A previously little-known group called the National Thowheed Jamath (NTJ) is being accused of having carried out the Easter Sunday attacks in Sri Lanka.
Sri Lankan officials pinned the blame on the NTJ at a news conference on Monday.
However, the NTJ has not admitted carrying out the wave of bombings which tore through the island, killing at least 321 people.
On Tuesday, the Islamic State (IS) group said its militants had carried out the attacks. It did not provide any details.
The IS claim should be treated cautiously. The group usually claims an attack very soon afterwards, publishing pictures of those who carried it out on its media portal, Amaq.
But still, the allegation raises the question, what is the NTJ?
Until Monday, when the Sri Lankan government spokesman mentioned its name, very few people had heard of the NTJ.
The group is believed to have splintered off from another hardline Islamist group in the country, the Sri Lanka Thowheed Jamath (SLTJ).
While still relatively unknown, the SLTJ is a bit more established. Its secretary, Abdul Razik, was arrested in 2016 for inciting hatred against Buddhists. He later issued an apology.
More on the Sri Lanka attacks:
Some reports have also linked the NTJ to a spate of vandalism last December that targeted Buddhist temples in Mawanella, central Sri Lanka. The faces of Buddha statues that were on display outside the temples were attacked.
But the NTJ is an extremist fringe group within an already small religious minority – only 9.7% of Sri Lanka’s population of about 21 million are Muslim.
Its social media presence is sparse, too. Although it has a Facebook page, it is only updated every few weeks or so. The NTJ Twitter feed hasn’t updated since March 2018.
The group’s website is also offline – although it’s not clear if it was taken down before or after Sunday’s attacks.
Links to the attacks
Government spokesman Rajitha Senaratne told reporters in Colombo on Monday that there had been “several warnings from foreign intelligence agencies about the impending attacks”.
This isn’t the only claim that officials had been alerted.
Sri Lankan Telecommunications Minister Harin Fernando tweeted a document that was reportedly sent by Sri Lanka’s police chief earlier this month.
That document explicitly names the NTJ – as well as a warning that the group was planning to attack churches and the Indian High Commission.
The document also names Mohamed Zahran, the group’s leader.
Alan Keenan, Sri Lanka director for the International Crisis Group think tank, also told BBC 5Live that the NTJ “appears to be the same group” as those behind the Mawanella vandalism.
He added: “The police eventually arrested a group of young men who were said to have been the students of a preacher who’s named in the intelligence document that came out yesterday [Sunday].”
But given how small NTJ are, officials suspect that it wasn’t acting alone.
“We don’t see that only a small organisation in this country can do all that,” Mr Senaratne said. “We are now investigating the international support for them, and their other links, how they produced the suicide bombers here, and how they produced bombs like this.”
And while not naming the NTJ directly, the Sri Lankan president’s office echoed this belief that whichever group was behind the attacks had help from abroad.
“The intelligence sections have reported that there are international terror groups which are behind the local terrorists,” a statement from President Maithripala Sirisena said. “International assistance will be sought to combat them.”