Sri Lankan authorities have pointed the finger of blame at an obscure group, the National Thowheed Jamath (NTJ), for carrying out a series of coordinated bombings on Easter Sunday killing more than 350 people.
Police have arrested at least 76 people, including alleged NTJ members, in connection with the deadliest attacks in the South Asian island nation since the end of its civil war a decade ago.
Police suspect the NTJ of having international ties. The Islamic State of Iraq and the Levant (ISIL, also known as ISIS) group has claimed responsibility for the bombings.
But Sri Lankan authorities remain unsure of ISIL's involvement and have blamed breakaway members of the NTJ and another group, named the Jammiyathul Millathu Ibrahim (JMI).
Intelligence officials and Prime Minister Ranil Wickremesinghe believe that Mohamed Zahran or Zahran Hashim, a Tamil-speaking preacher from the east of the country, may have been the mastermind.
However, four days after the blasts and following several media briefings by the government officials, little is known about the NTJ.
When was NTJ formed?
The NTJ is believed to have been formed sometime around 2014 after breaking away from the larger Sri Lanka Thowheed Jamath (SLTJ), according to a report in The Hindu newspaper.
Based in Kattankudy, a Muslim-dominated town in eastern Sri Lanka, the NTJ, much like the SLTJ, is believed to have been strongly influenced by Wahhabism - the official religious doctrine in Saudi Arabia that calls for a strict and literal reading of the Quran and the Sunnah, the teachings of the Prophet Muhammad.
According to its Twitter account, which has a limited social media presence and hasn't been updated since March 2018, the NTJ would regularly organise talks and seminars, distribute videos and even arrange funeral prayers at mosques.
Glenn Carle, a former Deputy National Intelligence Officer for transnational threats at the CIA, said while little was known about NTJ's membership, its size was likely modest compared to the SLTJ.
Muslims make up only 9.7 percent of Sri Lanka's population, and Carle said the NTJ appeared to be "very small" in size.
"The group is reportedly led by an imam who has been trained or influenced by Wahhabism. However, its foreign ties are surmised and not known," Carle told Al Jazeera.
Last year, the Sri Lankan government was forced to declare a national state of emergency after the majority Sinhalese ethnic group attacked dozens of Muslim businesses, houses and a mosque in the central district of Kandy.
A young Muslim man was killed with his body found in a burnt-out building.
Months after the riots, the NTJ came to prominence in December when its followers were accused of attacking Buddhist statues in Kegalle district.
NTJ secretary Abdul Razik has been arrested several times on charges of inciting religious unrest.
Its predecessor group, the SLTJ, which is also relatively unknown, has spoken out against Buddhist hardliners for years.
In a statement on Thursday, the SLTJ "strongly condemned" reports that the Easter Sunday attackers were linked to the group.
"Sri Lanka Thowheed Jamath would like to point out that media outlets acting irresponsibly and erroneously linking [it to] terror bombings ... is absolutely false.
"Sri Lanka Thowheed Jamath has no connection whatsoever with the bombings and has no connection with the organisation suspected to have [been] involved in the incident," the SLTJ's general secretary MFM Faseeh said in a statement.
ISIL connection?
Investigators suspect the involvement of a band of nine, well-educated suicide bombers, including a woman, from well-to-do families in the bombings.
ISIL released a video late on Tuesday through its AMAQ news agency, showing eight men, all but one with their faces covered, standing under a black ISIL flag, declaring loyalty to its leader, Abu Bakr Al-Baghdadi.
The one man in the video with his face uncovered was Mohamed Zahran. While the video showed eight men, Sri Lanka's state minister of defence, Ruwan Wijewardene, said there were nine suicide bombers.
Eight had been identified and one of them was a woman, he said.
"Most of the bombers are well-educated, come from economically strong families. Some of them went abroad for studies," Wijewardene told a news conference.
"One of them we know went to the UK, then went to Australia for a law degree. Foreign partners, including the UK, are helping us with those investigations."
Police sources say two Muslim brothers - sons of a wealthy Colombo spice trader - were among the perpetrators of the attacks.
They blew themselves up as guests queued for breakfast at the Shangri-La and Cinnamon Grand hotels in the capital, the source said.
The pair were key members of the NTJ, according to an investigating officer.
The ISIL statement on Tuesday said three fighters it named as Abu Obeidah, Abu Baraa and Abu Moukhtar were behind the attacks on the Shangri-La, Cinnamon Grand and Kingsbury hotels.
Three other fighters it named as Abu Hamza, Abu Khalil and Abu Mohammad carried out attacks on churches in the cities of Colombo, Negombo, and Batticaloa, it said.
The seventh man, Abu Abdallah, killed three police officers in an attack in a Colombo suburb, it said.
Early warning signs
A 2007 academic policy paper warned that violence by hardliner Muslims against Sufis in Sri Lanka might one day give rise to armed movements in parts of the country.
One reason why the warning signs may have been ignored is that the government's overwhelming focus has been on suppressing any revival of Tamil separatism.
Like other minorities, Muslims remained marginalised after the civil war between the Sinhalese Buddhist government and the mostly Hindu Tamil fighters ended in 2009.
Muslims in Sri Lanka, who are spread out geographically, never quite belonged to either side during the civil war.
Hundreds of Muslim youth were abducted and killed by Tamil rebels because of their Muslim identity.
There were largescale massacres in mosques in Kattankundy and Eravur, where more than 260 Muslims were killed in 1990. Muslims were also forced to flee northern towns, leaving thousands still displaced.
'Fast becoming a cancer'
If the attacks were carried out by a purely local Sri Lankan group, the attackers would have sought revenge against the Buddhist community for ultranationalist mob attacks on Muslims over the years and not churches or hotels, said Neil Devotta, a professor at Wake Forest University in North Carolina who has written extensively about Muslims in Sri Lanka.
Groups like the NTJ do not represent even one percent of the Muslim population in Sri Lanka, he said.
"What the moderate Muslims in Sri Lanka really fear is that these sorts of groups provide ammunition to Sinhalese Buddhist nationalists who tend to view Muslims and other minorities, but especially Muslims, in a very negative light to begin with," Devotta said. "This is not good for the Muslim community."
In 2014, a group called the "Peace Loving Moderate Muslims in Sri Lanka" published a statement in the local Daily Mirror newspaper denouncing NTJ and warning that it was "fast becoming a cancer" within Sri Lanka's Muslim community.
The statement warned that members of the group were making mosque attendance compulsory, forcing a strict implementation of Islamic law above Sri Lankan law and forcing women to cover their faces and wear long robes in place of traditional saris.
"It is tragic that the majority of Muslims who are essentially peace-loving are to pay for the actions of this minority," the statement said.
"We fear that these activities ... if left unchecked by the authorities, would create a situation in which the majority of Muslims in Sri Lanka, already under threat and harassment from this extremist minority, may have to face the wrath of other religions," the statement said.
