Police raided homes of suspected Islamist militants across France overnight following the Paris attacks, and a source close to the investigation said a Belgian national in Syria was suspected of orchestrating Friday's mayhem.
Prosecutors said one of the killers had been stopped and fingerprinted in Greece last month, fuelling speculation the Islamic State had taken advantage of the recent influx of refugees fleeing the Middle East to slip militants into Europe.
The Paris carnage, which killed 129 people, has led to calls for the European Union to close its borders to asylum seekers.
Prime Minister Manuel Valls warned France could be hit by new violence but said the Islamic State, which has claimed responsibility for the attacks in retaliation for French airstrikes in Iraq and Syria, would never win.
Interior Minister Bernard Cazeneuve told journalists on Monday police arrested 23 people and seized arms including rocket launchers in 168 raids overnight. Another 104 people were put under house arrest, he said.
"Let this be clear to everyone, this is just the beginning, these actions are going to continue," Cazeneuve said.
French warplanes pounded Islamic State positions in its Syrian stronghold Raqqa late Sunday -- its biggest such strike since it started assaults as part of a U.S.-led mission launched in 2014.
The investigation into the coordinated Paris attacks, the worst atrocity in France since World War Two, led swiftly to Belgium after police discovered that two of the cars used by the militants had been rented in the Brussels region.
By Sunday, Belgian officials said they had arrested seven people in Brussels, while another man -- one of three brothers believed to have been involved in the plot -- was being hunted.
A source close to the investigation said Belgian national Abdelhamid Abaaoud, currently in Syria, was suspected of having ordered the Paris operation. "He appears to be the brains behind several planned attacks in Europe," the source told Reuters.
French prosecutors say they have identified five of the seven suicide attackers who died on Friday. Four were French, while the fifth man was fingerprinted in Greece in October and was possibly Syrian.
Valls said that since this summer, French intelligence services had prevented five attacks.
"We know that more attacks are being prepared, not just against France but also against other European countries," Valls told RTL radio. "We are going to live with this terrorist threat for a long time."
SYRIAN CONNECTION
The death toll was revised back down to 129 following a counting error. Dozens of people remain in intensive care.
France has declared three days of national mourning and President Francois Hollande will make a rare address to the joint upper and lower houses of parliament later in the day at the Palace of Versailles, just outside Paris.
Schools in Paris re-opened on Monday, and many museums were due to open their doors in the afternoon after a 48-hour shutdown, but some popular tourist sites, including Disneyland, remained closed.
Police have named just two French attackers -- Ismael Omar Mostefai, 29, from Chartres, southwest of Paris, and Samy Amimour, 28, from the Paris suburb of Drancy. Media named the two other French assailants as Bilal Hadfi and Ibrahim Abdeslam.
The man stopped in Greece in October was carrying a Syrian passport in the name of Ahmad Al Mohammad. Police said they were still checking to see if the document was authentic, but said the dead man's fingerprints matched those on record in Greece.
Greek officials said the passport holder had crossed from Turkey to the Greek islands last month and then registered for asylum in Serbia before heading north, following a route taken by hundreds of thousands of asylum seekers this year.
The news revived a furious row within the European Union on how to handle the flood of refugees. Top Polish and Slovak officials poured cold water on an EU plan to relocate asylum seekers across the bloc, saying the violence underlined their concerns about taking in Muslim refugees.
Britain announced on Monday it would boost its intelligence agency staff by 15 percent and more than double spending on aviation security to defend against Islamist militants plotting attacks from Syria.
A source in British Prime Minister David Cameron's office said police had foiled one attack against the country last month.
Valls said the French authorities would use every means at their disposal to counter the Islamist threat, adding that mosques harboring extremists would be shuttered and foreigners expelled if they "held unacceptable views against the republic".