One of the Paris suicide attackers may have had an accomplice with him as he travelled through the Balkans to western Europe after entering Greece posing as a Syrian refugee, counter-intelligence and police sources say.
The assailant may also have reached Paris faster and more easily than expected because asylum seekers were rushed across some national borders at the height of the migration crisis in Europe this year to avoid bottlenecks after Hungary closed its borders, ironically to keep out suspected militants.
The man, who blew himself up near the Stade de France stadium in Friday's attacks that killed 129 people, has been identified from a Syrian passport found near his body as 25-year-old Ahmad al-Mohammad from the northwestern city of Idlib.
The passport could be false or stolen but its holder was registered as arriving alongside 198 refugees by boat from Turkey on Oct. 3 in Leros, a small picturesque Greek island.
French authorities have said the fingerprints of the attacker who blew himself up matched those of the man who landed on Leros.
Greek officials said on Sunday that Mohammad seemed not to be travelling with anyone specific, despite arriving with others. But a counter-intelligence source in Former Yugoslav Republic of Macedonia (FYROM), one of the countries he passed through, spoke of a "massive investigation in the Balkans about the route of two of the terrorists."
The source, who declined to be named, indicated to Reuters that FYROM was coordinating its action with Greece, and that a companion was with Mohammad by the time they bought ferry tickets taking them to Piraeus on the Greek mainland.
A Leros travel agent said that on Oct. 4 he issued two tickets costing 51.50 euros ($54.90) each to the men for a ferry departing the following night from the nearby island of Kalymnos, which is reached from Leros by a local service. The 23:10 sailing reached Piraeus on the morning of Oct. 6.
The owner of the Kastis travel agency in Leros, 42-year-old Dimitris Kastis, remembers selling tickets to Mohammad and a man who was with him. "He didn't do or say anything that caught my attention," Kastis said, adding that both men had paid in cash. He said the man travelling with him had a similar surname.
Greek media have published a photograph of the second man's ticket which gives his family name as al-Mahmod, and the initial of his given name as M.
Kastis said he recognised this as the name the second man provided when purchasing the ticket.
A Croatian police official, who declined to be named, also told Reuters that an investigation was under way into Mohammed's journey which was focusing on whether he was travelling with anyone and, if so, with whom.
In Leros, Mohammad was registered as required under European Union rules, with his fingerprints recorded in a European database known as Eurodac. Because his passport looked authentic and there was no police record on him, he was given a permit allowing him to stay in Greece for six months.
A copy of Mohammad's permit was distributed to journalists by Immigration Minister Yannis Mouzalas. Written in Greek only, it states that its holder should not leave the city of Corinth for the whole period without alerting police.
But within days, Mohammad had gone at least as far as Croatia.
The counter-intelligence source in FYROM said Mohammad was still travelling with a companion two days after reaching Piraeus. They registered together at a refugee camp in the backyard of an old tobacco plant in the Serbian town of Presevo, though Serbian officials have not mentioned an accomplice.
Mohammad then went on to Croatia, either by train or bus, and was registered on Oct. 8 at the Opatovac refugee camp.
Reuters has been unable to determine what route Mohammad took after this, or whether he was accompanied by anyone.
Croatian police said he almost certainly left for Hungary within 24 hours, though Budapest has no record of him entering from Croatia, which at the time was offloading thousands of migrants every day across its northern border with Hungary.
Mohammad's most likely destination from Hungary would have been Austria. In early October migrants were being sent in trains with locked doors to Hegyeshalom on the Austrian border, where Reuters journalists said they were ushered into the country without having their documents checked.
Austrian Interior Ministry spokesman Karl-Heinz Grundboeck said it was "conjecture and speculation" that a man going by the name of al-Mohammad had passed through Austria which, like France, is part of the EU's Schengen zone where routine internal border controls have been removed.
But Vienna has confirmed that another of the attackers, Belgian-born Frenchman Salah Abdeslam, entered Austria from Germany on Sept. 9.
Hungarian government spokesman Zoltan Kovacs told reporters on Tuesday that Budapest had no information as to whether Mohammad traversed Hungary. At that time Hungary was not registering migrants because Croatia had already done so.
Both countries are EU members but, unlike Croatia, Hungary is in the Schengen zone and had sealed its frontier with Serbia to migrants on Sept. 15.
This forced the migrants into Croatia, which infuriated Hungarian Prime Minister Viktor Orban by busing them north across its own border with Hungary, in many cases without checks.
Orban's tough stance
The irony of an Islamist militant moving quickly through the Balkans into western Europe and the heart of the 28-nation EU will not be lost on Hungary, where Orban based his tough stance on the flow of migrants on concerns that many were immigrants rather than refugees fleeing poverty or war, and that some could be "terrorists".
The issue is also sensitive in Germany, where Chancellor Angela Merkel has been criticised for her welcoming policy on refugees.
And some far-right and populist leaders have seized on the possibility that any of the eight Paris attackers reached Western Europe by posing as a migrant, using it to step up their anti-immigration message.
Any security lapses are also a potential embarrassment for the countries Mohammad passed through, but authorities say the influx of migrants in recent months has made it almost impossible for them to keep out would-be attackers.
"We take fingerprints, but how do we check them? Against which database? If there's nothing on that person in the information we received or if he's not wanted by Interpol he can go … He could be a shaven Osama Bin Laden for all we know," said a senior Serbian law enforcement official, speaking on condition of anonymity.