The gunman has been identified by authorities as Ayoub El Khazzani, 25, a Moroccan national who is said to have been living on the streets in the Belgian capital, Brussels.
He is believed to have boarded the France-bound Thalys train in Brussels, armed with a Kalashnikov assault rifle, a Luger pistol and a box cutter.
French authorities said it is clear he was planning a massacre, and Belgian authorities said he had ties to known hard line Islamist groups.
According to French sources, El Khazzani was the subject of a "Fiche S," or "S notice," signaling to intelligence communities across Europe that a person merits special surveillance.
It was that notice, reportedly started because of El Khazzani's connection to radical mosques in Spain, which brought attention to his trip from Berlin to Istanbul in May.
It's not known if he also traveled to Syria in an attempt to join ISIS, but a senior European official said he may have been linked to a cell of French ISIS Fighters in Turkey.
The same cell is thought to have plotted a foiled attack against a church
in the Paris suburbs in April, the official said. The gunman in that attack is awaiting trial after accidentally shooting himself in the foot and turning himself in to medical personnel.
El Khazzani's attorney, Sophie David, says her client denies making a trip. She told CNN affiliate BFMTV and other media organizations that her client wanted to carry out an armed robbery and did not intend to spark a terror alert.
"He says he only wanted to extort money from the Thalys passengers, and nothing else," she told France's Le Parisien newspaper. "He denies any terrorist dimension to his actions -- the suggestion makes him almost laugh."
The lawyer said her client told her he found the firearms "in a suitcase abandoned in a park near Brussels railway station, where he used to sleep rough."
Whatever his plans, it appears the gunman was not well-trained; witnesses said he didn't seem to know what to do when his rifle jammed during the attack.
"He clearly had no firearms training whatsoever," said Alek Skarlatos, one of the Americans who tackled the gunman. "If he knew what he was doing or even got lucky and did the right thing, he would have been able to operate through all eight of the magazines, and we probably wouldn't be here today."
El Khazzani is believed to have lived in the Spanish capital, Madrid, and Algeciras, in the south of the country, for several years. While there, he worked as a house painter and was twice convicted of drug smuggling.
His family moved to Spain from Morocco in 2007, and his parents still live there. They said he is an ordinary citizen, not a terrorist; his father told Spanish and British newspapers that his son never talked politics but just liked football and fishing.
Kamal Cheddad, leader of the Muslim community in El Saladillo, Algeciras, said El Khazzani "behaved like a normal guy for his age. He played and went to the beach with other guys; he was also looking for a job."
Cheddad said the suspect left Spain for France "about two years ago. We were told he got a contract with a mobile phone company, delivering (SIM) cards."
The 25-year-old is said to have visited numerous European countries, including Austria, Germany, France and Andorra, in recent months.
Anti-terror police in Paris have 96 hours to question El Khazzani; that time limit is due to expire Tuesday evening.
Two U.S. law enforcement officials said El Khazzani was not known to U.S. authorities and was not on the U.S. no-fly list, meaning he could have boarded a plane from Europe to the U.S. without any issues.
That highlights the ongoing concern in the U.S. government about information-sharing from other countries regarding possible terrorists.
Officials say information-sharing between European countries and the United States is improving, but they still have a long way to go with real-time information-sharing.
One of the debates going on right now among countries is how to reconcile better information-sharing with individual countries' privacy laws.