"There were for certain three terrorists," Essebsi said. "There is one on the run. He will not get far."
Previously two suspects had been identified -- Yassine Labidi and Saber Khachnaou -- though it wasn't immediately clear if they were the pair killed at the museum by Tunisian security forces.
He said Yassine was "known to the security services, he was flagged and monitored," but not known or being followed for anything special.
Authorities have arrested nine people in connection with the attack, including four directly linked to it, according to Essebsi.
The development came a day after the bodies of four Italian tourists slain in the attack arrived back in Italy, an official with the Tunis Crisis Center told CNN, but 14 victims' remains still lie in the morgue.
Most of the 23 victims were foreigners
, making the process of identification more complicated. Nineteen of them were tourists who'd been on two cruise ships that docked in Tunis.
French, Spanish, Italian, British, Japanese, Russian and Colombian citizens are among those to have been formally identified so far.
The bodies of the Italians were met in Rome by Italian Prime Minister Matteo Renzi, who paid his respects to the victims and their families in a brief ceremony.
Eleven people who were injured in the attack remained in the hospital in Tunisia on Saturday, the official at the Tunis Crisis Center said.
Suspected gunman's uncle: He wasn't extreme
An uncle of Yassine Labidi, Abeld Malik Labidi, told CNN on Friday that no one he knew had seen any signs of extremism in his 26-year-old nephew.
But he said Yassine Labidi was one of the two gunmen killed at the museum.
"It's true that Yassine carried out this terrorist attack, he was killed; his head, his body, we don't have it back," he said.
But, he said, he believed Yassine and other young Tunisians like him were also victims of terrorism -- of the recruiters who paid them money, organized the logistics and took them to places like Syria and Libya to train as fighters.
He had known his nephew well, he said. "After the revolution of 2011 he started to pray, before he would drink beers from time to time, like a young Tunisian. He wasn't extreme in any way."
The only thing that raised questions was that Yassine had disappeared for about a month, he said. Although his nephew said he'd gone to the Tunisian city of Sfax to work, his family now suspected he had been in Libya because of the phone numbers he called from.
"When he came back his behavior was the same: he was still himself, calm, serious. Nobody noticed anything, even the neighbors I spoke to," said Abeld Malik Labidi.
"He said hello to everyone, he prayed, he took his coffee, even on the day of the attack he took his coffee with his family and went to work."
Family 'shocked' by events
Abeld Malik Labidi said Yassine's father, sister and brother had undergone lengthy interrogations by anti-terror police since the attack. Officers had seized his nephew's computer and phone, as well as taking samples of his fingerprints, he said.
A cousin of Yassine, who asked not to be named, told CNN that the family was shocked by what had happened.
"We are all shocked, we lost someone even if what he did was wrong, may God forgive him. Those he killed were innocent, why would you go and harm Australians or Japanese ... our Islam doesn't mention about killing people, Islam has never been this," he said.
He also said he had no idea how his cousin had been radicalized, saying he was "a normal Tunisian guy ... but not an extremist."
Security Minister Rafik Chelly said on Friday that the two extremists who attacked the museum got weapons training at camps in Libya
. The suspects were activated from sleeper cells in Tunisia, he said. He did not say which group activated them, or with whom they trained.
"They left the country illegally last December for Libya, and they were able to train with weapons there," he told private broadcaster AlHiwar Ettounsi TV.
Like Tunisia, Libya saw its longtime leader Moammar Gadhafi
ousted during the regional wave of revolutions known as the Arab Spring
. But unlike its neighbor to the west, Libya has been fraught with more instability and violence -- much of it perpetrated by Islamist militants.
ISIS claims responsibility
In an audio message posted online Thursday, ISIS
claimed responsibility for Wednesday's attack, which it said targeted "crusaders and apostates"
with "automatic weapons and hand grenades." CNN cannot independently verify the legitimacy of the audio statement.
That bloodshed is "just the start," the ISIS message warned -- a threat that may or may not be hollow, but nonetheless adds extra urgency for Tunisian investigators.