High school student Farhad Jabar was recruited by a group of western Sydney extremists to carry out a terrorist attack because they thought they were under too much surveillance to do it themselves, police believe.
CCTV from Parramatta Mosque, now in the hands of police, shows several men meeting Jabar at the mosque on Friday, hours before the quiet year 10 student walked to the Parramatta police headquarters and shot accountant Curtis Cheng, 58, in the back of the head.
On Wednesday, police raided homes across Sydney and arrested four men as part of their investigation into the brutal execution on Friday.
Police believe Jabar acquired an older-style handgun at the mosque that afternoon and put it in his Nike backpack.
A Middle Eastern crime gang is being investigated in relation to supplying the gun used by Jabar.
Police raided a home in Merrylands on Wednesday that had been investigated for firearms supply earlier this year.
Talal Alameddine, a known criminal on firearms charges, was detained at the home but it's not believed he sourced the gun.
He was also not part of the group that met Jabar at the mosque.
Jabar, who recently started going by the name Abu Zaid on social media, also wrote a chilling note on Friday afternoon, found in his backpack dumped near the scene. Among the ramblings, described by one source as mostly "jibberish", the note said: "blood will run into the streets" and "know your security means nothing to us". The handwriting has been confirmed as Jabar's, Fairfax Media has been told.
As part of their investigation into Mr Cheng's murder, police raided homes in Merrylands, Guildford, Wentworthville and Marsfield on Wednesday and arrested five men.
A man from north-west Sydney, two teenagers aged 16 and 18 from Wentworthville and Mr Alameddine were arrested. Mr Alameddine's brother, Rafat, was also arrested on outstanding fraud warrants.
The man from the north-west and the teenagers from Wentworthville had previously been targeted in sweeping Operation Appleby counter-terrorism raids in September 2014 but they were not arrested at the time.
A source said they were considered "peripheral" players to the plot at the centre of the Appleby raids – an alleged phone call between Guildford man Omarjan Azari, 23, and Islamic State recruiter Mohammed Ali Baryalei, about beheading a random person on the streets of Sydney.
Two of Mr Azari's brothers were targeted in the raid in Guildford on Wednesday but they were not arrested.
The men targeted in Operation Appleby last year met at Parramatta Mosque often and operated a group called the Shura, an Arabic term for consultation.
The men have been under heavy surveillance since last year, leading them to look elsewhere in their efforts to carry out a terrorist attack, Fairfax Media understands.
"Some of them might have been wanting to do an attack but were concerned. They've managed to radicalise a poor vulnerable person to do it instead," a police source said. "It's almost like they've groomed him like paedophiles to do something for them."
Jabar was a quiet, cheerful student who vigilantly attended the mosque but was not considered extremist and was not on any police radar before Friday.
Fellow students told Fairfax Media he never spoke openly about religion and was more concerned with playing basketball and joking around. It was only a few weeks ago that he was drawn into the extremist circle by the 16-year-old Wentworthville boy, one of Jabar's year 10 classmates at Arthur Phillip High School.
The pair regularly attended the same sessions at Parramatta Mosque and school lunchtime prayer groups.
The 16-year-old, who cannot be named, was charged last year for driving past a Christian school in Harris Park, yelling death threats and waving an Islamic State flag.
His Facebook page reveals odd connections with extremist preachers in Canada, Sydney and Lebanon.
The men made sure they only communicated with Jabar at the mosque and not through social media, Fairfax has been told.
Deputy Commissioner Catherine Burn did not rule out further arrests and said it was an "unfortunate reality" that undetected lone wolves will continue to launch attacks on home soil.
Australian Federal Police Acting Deputy Commissioner Neil Gaughan said authorities were in "an unprecedented time of operational tempo".
"The threat level remains high and that means a terrorist attack is likely. That's not going to change in the foreseeable future," he said.
Mr Gaughan also revealed that Jabar's sister, Shadi, left Australia without warning last week.
He said Turkish police had been notified and they were attempting to find her.
NOTE: An earlier version of this story was changed for legal reasons
