Peter Bergen is CNN's national security analyst, a vice president at New America and a professor of practice at Arizona State University. He is the author of "United States of Jihad: Investigating America's Homegrown Terrorists." The opinions expressed in this commentary are his own. View more opinion articles at CNN. The piece has been updated to reflect the latest news.

(CNN)It is one of the most lethal terrorist operations since September 11 -- with a death toll of at least 290 people. That number will almost certainly rise, given the hundreds that were also injured in the eight attacks at churches and hotels in Sri Lanka on Sunday.

What is puzzling about the attacks is that while Sri Lanka has seen plenty of terrorism in the past -- a result of the civil war between the separatist Tamil Tigers and the Sri Lankan government -- that war ended a decade ago. And the Tamil Tigers had notably focused their attacks on "transit hubs, Buddhist shrines, and office buildings ... and Sri Lankan officials," rather than churches, according to a Council on Foreign Relations report.

Sri Lankan Defense Minister Ruwan Wijewardene told reporters the "terrorist incident" was carried out by those following "religious extremism." While no group has claimed responsibility yet, the targets of the attacks -- churches packed with the faithful on Easter Sunday and three five-star hotels catering to foreigners -- have also figured in previous attacks.

In January of this year, ISIS claimed responsibility for an attack that killed at least 20 in a church in the Philippines. The attack also took place on a Sunday, when worshippers were gathered for mass. Then, last May, ISIS claimed responsibility for carrying out attacks at three churches in Indonesia, killing at least 12 people and injuring dozens more. And, in 2017, on Palm Sunday, ISIS killed at least 49 people gathered for Mass at two churches in Egypt.

But ISIS isn't the only Islamist group to operate this way. An offshoot of al Qaeda in Iraq killed 58 people at a church on a Sunday in the Iraqi capital Baghdad in 2010. Four years earlier, al Qaeda in Iraq attacked the Grand Hyatt, the Radisson SAS and Days Inn hotels in Amman, Jordan, killing 57. (For reference, ISIS has its roots in al Qaeda in Iraq.)

Then there's Pakistan-based Lashkar-e-Tayyiba, which carried out attacks in 2008 on two luxury hotels in Mumbai -- the Taj and the Oberoi -- that were part of a larger operation in which a total of 164 people were killed.

And Indonesia-based Jemaah Islamiyah carried out multiple attacks on churches in 2000, killing 17. They also attacked the JW Marriott and the Ritz-Carlton hotels in the Indonesian capital, Jakarta, in 2009, killing nine.

None of these groups has had much of a presence in Sri Lanka, though ISIS did try to recruit from the South Asian country. And, in 2016, a Sri Lankan official said that 32 Sri Lankans had joined the group.

CNN obtained a memo circulated by Sri Lankan police that warned on April 11 of a "suicidal attack by the leader of 'Nations Thawahid Jaman.'" It's not clear if this Islamist group carried out the attacks.

Of course, there are more questions than answers right now -- particularly surrounding who is behind the Sunday attacks. All we know now for sure is that a group of extremists killed almost 300 people on Sunday in one of the most deadly attacks the world has seen since 9/11.