MADRID—The explosion came minutes before midnight in a squat on the edge of the little Spanish town of Alcanar on the coast south of Barcelona, but even in the dark, and miles away, people could see the mushroom-shaped cloud as flames lit up the sky. This was a massive bomb made of conventional material, but a weapon of mass destruction nonetheless. That it only killed the people making it was a stroke of luck.

But as more is learned about the jihadi cell involved, concerns are growing about the extent of the networks to which they may be linked. The Moroccan bomb maker, a self-styled imam named Abdelbaki Es Satty, 42, had connections to vast hashish smuggling operations in Europe as well as groups with long histories of violent extremism.

Indeed, his group appears to be a classic example of what influential French criminologist Alain Bauer has warned about for years, a “hybrid threat” that is “part common criminal and part political.” And when organized crime meets organized terror, that threat is only more intense.

Es Satty previously was imprisoned for smuggling hash and his contacts range from Morocco to Belgium. He, or other members of his cell, also paid a quick visit to the outskirts of Paris a few days before they planned to carry out attacks in Spain. Es Satty may have been in contact with other groups with more bomb factories and still undetected jihadi cells. According to one report in Spain, he had learned his skills in France.

Such is the level of concern that a rock concert by a band from California in Rotterdam, The Netherlands, was canceled on Wednesday night after authorities received a tip from Spain that it might be a target.

Most of the group building the bombs in Alcanar, or waiting to use them, actually lived in the little town of Ripoll, and had planned to hit symbols of Christianity, first among them Antoni Gaudí’s wondrous basilica La Sagrada Familia in Barcelona, where thousands of tourists as well as the Catholic faithful might have been targeted.

But after the mushroom cloud rose over Alcanar, with their middle-aged bomb-maker dead and one of their number, a survivor of the blast, in police custody, the young terrorist recruits in the cell changed their plans.

Over the next 26 hours, during the afternoon and night of Aug. 17, they wrought as much mayhem as they could.

One would drive a white panel truck (a Fiat Talento) almost half a mile through pedestrians and café-goers on Las Ramblas in the tourist heart of the Catalan capital, killing 13 men, women, and children, and injuring scores more from 34 countries.

The driver, Younis Abouyaaqoub, then jumped out and disappeared into La Boqueiría, a densely crowded indoor market with several exits. He hjiacked a car and stabbed the owner to death, ran a police roadblock, and escaped, before finally being tracked down and shot four days later.

Another group of five who were crammed inside a little Audi hatchback mounted an attack along the waterfront in the seaside town of Cambrils, trying to run over pedestrians before crashing into a police car at a checkpoint and overturning. They scrambled out with knives and a hatchet and started slashing away at anyone nearby. One woman was killed and six injured. The five attackers were shot by the Catalan police, four of them dying at the scene and one in hospital.

All of the terrorists, Abouyaacoub as well, had worn the vests of suicide bombers but without explosives, leading to speculation that they wanted to be sure the police killed them in any confrontation, even though they no longer had the munitions to blow themselves up.

The level of improvisation is striking, especially given the lack of experience among most of the young recruits in the cell.

Anthropologist Scott Atran, who has spent years doing field research on jihadi networks, was staying near La Sagrada Familia and went to Las Ramblas the night of the attack. He has watched developments closely since then. What he and others are trying to determine is whether this was a tight-knit operation centrally directed by the ISIS external intelligence operation, known as the Amn al-Kharji or the Emni, or whether it is more improvisational.

“When ISIS ruled the roost in Raqqa and Mosul [the first now under siege, the other liberated] Emni told people to come to Syria, get training, go back [to their home countries] and do operations,” says Atran. “But they kept various networks as separate as they could under their control, so as not to compromises networks and groups in other places.

“Of course there was also the general directive that if you can’t come to Syria or Iraq, then do anything you can, anywhere, any way to hit basically indefensible soft targets to undermine people’s faith that their own government can fulfill its basic responsibility to provide citizens security, and to increase general suspicion against Muslims so that the hate generated will show them that trying to live in peace with infidels brings only pain,” says Atran. (This is very much in line with the analysis of “third generation” or 3G jihad ideology by Gilles Kepel and other influential scholars.)

