German officials are weighing up how to react to what is being treated as the first attack with a jihadist motive by an asylum seeker on German soil, who prosecutors suggested may have decided to carry out the attack just days earlier.

A 17-year-old Afghan armed with an axe and a knife attacked passengers on a regional train in northern Bavaria on Monday evening, seriously injuring four Chinese tourists before being shot dead by police.

Prosecutors said on Tuesday that two of the injured were suffering from “acute life-threatening” wounds.

The attack had been carried out with an “Islamist religious motive”, a spokesperson for the state office of criminal investigations said. A hand-painted Islamic State flag had been found in the teenager’s room at his foster home, as well as a college book with a text written in Pashtun.

Lothar Köhler, the director of the Bavarian investigations office, said he understood the text to be a farewell letter to the teenager’s father, in which he complained about “nonbelievers”. In one key passage, he wrote: “Now pray for me that I can take revenge on these nonbelievers, and pray for me, that I make my way into heaven.”

On an emergency phone call made by one of the train’s passengers and recorded by her partner’s answerphone, the young man is said to be heard shouting “Allahu Akbar” as he carried out the attack.

The teenager had found out on Friday or Saturday that a close friend of his had died in Afghanistan, Köhler said – an event that may have played a role in his radicalisation. Witnesses said the 17-year-old had spent a lot of time on the phone after being informed of his friend’s death. A mobile phone that the attacker discarded while on the run has since been recovered.

The Bavarian interior minister, Joachim Herrmann, said the notebook entry was a strong indicator that the teenager “could be a person who had been self-radicalised”. At the same time, Herrmann said, there was no evidence that the attack had been organised or coordinated directly by Isis. “There are currently no indicators of the young man being part of the Islamist militia’s network.”

Isis moved quickly to take responsibility for the attack, releasing a statement via its online news agency, Amaq, which said: “The perpetrator of the stabbing attack in Germany was one of the fighters of the Islamic State and carried out the operation in answer to the calls to target the countries of the coalition fighting the Islamic State.”

Amaq later released a video that purported to show the attacker, in which a young man waves a knife towards the camera and says: “I will slaughter you with this knife and will behead you with axes.” Herrmann told Bayerischer Rundfunk TV that he believed the video clip released by Isis to be real and showing the man who carried out the attack.

A still from a video released by the Isis news agency Amaq purporting to show the Afghan teenager who attacked passengers on a train in Germany. Photograph: -/AFP/Getty Images

The teenager had been based in southern Germany since 30 June 2015, and only moved two weeks ago into a foster home in Ochsenfurt, close to the city of Würzburg, where the attack took place. The young man had received a temporary residence permit earlier in the year.

Directors of the refugee shelter in Ochsenfurt where the 17-year-old had been staying expressed their shock and grief at the news: “We’ve never had any form of incident here,” the website of news weekly Der Spiegel quoted a coordinator as saying. “People treat each other peacefully here, that’s why we are shocked and sad.”

About 250 refugees are stationed in Ochsenfurt, about 60 of whom are unattended minors. According to news agency DPA, the teenager had been on a work experience placement at a local bakery and been receiving support from the German social ministry’s youth welfare service.

The attack is seen as a wakeup call for Germany’s security and intelligence services, after the country appeared to have previously been able to avert attacks of the kind seen in Belgium and France.

Security services in Germany say that since 2001 they have managed to successfully avert 12 attempted terrorist attacks with an Islamist motive, by cooperating closely with local community leaders and security agencies in other countries.

Community support schemes aimed at deradicalising young jihadis by working closely with their families had been hailed as a success around Europe.

But the attack in Würzburg appears to be part of a growing trend towards “lone wolf” attacks by individuals who are radicalised suddenly.

German terrorist experts have drawn comparisons between Monday night’s attack and an incident in Hanover on 26 February, in which 15-year-old student Safia S stabbed a policeman in the neck during a routine ID check.

Security agencies in Germany were still investigating the student’s claims that she had been acting upon orders from Isis. Unlike the Afghan asylum seeker shot during Monday night’s incident, Safia S had been raised in Germany.

According to Daniel Köhler, the director of the German Institute on Radicalisation and De-Radicalisation Studies, “lone actor terrorists” pose “a new challenge that we are struggling to come to terms with”. When newly arrived unattended minors are radicalised over a short period, Köhler said, the security agency’s previous strategy was largely rendered redundant. “We are effectively starting at zero.”

“Over the last few years, counterterrorism strategy in Germany has focused massively on working with families to prevent radicalisation taking place,” Köhler said. “Preventing radicalisation amongst refugees, however, will require lots and lots of catching up.”

German charity Violence Prevention Network in April launched a project called Al Manara, which is aimed specifically at working with unaccompanied minors, a group it says are “particularly susceptible to recruitment drives on behalf of extremist salafists”. However, the project only exists on a very small scale and is active only in Berlin.

Herrmann appeared to implicitly criticise Angela Merkel’s strategy during the refugee crisis when he said that security agencies in his state were having to cope with the possibility of refugees entering the country under false motives, “a constellation that would have been unimaginable until recently”.

Herrmann is a member of Bavaria’s Christian Social Union, a sister party to Merkel’s Christian Democrats. His party’sleadership has emerged as one of the most vocal critics of the German government’s open-borders stance.

Renate Künast, a prominent member of the German Green party and former agriculture minister, earned criticism for a tweet in which she questioned why police had shot the teenager dead rather than merely incapacitating him.

Tragisch und wir hoffen für die Verletzten. Wieso konnte der Angreifer nicht angriffsunfähig geschossen werden???? Fragen! #Würzburg @SZ — Renate Künast (@RenateKuenast) July 18, 2016

“When police forces are attacked in such a way, they will hardly go for kung fu,” said Rainer Wendt, head of the German police union. “Regrettably that sometimes results in the death of the culprit, but that’s hard to change.”

Wendt said it was fine for state prosecutors to investigate if police officers acted in accordance with their guidelines, “but we really don’t need parliamentarian smart-arses to do that”.