Police also said they had arrested the group's second-in-command.
They said investigators had determined that the assailants' military training was provided by someone they called "Army Mohideen", and that weapons training had taken place overseas and at some locations in Sri Lanka's eastern province.
Police also said the attackers had worked out at a local gym and by playing football. They said the vehicles used in the attack were bought at a car dealership in Kadawatha, a suburb of Colombo, the capital.
The warning of possible additional attacks came from the national police inspector general's office, which circulated a letter to other police agencies saying that the same groups that carried out the Easter blasts had threatened to attack mosques where Muslim religious leaders are buried. The letter, a copy of which was obtained by the Washington Post, said the threat should be addressed with urgent measures.
Prime Minister Ranil Wickremesinghe warned that some suspects linked to Sunday's attacks remained at large and "may go out for a suicide attack".
Amid outrage over government failures to act on warnings of possible terrorist attacks around Easter, Defence Secretary Hemasiri Fernando stepped down from his post after Sri Lanka's President demanded his resignation. The national police inspector general, Pujith Jayasundara, had already resigned.
National Thowfeek Jamaath has been active in the eastern region of Kattankudy, home to a large Muslim population. Isis (Islamic State) asserted responsibility for the attack, and video emerged this week of the suspected ringleader of the attack pledging allegiance to Isis and its leader, Abu Bakr al-Baghdadi.
Security forces in Colombo cordoned off and searched the country's central bank and several office buildings. They also searched the luxurious suburban home of a Muslim spice trader whose two sons were among the suicide bombers.
Police officials and a former navy chief told media outlets that the merchant, a prominent business leader named Y.M. Ibrahim, had been arrested on charges of aiding his sons in the attacks.
Many shops and restaurants remained closed in Colombo, where a night-time curfew stayed in effect, and in the nearby seaside city of Negombo, where the deadliest bombing took place. Church officials in Negombo have held about 75 funerals and burials since Monday, but formal religious ceremonies there have now been paused for security reasons. One church official said he had been told that police were still searching for suspects in the area.
M.H. Abdul Halim, the country's senior Muslim government official, called on all Muslims to "avoid gathering" for congregational prayers yesterday and instead to remain at home and "pray for the peace and security of the motherland". Halim, the federal Minister of Postal services and Muslim Affairs, said he was acting "in solidarity" with the Catholic Church and "in protest the barbaric acts" of the bombers.
Many Muslims have expressed fears of being blamed for the bombings and targeted for reprisal attacks, and streets and shops in Muslim communities in both cities have been deserted and on edge. Some people said they were worried about security conditions during Ramadan, the Muslim month of fasting and prayer, which will begin in early May. "I can't go to work, I can't go to shop, I don't want to leave the neighbourhood. I'm even afraid to go to the mosque," said Mohammad Rahmatullah, 62, in Negombo.
- additional reporting AP
