Three churches and four hotels were hit by suicide bombers on Sunday in Sri Lanka.
The forces of the ISIS may no longer control a swath of territory across Iraq and Syria, but the coordinated attacks in Sri Lanka demonstrated that the resilient group can still sow carnage beyond the borders of its former caliphate.
Even a landless ISIS is influential, as a facilitator of attacks and an inspiration for its followers, including the ones who blew themselves up in churches and hotels on Easter morning, killing at least 321 people, terrorism experts said.
On Tuesday, video emerged of the suspected ringleader of the attacks and seven followers, their faces obscured by scarves, swearing allegiance to the ISIS and its leader, Abu Bakr al-Baghdadi. The ISIS also issued a formal communique claiming responsibility for the attacks, which it said targeted Christians and "coalition countries."
The statement embraced the suicide bombers as "brothers," identifying them by their presumed aliases and naming the churches and hotels each of them struck.
Sri Lankan officials are attributing the attacks to National Thowheed Jamaath, a local Islamist organisation, but the group has no history of significant terrorist attacks and was effectively unknown to US intelligence agencies, current and former US officials said.
Its most notable activity before Sunday was vandalising Buddhist temples, said Rita Katz, co-founder of SITE, a terrorism analysis organisation.
"However, ISIS generally has built its global network by recruiting from existing extremist groups around the world," she said.
US President Donald Trump has, on different occasions, declared the caliphate defeated and destroyed. US-backed forces took the last territory controlled by the ISIS - the Syrian village of Baghouz - in March. But even as the militants eyed the impending doom of the caliphate, they regrouped in the form of an insurgency and have maintained an active presence on social media, which has long been the ISIS' most productive recruitment ground.
US intelligence agencies have been tracking its recruitment efforts and how they might encompass Sri Lanka, current and former officials said. Of particular concern are the Sri Lankan men, about 40, who left their country to fight with the ISIS in Iraq and Syria, where they may have been exposed to the group's methods for bomb-making and coordinating attacks.
A Sri Lankan official, who spoke on the condition of anonymity because he was not authorised to speak publicly, said as early as 2017, the United States had warned Sri Lankan officials that the ISIS was recruiting across Southeast Asia and that Sri Lanka could become a "hub" for the group's activities.
There was no indication that the United States had advance warning about the Easter attacks, US officials said, also speaking on the condition of anonymity to discuss an ongoing investigation. Had the United States obtained information about an imminent strike, it would have been immediately shared with the Sri Lankans, current and former officials said.
Speaking to CNN, the US ambassador to Sri Lanka and Maldives, Alaina Teplitz, confirmed that the United States "had no prior knowledge of these attacks."
The ambassador noted that "the Sri Lankan government has admitted lapses in their intelligence gathering and information sharing."
Investigators are still trying to determine how the Sri Lankan attackers may have connected with the ISIS and what role the group could have played.
When local groups pledge fealty to the ISIS, it usually opens the door to an array of new resources and capabilities, Katz said. This would explain how individuals from a relatively amateur group like Thowheed Jamaath could contribute to an attack as devastating as that in Sri Lanka, she said.
Katz said she believes the ISIS was involved in planning the attack, but that its exact role is unclear.
"The Sri Lanka blasts were both sophisticated and well-coordinated, making it very likely that the attackers received some sort of training and assistance from ISIS - possibly from one of the group's bases in the Philippines or elsewhere in the region," she said.
"It is too early to tell the degree of involvement from ISIS - beyond inspiration and even embedding the jihadi DNA in local extremist groups," said Juan Zarate, the chairman of Financial Integrity Network, a consulting firm, and a former deputy national security adviser for counterterrorism in the George W. Bush administration.
"That said, we should not be too dismissive of ISIS claims or capabilities," he added. "I do think it is possible that ISIS has communicated directly or embedded with these local groups and found a way of helping plot, amplify and supercharge their capabilities and operational effectiveness on the ground. The ISIS diaspora and expertise is real, and ISIS has global designs - in South Asia and elsewhere."
