Austrian police raided 18 locations and arrested 14 people in a massive dragnet on Tuesday, after a gunman killed four people in a rampage in the centre of Vienna overnight.
The gunman, who was killed by police minutes after he opened fire on crowded bars, was identified as a 20-year-old convicted jihadist released from jail less than a year ago, who had managed to convince authorities that he was no longer a threat.
An elderly man and woman, a young passer-by and a waitress were killed in the attack, and 22 people including a policeman were wounded, Interior Minister Karl Nehammer told a news conference. Vienna's mayor said three people were still in critical condition.
Describing the assault as a terrorist attack, Chancellor Sebastian Kurz said in a televised address: "This is not a conflict between Christians and Muslims or between Austrians and migrants. No, this is a fight between the many people who believe in peace and the few (who oppose it). It is a fight between civilisation and barbarism."
Authorities had previously said they could not rule out the possibility that other shooters were still on the loose and asked people to avoid the centre of Vienna, which was largely deserted on Tuesday with most shops closed.
Nehammer said footage of the incident filmed on mobile phones showed no evidence of a second gunman, although the possibility had not been completely ruled out.
The attacker, an Austrian-born son of immigrants from North Macedonia, was wearing an explosive belt that turned out to be fake. Vienna's police chief said he was killed nine minutes after he started his rampage.
He was identified as Kujtim Fejzulai, a dual citizen of Austria and North Macedonia, who had been sentenced to 22 months in jail in April last year for attempting to travel to Syria to join Islamic State. He had been released early because of his young age, in December.
Nehammer said Fejzulai had attended a de-radicalisation programme, but that "despite all the outward signs that he was integrating into society, the assailant apparently did exactly the opposite".
Fejzulai had posted a photo on his Instagram account before the attack, showing himself with two weapons, Nehammer said. There was no immediate claim of responsibility for the attack.
Officials said the perpetrator had been armed with an automatic rifle, a hand-gun and a machete.
Witnesses described crowds being fired on in bars as people enjoyed a last evening out, in an area full of shops and restaurants, before the start of a nationwide coronavirus curfew.
Police said they had established at least three sites where attacks took place, one of them outside the main synagogue, which was closed.
The government announced three days of national mourning, and held a minute's silence at noon.