Initially, Malaysian police said they suspected Friday’s incident was linked to the hardline group Jemaah Islamiyah (JI) and was probably an attempt to steal weapons. Speaking to the media after the attack in the town of Ulu Tiram, Inspector General of Police Razarudin Husain said police raided the suspect’s house and discovered “JI-related paraphernalia”.

Five members of his family were arrested, including the suspect’s 62-year-old father, who police said was a “known JI member”. Two other people, who were in the police station making a report at the time of the attack in the early hours of Friday morning, were also detained.

But on Saturday, Malaysia’s Minister of Home Affairs Saifuddin Nasution Ismail appeared to backtrack on the JI connection, describing the attacker as a “lone wolf” who was “driven by certain motivations based on his own understanding because he rarely mixed with others”.

Former members of JI in Indonesia told Al Jazeera that an attack by the group on Malaysian soil seemed unlikely.

Speaking from prison in Indonesia’s capital Jakarta, where he is serving a life sentence for his role in JI’s 2002 Bali bombing, which killed more than 200 people, Ali Imron told Al Jazeera that JI’s profile in Malaysia did not seem to fit the police station attack.

“There have never been any JI members in Malaysia who agreed to commit acts of violence like this,” he said. “Before the Bali bombing, there were attacks in Malaysia, but these were committed not by JI but Kumpulan Mujahidin Malaysia [KMM].”

KMM, a hardline group linked to JI, carried out small-scale attacks in Malaysia in the early 2000s.

Rueben Dass, a senior analyst at the S Rajaratnam School of International Studies in Singapore, noted that JI had never previously mounted attacks in Malaysia.

“Malaysia was always considered an economic region for JI, not the focus of attacks,” he told Al Jazeera. “The Malaysian authorities were always vigilant and aware, particularly after KMM became active. They have been on their toes and carried out a wave of arrests in the early 2000s of JI members.”

Since then, he said, JI had maintained a low profile.

“To see them coming up again is a little surprising,” he added.

Indonesia, which saw a spate of JI attacks in the late 1990s and early 2000s – including attacks on churches on Christmas Eve 2000, the Bali bombings and the 2003 attack on Jakarta’s JW Marriott Hotel – has also been largely successful in clamping down.

In 2003, with funding and training from the United States and Australia, it established the Counterterrorism Special Detachment 88 (Densus 88), and later set up a National Counterterrorism Agency (BNPT).

Indonesian authorities have also pioneered a range of deradicalisation programmes, using former members of hardline groups including JI, with recidivism rates at about 11 percent, according to the Institute for Policy Analysis of Conflict, a Jakarta-based think tank.

History of JI

JI was founded by Indonesian Muslim scholar Abu Bakar Bashir and Abdullah Sungkar in 1993, with a mission to establish an Islamic caliphate across Southeast Asia.

The group has historically been linked to al-Qaeda, from which it reportedly received funding and training in the 1990s and early 2000s. It has had members in Indonesia, Malaysia, Singapore, Cambodia and the Philippines.

JI was officially banned in Indonesia in 2007, leading to the group splintering. Some members focused on dakwah or proselytisation, while others continued to plot violent attacks. Arrests have continued across the region with members accused of stockpiling weapons and bomb-making equipment.

According to open source data, between 2021 and 2023, out of 610 people arrested In Indonesia, 42 percent were JI and 39 percent were from other hardline groups – including Jamaah Ansharut Daulah (JAD) and other pro-Islamic State groups.

The majority of JI senior figures have been either executed, shot dead in police raids or jailed.

Both Bashir and Sungkar lived in Malaysia in the 1980s and 1990s, in addition to senior members such as Indonesian Encep Nurjaman (alias Hambali) and Malaysians Noordin Mohammed Top and Azahari Husin. Ali Ghufron (alias Mukhlas), Amrozi bin Nurhasyim and Imam Samudra, the masterminds of the Bali bombing, also spent time in Malaysia.

Hambali was arrested in Thailand in 2003 and is currently awaiting trial at Guantanamo Bay in Cuba, while Samudra, Amrozi and Mukhlas were executed in 2008. The two Malaysians were shot in separate police raids in Indonesia in 2005 and 2009.

Before his death, Noordin ran the Luqmanul Hakiem Islamic boarding school in Malaysia, which was founded by Bashir and Sungkar and was in Ulu Tiram, close to the home of the suspect of Friday’s attack.

Malaysia closed the school in 2002 amid suspicions it was being used to recruit people to JI.

Style of attack

While the profile of the suspect’s father, and the proximity to Luqmanul Hakiem, might have suggested a JI connection, Imron cautioned against such an analysis.

“If the son followed his father, there is no way he would have committed this act, so there is a strong possibility that he was inspired by ISIS [ISIL],” Imron said, suggesting the Malaysian authorities had “jumped to that conclusion.”

Umar Patek, who was released from prison in 2022 after serving 11 years of a 20-year sentence for mixing some of the chemicals used in the Bali Bombing, told Al Jazeera that he “did not believe” that the attacker was a member of JI and agreed that the attack appeared to have the hallmarks of another group.

“I am very doubtful,” he said. “I don’t understand it, especially carrying out a violent attack. It is impossible in my view that it was JI, but it is possible that it was ISIS.”

The style of the attack has added to the scepticism, as the targeting of a police station and Muslim police officers is inconsistent with JI’s attacks in Indonesia. There, it has been ISIL-inspired hardline groups, including JAD, that have attacked police stations, seeing them as representative of the state.

Judith Jacob, the head of Asia for the risk analysis and intelligence company Torchlight, told Al Jazeera that the most unusual aspect of Friday’s attack was the location.

“While Malaysian militants have been key figures in JI and Philippine-based groups, there are few indications of sophisticated plots targeting Malaysia specifically in recent years,” she said.

However, while Malaysia and Indonesia have not seen anything like the levels of violence of the early 2000s, attacks have not been completely eradicated – with a pattern of more opportunistic and low-level violence emerging.

“The attack in Malaysia remains squarely within the wheelhouse of regional Islamist militant groups – that is to say, it is a relatively unsophisticated assault,” Jacob said.

“Indonesian groups, in particular, have been largely unable to conduct the large-scale attacks or coordinated bombings that were a hallmark of JI in its heyday in the 2000s. Militant groups in the Philippines are more capable, but they too have been unable to conduct sophisticated bombings beyond the southern islands.”