The suspects were activated from sleeper cells in Tunisia, Security Minister Rafik Chelly said. He did not say which group activated them, or with whom they trained.
"They left the country illegally last December for Libya, and they were able to train with weapons there," he told private broadcaster AlHiwar Ettounsi TV.
Like Tunisia, Libya saw its longtime leader Moammar Gadhafi
ousted during the regional wave of revolutions known as the Arab Spring
. But unlike its neighbor to the west, Libya has been fraught with more instability and violence -- much of it perpetrated by Islamist militants, like those behind the 2012 Benghazi attack
that killed U.S. Ambassador Chris Stevens and three other Americans.
Such violence has been rare in Tunisia
, at least on the scale of what happened Wednesday at the Bardo Museum in Tunis. Still, it is not a total shock, given that up to 3,000 Tunisians have left to fight as jihadists in Iraq and Syria, according to the International Centre for the Study of Radicalization in London, not to mention others who have joined radical groups closer to home.
Already, authorities have arrested nine people in connection with the attack, including four directly linked to it, according to a statement from Tunisian President Beji Caid Essebsi.
And in an audio message posted online Thursday, ISIS
claimed responsibility for the attack, which it said targeted "crusaders and apostates" with "automatic weapons and hand grenades." CNN cannot independently verify the legitimacy of the audio statement.
That bloodshed is "just the start," the ISIS message warned -- a threat that may or may not be hollow, but nonetheless adds extra urgency for Tunisian investigators.
The nation's security forces are working to break up other cells like those behind the recent Bardo Museum attack. But that's not necessarily going to be fast or easy.
"We know they can launch operations, but we must piece together clues in order to conduct an arrest," Chelly said.
Independence day takes on special meaning
As investigators continued their work, Tunisians turned out Friday to mark the North African nation's independence from France.
Those commemorations were more somber this year, but they were also in many ways more significant.
"I'm here to celebrate 59 years of our independence," said Adib Adela, 38, a school inspector in Tunis. "The most important thing now is to properly investigate and to find those responsible."
Tunisia has been shaken by the terrorist attack, though it was foreigners -- 19 of them tourists who'd been on two cruise ships that docked in Tunis -- who made up the vast majority of victims.
Fifteen victims' bodies are at a morgue in the capital, a forensic official said. Some of them haven't been identified two days after the attack, according to the official, and all are foreigners.
The fear is that many other tourists won't come back. Already, the parent companies of the two ships that had most of the victims, Costa Cruises and MSC Cruises, have announced the cancellation of all scheduled stops in Tunis for 2015 and substituted them with other ports.
That means some foreigners won't be coming to Tunisia as once expected. But it doesn't mean all tourists will stay away -- as illustrated by a movement online of people vowing, "I will come to Tunisia
Beyond tourism, Tunisians also hope to get support from other countries as they fight terrorism.
"I hope other countries will support Tunisia, like they supported France after Charlie Hebdo
," said Amir Foudieli, 33, who works for an export company, referring to the January massacre at the satirical magazine's offices in Paris.
"We are Tunisian, this is our country. Not theirs, they (the terrorists) are bastards of children. We have centuries of history."