Residents pray outside St Anthony's Church in Kochikade on April 23 in Colombo.
What the ISIS lost in territory it did not lose in ideological influence. "I don't think it's too soon to say that defeat of the physical caliphate in Iraq and Syria was never going to be the end of the ISIS challenge," said Nicholas Rasmussen, a former senior director for counterterrorism on the National Security Council who also ran the National Counterterrorism Center in the Obama and Trump administrations. "That is why many terrorism experts urged care and restraint on the administration in making claims about defeat of ISIS. The ideology underpinning the caliphate has reach far beyond Iraq and Syria."
Javed Ali, a former senior director for counterterrorism at the National Security Council in the Trump administration, noted the absence of the word "caliphate" from the ISIS claim of responsibility in the Sri Lankan attacks. That suggests that "even they will accede to the notion that the physical caliphate, at least in Iraq and Syria, is gone," said Ali, now a visiting professor at the University of Michigan. "But the notion of the Islamic State still exists. You don't need a physical caliphate to be beholden to the group."
Its influence has also spread to places where it hasn't traditionally held sway. Last week, through its Amaq News Agency, the group asserted responsibility for an attack in Congo for the first time.
For decades, parts of eastern Congo have been submerged in conflict, and a number of armed groups seeking to undermine the government have taken advantage of the chaos, launching attacks on civilian and military targets.
In a statement, John Manley, a spokesman for US Africa Command, said it now considers one of those groups, the Allied Democratic Forces (ADF), to have "meaningful ties to the Islamic State." The group claimed allegiance to the ISIS in 2017, Manley said.
A US official who works on the region said that the ties should be taken seriously, and that relationships between senior ADF leaders and foreign extremist groups go back decades.
"Not all of the ADF can be said to be part of ISIS, or even be jihadists," said the official, who was not authorized to speak publicly about the matter and spoke on the condition of anonymity. But "some have had contact [with foreign extremists] dating back years that included training and fighting abroad."
As Sri Lankans continued to mourn, government officials scrambled to determine how they had failed to detect cooperation between a local group, which was known to at least some Sri Lankan authorities, and outsiders.
Sri Lanka's president, Maithripala Sirisena, said in a televised address that police and security forces "would be restructured within a week" and that he expected to change the heads of all the security forces. The president acknowledged that the government had information about the local group since 2017 but said there was insufficient evidence to take legal action against its members.
India provided the Sri Lankans with specific warnings about threats, even naming the group and its ringleader, in the days before the attack, Sri Lankan officials said.
Men lay wreaths on top of graves at a mass burial site in Negombo, Sri Lanka.
Mahinda Rajapaksa, an opposition leader and Sri Lanka's former strongman president, ascribed the security failure to rivalries between the president and the prime minister.
"Don't take this as a joke," he said. "As long as the division between the president and the prime minister exists, you can't solve this problem. My security division knew about the advance notice [of the attack]; I did not."
While officials examined their own failures, some looked outside the country to help explain the bloody attacks.
State Minister of Defense Ruwan Wijewardene told Parliament that the bombings were carried out in retaliation for shootings that claimed 50 lives at two mosques in Christchurch, New Zealand, by an avowed white supremacist.
But others were skeptical of that connection.
"It is possible [that Sunday's attacks] could have been because of the Christchurch attacks," Prime Minister Ranil Wickremesinghe said at a news conference. "We cannot say yet."
"There seems to have been foreign involvement," he added. "Some may have traveled abroad and come back. . . . So far, it is only Sri Lankan citizens that have been taken in for questioning."
Plots of such complexity take many months to organise, and the Christchurch shootings occurred less than six weeks ago, Rasmussen noted. "It's also true that terrorist organizations are often opportunistic in the way that they claim justification or rationalization for their attacks, so it's possible that the minister's comments reflect something that is emerging in the investigation from talking to suspects linked to the perpetrators," he said.
The office of New Zealand Prime Minister Jacinda Ardern released a statement Tuesday: "We understand the Sri Lankan investigation into the attack is in its early stages. New Zealand has not yet seen any intelligence upon which such an assessment might be based."