The assailant may also have reached Paris faster and more easily than expected because asylum seekers were rushed across some national borders at the height of the migration crisis in Europe this year to avoid bottlenecks after Hungary closed its borders, ironically to keep out suspected militants.
The man, who blew himself up near the Stade de France stadium in Friday's attacks that killed 129 people, has been identified from a Syrian passport found near his body as 25-year-old Ahmad al-Mohammad for the northwestern city of Idlib.
The passport could be false or stolen but its holder was registered as arriving alongside 198 refugees by boat from Turkey on October 3 in Leros, a small picturesque Greek island.
French authorities have said the fingerprints of the attacker who blew himself up matched those of the man who landed on Leros.
Greek officials said on Sunday that Mohammad seemed not to be traveling with anyone specific, despite arriving with others. But a counter-intelligence source in Macedonia, one of the countries he passed through, spoke of a "massive investigation in the Balkans about the route of two of the terrorists."
The source, who declined to be named, indicated to Reuters that Macedonia was coordinating its action with Greece, and that a companion was with Mohammad by the time they bought ferry tickets taking them to Piraeus on the Greek mainland.
"On October 4, one after the other, they bought ferry tickets for EUR 51.50 ($54.90) and they arrived in Piraeus at 23:10 on October 5 on the Diagoras ferry," the source said.
The owner of the Kastis travel agency in Leros, 42-year-old Dimitris Kastis, remembers selling tickets to Mohammad and a man who was with him.
"He didn't do or say anything that caught my attention," Kastis said, adding that both men had paid in cash. He said the man traveling with him had a similar surname.
Greek media have published a photograph of the second man's ticket which gives his family name as al-Mahmod, and the initial of his given name as M.
Kastis said he recognized this as the name the second man provided when purchasing the ticket.
A Croatian police official, who declined to be named, also told Reuters that an investigation was under way into Mohammed's journey which was focusing on whether he was traveling with anyone and, if so, with whom.
In Leros, Mohammad was registered as required under European Union rules, with his fingerprints recorded in a European database known as Eurodac. Because his passport looked authentic and there was no police record on him, he was given a permit allowing him to stay in Greece for six months.
A copy of Mohammad's permit was distributed to journalists by Immigration Minister Yannis Mouzalas. Written in Greek only, it states that its holder should not leave the city of Corinth for the whole period without alerting police.
But within days, Mohammad had gone at least as far as Croatia.
The counter-intelligence source in Macedonia said Mohammad was still traveling with a companion two days after reaching Piraeus. They registered together at a refugee camp in the backyard of an old tobacco plant in the Serbian town of Presevo, though Serbian officials have not mentioned an accomplice.
Mohammad then went on to Croatia, either by train or bus, and was registered on October 8 at the Opatovac refugee camp.
Reuters has been unable to determine what route Mohammad took after this, or whether he was accompanied by anyone.
Croatian police said he almost certainly left for Hungary within 24 hours, though Budapest has no record of him entering from Croatia, which at the time was offloading thousands of migrants every day across its northern border with Hungary.
Mohammad's most likely destination from Hungary would have been Austria. In early October migrants were being sent in trains with locked doors to Hegyeshalom on the Austrian border, where Reuters journalists said they were ushered into the country without having their documents checked.
Austrian Interior Ministry spokesman Karl-Heinz Grundboeck said it was "conjecture and speculation" that a man going by the name of al-Mohammad had passed through Austria which, like France, is part of the EU's Schengen zone where routine internal border controls have been removed.
But Vienna has confirmed that another of the attackers, Belgian-born Frenchman Salah Abdeslam, entered Austria from Germany on September 9.