It always has to be kept in mind that the terror organization is flexible and innovative.

“When ISIS and ISIS-inspired plots first started hatching in Europe, they were mostly one-off events and most failed,” says Atran. “But as ISIS began plugging into pre-existing local networks in neighborhoods, they became much more effective.

“Now Emni obviously has less ability to command operations,” says Atran, “and so the question is: Are these various networks hooking up themselves and doing their own planning?”

There is one particularly striking precedent with a direct connection to the Barcelona plot. It goes way back, before the schism in al Qaeda that created ISIS, and it suggests how deeply “sleeper” cells may become embedded.

The worst jihadi terror attack Europe has ever seen was the bombing of the Atocha commuter rail station in the heart of Madrid on March 11, 2004, when 192 people died. Some members of the cell had connections to an al Qaeda affiliate, the Moroccan Islamic Combatant Group, which carried out a stunning suicide attack on the Spanish cultural center in Casablanca the year before.

But at an operational level the Madrid bombers of 2004 had little or no outside support, improvising and organizing on their own. Their drug smuggling connections had given them the underworld contacts needed to buy stolen explosives from ordinary criminals: 35 kilos of hash for 200 kilos of dynamite.

This sort of transaction is another reason European authorities are so concerned right now. The Alcanar bomb may have been homemade from volatile components, but an entire military grade arsenal, including plastic explosives and grenades, was stolen recently in Portugal, and even if that was the work of criminals with no interest in violent jihad, they may want to trade for jihad-network money or drugs.

The Madrid attack in 2004 was not a suicide attack, although several members of the cell were hunted down and blew themselves up while under siege.

Others survived and one Madrid plotter who was arrested and imprisoned was Rachid Aglif, a Moroccan resident in Spain who was known as “El Conejo,” The Rabbit, because of his elongated face and prominent front teeth. He and the central figure in the Ripoll cell that carried out the Aug. 17 attacks, Abdelbaki Es Satty, did four years together in Spain’s Castellón prison after Es Satty was convicted of hashish smuggling in 2011.

The narrative that emerged soon after Es Satty’s prison record came to light suggested he was not religious before he went to jail, and may have been radicalized by The Rabbit. As a self-styled imam he even led the prayers for Muslim inmates. Somewhere Es Satty also thought he learned to make bombs. According to one investigative report in Spain, he traveled to France “on several occasions to take a course from one of the ‘dinamizadores’ of the Islamic State in the use of arms and the manufacture of explosives.” Apparently he did not learn well enough. He had to be identified by DNA from pieces of his body.

On Friday, a report by the conservative Barcelona daily ABC shows Es Satty’s ties to jihadist circles go back much farther than previously documented in the press: Already in 2005 Spanish police had tapped his phone because of his suspected involvement with the Moroccan Islamic Combatant Group and the Moroccan version of Ansar al Islam.

At the time, the court order approving the tap noted that Es Satty’s role was mainly logistical, including contacts with forgers for falsified documents helping people move through Spain to Syria and Iraq, where the jihadi war was on against American troops on the ground.

The taps eventually were lifted and even after Es Satty’s jail term he was allowed to stay in Spain as a man supposedly fully integrated into the community. But soon after he got out of prison he went straight to the Belgian city of Vilvoorde near the Brussels airport. It had been known as a center of jihadist activity at least since 2011 when a network there was helping funnel people to Syria.

Local authorities in Vilvoorde say they questioned the Spanish government about Es Satty’s possible terrorist ties in 2016 and the Spanish supposedly said he posed no danger. But the Spanish National Police and Guardia Civil deny this.

Es Satty reportedly caused problems at one of the mosques in Vilvoorde, where he wanted to take over. He was expelled, as it happens, just before the March 2016 bombing of the Brussels airport, but so far no connection has been established between him and the network that carried that out, which was directly tied to the group that committed the atrocities in Paris in November 2015.

Es Satty went back to Spain, to Ripoll, where he started building the cell that went into action on Aug. 17, after he blew himself to bits the night before.