COLOMBO • The devastating Easter Sunday bombings in Sri Lanka were retaliation for attacks on mosques in New Zealand, a Sri Lankan official said yesterday, as the Islamic State in Iraq and Syria (ISIS) claimed responsibility for the coordinated blasts that killed at least 321 people.

"The security apparatus is of the view that there are foreign links and there is evidence that points to that," Sri Lankan Prime Minister Ranil Wickremesinghe said at a press conference yesterday evening.

"We will be following up on the claim by IS - there were some suspicions that there were links with IS," he said, using another acronym for militant group ISIS.

Mr Mujibur Rahman, a Sri Lankan MP, said police have informed lawmakers that "eight or nine others linked to this ring" involved in the attacks were still at large and were being sought.

Mr Wickremesinghe corroborated that, telling reporters that some people linked to the bomb plot are on the run and could be armed.

Police have been given emergency powers to detain and question suspects without a court order. Such powers were used extensively during Sri Lanka's civil war, but have not been employed since 2011.

It was also announced that schools and universities would be closed, at least until next Monday, and masses at churches were cancelled until further notice.

The country has been on edge, with three bomb scares, including one at the United States Embassy, taking place in the last 24 hours.

Police have been instructed to look out for five motorbikes, a cab and a van suspected of carrying more explosives.

"Those who carried out the attack that targeted citizens belonging to the alliance countries and Christians in Sri Lanka are fighters with the Islamic State (in Iraq and Syria)," according to a statement on ISIS news agency Amaq that was reported by the Site Intelligence Group, which tracks extremist activity online.

Site Intelligence said on Monday that an unidentified ISIS supporter distributed photos of three alleged "commandos" involved in the Sri Lanka attacks.

It said the photos were posted in pro-ISIS chat rooms and the men, pictured holding weapons in front of ISIS banners, were described as "among the commando brothers in Sri Lanka".

Separately, police sources said two Muslim brothers - sons of a wealthy Colombo spice trader - were among the perpetrators of the attacks. They blew themselves up as guests queued for breakfast at the Shangri-La and Cinnamon Grand hotels in the capital, said the sources.

The militant group's claim came after Sri Lanka's State Minister of Defence Ruwan Wijewardene told Parliament yesterday that initial investigations had revealed that Sunday's explosions were executed by local extremist group National Thowheeth Jama'ath (NTJ) in retaliation for the Christchurch attacks in New Zealand last month.

A Sri Lankan security official characterised NTJ as being a shell for ISIS and said it has been active in Kattankudy, an area in the eastern part of the country and home to one of its largest Muslim populations.

The group's leadership is believed to be based there, said the official, adding that there could be additional explosives or potential suicide bombers.

Mr Wijewardene also said attention was now focused on a second extremist group known as Jamaat-ul-Mujahideen. Little is known about the group, other than reports that it was established last year and is affiliated to a similarly named group in Bangladesh.

So far, only Sri Lankan citizens have been taken in for questioning, said Mr Wickremesinghe, noting that some may have travelled abroad and returned.

But three government and military sources told Reuters yesterday that Sri Lankan police were holding a Syrian national in custody for questioning over the attacks. "He was arrested after interrogation of local suspects," a source said.

Over 40 suspects are in custody, national police spokesman Ruwan Gunasekera said yesterday.

Interpol and the US' Federal Bureau of Investigation have joined the probe into the blasts.

Earlier in the day, Sri Lankan President Maithripala Sirisena said in a statement: "The intelligence agencies have reported that there were international organisations behind these acts of local terrorists. Hence, it has been decided to seek international assistance for investigations."

Yesterday, the victims of the blasts were remembered throughout the country with three minutes of silence that started at 8.30am, the exact time when the first of six bombs were detonated on Sunday.

WASHINGTON POST, BLOOMBERG, AGENCE FRANCE-PRESSE, REUTERS