Suicide bombers attacked three churches and three hotels, killing at least 290 people and wounding more than 500. Police have detained more than 20 people in their investigation, including several Indian and Pakistani citizens.
Some of the arrests took place at a large home in the Dematagoda neighbourhood of Colombo, Sri Lanka's capital. The home belongs to the family of the alleged leader of Thowheeth Jamaath, according to a police official.
The leader is believed to have died in a suicide attack on the Shangri-La Hotel in Colombo, according to investigators who were not authorised to speak to the media.
The FBI is assisting Sri Lankan officials with the investigation, according to a law enforcement official. In addition to providing technical investigative support to the case, the agency is also scouring intelligence databases to see whether there are any pieces of information that could help investigators reconstruct the plot, the official said.
A Sri Lankan security official said there could be additional explosives or potential suicide bombers authorities have not yet located.
"Right now, they are searching everywhere for possible bombs and people involved," said the official.
Thowheeth Jamaath, which the Sri Lankan security official characterised as a shell for Isis (Islamic State), has been active in Kattankudy, an area in the eastern part of the country and home to a large Muslim population, the official said. The group's leadership is believed to be based there, the official said.
Criticism of the government's failure to act on prior intelligence about the group and its plans grew.
Two government officials provided the Washington Post with a three-page report issued on April 11 in which a senior police official warned of potential suicide attacks by Thowheeth Jamaath against well-attended Catholic churches.
The group was "planning suicide attacks" that could target churches and also the Indian High Commission, Priyalal Dassanayake warned in the document.
Dassanayake, a deputy inspector general of police, identified at least five members of the group by name, including its alleged leader. He wrote that the authorities were monitoring their social media posts and possessed other intelligence, including information on their whereabouts.
The leader's social media posts did not reveal "clear evidence" of an intent to attack churches, Dassanayake wrote, but had called since 2016 for "nonbelievers" to be killed.
In a Facebook video of an older speech, reposted recently, the leader said there were three kinds of people - those who follow Islam, those who are friends of Islam and those who should be killed.
Dassanayake wrote that two members of the group went into hiding after several religious statues were vandalised late last year.
"Confidential investigations are continuing," he concluded.
A spokesman for Sri Lanka's police declined to comment on the report's contents.
In the days after April 11, the report circulated in parts of Sri Lanka's security establishment but was not raised before the Cabinet.
Mujibur Rahman, a member of Sri Lanka's Parliament, said his security personnel were aware of the report before the attacks. He said the report was based on information provided by Indian intelligence agencies.
The report has become a weapon in the bitter rivalry between Sri Lanka's President and Prime Minister, who represent separate parties.
The President, Maithripala Sirisena, also serves as the Minister of Defence. Allies of the Prime Minister, Ranil Wickremesinghe, say the handling of the report was a major national security blunder.
Others said the Sri Lankan Government had done too little. Hilmy Ahamed, vice-president of the Muslim Council of Sri Lanka, said he gave intelligence officials details on extremists in the community, including those featuring in the current investigation, three years ago.
"I personally have gone and handed over all the documents three years ago, giving names and details of all these people," Ahamed said. "They have sat on it. That's the tragedy."
