The two gunmen who attacked foreign tourists at Tunisia's national museum trained in Libya, authorities say.
Tunisia says two gunmen who killed 21 people at its national museum trained at a militant camp in Libya.
The Islamic State group claimed Wednesday's attack on foreign tourists in Tunis, the deadliest since Tunisia's 2011 revolution which sparked the Arab Spring regional uprisings.
Australian-Colombian dual national Javier Cameloan, 28, and his Colombian mother were killed in the attack.
The assailants "left the country illegally last December for Libya and they were able to train with weapons there," Secretary of State for Security Rafik Chelly told Tunisian television on Friday.
IS, which includes hundreds of Tunisians in its ranks, threatened more attacks in an audio message claiming the massacre at the National Bardo Museum massacre.
Authorities say as many as 3000 Tunisians have gone to Iraq, Syria and Libya to join jihadist ranks, raising fears of returning battle-hardened militants plotting attacks.
Chelly named locations of several suspected training camps for Tunisians in violence-wracked Libya, including second city Benghazi and the jihadist stronghold of Derna.
President Beji Caid Essebsi's office said security forces arrested nine suspects - "four people directly linked to the (terrorist) operation and five suspected of having ties to the cell".
Amid international outrage over the attack on Tunisia - hailed as a rare success story of the Arab Spring - Essebsi was defiant.
"The process of implementing a democratic system is underway, well anchored," he told French television. "We will never move backwards."
Cameloan's father, a retired Colombian general, lamented the "irony" of losing his wife and Sydney-based son on holiday after spending his life "fighting terrorism" at home.
"Look at the irony of life, all my life I spent in the military fighting terrorism, combating terrorism, and now in a place totally remote from Colombia it takes my wife and son," Jose Arturo Camelo said, according to the Colombian president who called him.
Other victims included four Italians, three Japanese, three French, two Spaniards, a British woman, a Belgian woman and a Pole, health ministry officials said.
A Tunisian policeman killed in the attack was buried on Thursday.
The attack was a massive blow to Tunisia's economy, heavily tourism-dependent economy.
At least two major cruise ship operators suspended Tunis calls after the attack.
In Barcelona, hundreds disembarked from the MSC Splendida after their cruise was cut short.
Victoria Bronskaya, a tour guide from Belarus, recalled seeing two panic-stricken tourists gunned down as they tried to board the tour bus where she was cowering on the floor.
Their bodies blocked the way, perhaps saving her life because the "terrorist could not get on board".
Prime Minister Habib Essid named the two gunmen killed by security forces at the museum as Yassine Abidi and Hatem Khachnaoui, whose first name was later given as Jabeur by police in his home town.
Chelly said Abidi had been arrested before going to Libya, and that the pair had been "from sleeper cells".
Khachnaoui was described by a relative as a pious loner who never gave his parents a hard time.
He was said to have abruptly dropped out of high school months before graduation and gone to Libya, and there are suspicions he also went to Iraq.
Four of Khachnaoui's relatives have been arrested, the family and police said.
Abdelfattah Mourou, deputy speaker of parliament, told AFP that guards supposed to be protecting parliament and the museum were having coffee as the assault happened.
"I found out there were only four policemen on security duty around the parliament (compound), two of whom were at the cafe. The third was having a snack and the fourth hadn't turned up," Mourou said.