online, for more than a year.

Some of Hashim’s speeches were uploaded from India, said Hilmy Ahamed, vice president of the Muslim Council of Sri Lanka, which was tracking the preacher’s activities. Ahamed said the council had repeatedly warned Sri Lanka’s intelligence agencies about hate speech by Hashim, most recently in December, but was told he could not be located.

Despite the warnings that further attacks are possible, signs of normalcy were returning. On Tuesday, the government lifted a nationwide social media ban that was imposed after the bombings to help fight the spread of misinformation on sites and apps such as Facebook, YouTube, Instagram and WhatsApp. In a statement released Tuesday, President Maithripala Sirisena asked the public to act “in a responsible manner” when using such technology.

AD

AD

Police have arrested scores of people they suspect of having links to the bombings. On Friday, as security forces approached a suspected safe house in the eastern town of Sainthamaruthu, explosions and a shootout left 15 people dead, including six children. During the raid, the father and two brothers of Hashim were killed, and police rescued his injured wife and daughter.

Sri Lanka has been in a heightened state of alert since the Easter Sunday attacks. Meanwhile, the government’s failure to prevent the bombings — despite having received specific intelligence warnings — has sparked a political crisis.

A power struggle involving Sirisena, Prime Minister Ranil Wickremesinghe and opposition leader Mahinda Rajapaksa has been cited as a major contributor to the government’s poor response to the intelligence.