ISIS isn't dead. It's just moving to countries like Sri Lanka

Want the best from VICE News in your inbox? Sign up here.

Sri Lanka’s government confounded terrorism experts when they pinned the blame for Sunday’s terror attacks, which killed more than 300 people, on a little-known and disorganized extremist group: National Tawheed Jamath.

On Tuesday, the Islamic State group offered some clarity, claiming responsibility for the attack. Through Amaq, ISIS’s propaganda arm, the terror group distributed photos and videos of eight militants allegedly responsible for the attacks, and even provided aliases for some of them. The group said the men were "fighters of the Islamic State."

Though ISIS’s claim has yet to be corroborated by intelligence officials, it gives credence to what many experts have suspected since Sunday’s horrific events: the string of bombings was too complex for a local group with little history of deadly attacks to pull off on its own and likely required the involvement of a foreign organization.

“It seems too sophisticated — all the bombs went off when they were supposed to — there’s got to be a broader network at play here,” said Colin P. Clarke, Senior Research Fellow at The Soufan Center and author of the book “After the Caliphate.”

The targets of Sunday's attack — churches and hotels typically frequented by Christians and tourists — also fits the group's M.O., experts said, and draws parallels with a 2016 attack on a bakery in Bangladesh.

“The pattern of attacking Westerners, that is Western tourists and churches, is a common pattern here of ISIS,” said Robert Pape, a professor at the University of Chicago and director of the Chicago Project on Security and Threats.

While the Islamic State has been defeated militarily and deprived of territory in Syria and Iraq, experts say the group remains a threat and still has the capacity to support acts of terror elsewhere. It may be more motivated to do so, especially in the near-term as the group struggles to remain relevant.

And if indeed ISIS’s claim proves credible, then Sunday’s attack portends what experts say may become a common model for them going forward.

“What we’re likely to see in this post territorial caliphate stage is ISIS as a network, lending logistics support and militant infrastructure to local groups to carry out these attacks,” Clarke said. “Where are we likely to see it? Exactly in the types of places that Sri Lanka is, it’s not a failed state, but it’s a weak state and it’s also a state that’s suffered from three decades of civil war and ethnic violence, so it’s a country awash with weaponry, explosives and ammunition.”

Bruce Hoffman, a Visiting Senior Fellow for Counterterrorism and Homeland Security at the Council on Foreign Relations, wrote in the Cipher Brief Tuesday that recent activity by the group in Afghanistan, Saudi Arabia and the Democratic Republic of Congo gives cause for concern.

“ISIS is unbowed by its battlefield defeats and the loss of its caliphate,” Hoffman writes. “Instead, as ISIS’s recent appearance in the Democratic Republic of the Congo demonstrates, the group’s continued vitality and intention to opportunistically continue to prosecute its terrorist campaigns and expansion of its malignant ideology to whatever venues are available is evident.”

“Sunday’s horrific attacks on churches and hotels in Sri Lanka may prove to be another manifestation of this opportunism,” Hoffman adds.

The timing of Sunday’s attacks also raises alarm bells, as it comes within weeks of Ramadan, the holy month of fasting that the group has perversely used as a time for increased attacks.

Sri Lankan investigators are still determining the origins of the attack, but the evidence thus far hasn’t painted a positive picture for the country’s security forces. The Sri Lankan government was previously warned that Islamic terrorists were planning to attack churches earlier this month, according to the New York Times.

On Tuesday, CNN reported that Indian authorities passed specific intelligence to Sri Lanka about an impending attack after interrogating a man who claimed to have trained one of the bombers in Sri Lanka and is connected to one of the groups implicated in the bombings. The man, Zahran Hashim, was identified in a video of the purported attackers released Tuesday by ISIS.

Authorities have arrested at least 40 people in connection to Sunday’s attacks — all local Sri Lankans, said Prime Minister Ranil Wickremesinghe Tuesday.

Terrorism watchers said they’re now paying close attention to see whether or not foreign fighters were involved.

“Now that ISIS has been rolled back as a territorial entity, many of those fighters are going out of Iraq and Syria. Many are going back to their original homes,” said Pape at the University of Chicago. “We dismantled a gigantic terrorist training camp that had 20,000 to 30,000 fighters, half of whom came from countries around the world, and now we don’t know where they are.”

Cover: Sri Lankan President Maithripala Sirisena (2nd L) visits the St. Sebastian Church after the multiple terror attacks in Negombo, Sri Lanka on April 23 , 2019. (Photo by The Presidential Office of Sri Lanka / Handout/Anadolu Agency/Getty Images)