The San Bernardino mass shooting caught authorities by surprise. Neither of the two shooters, Syed Rizwan Farook and Tashfeen Malik were on law enforcement's radar. One week later, the investigation has turned up that while the possibility remains that the couple were self-radicalized, their terror plot did not happen in a vacuum.

These are the latest and most significant investigative leads so far:

Thursday
Farook in same 'social circle' as convicted terrorist

The FBI believes Farook had ties to a group of jihadists in California who were arrested in 2012 for attempted to travel to Afghanistan to join al Qaeda.

Specifically, investigators are taking a new look at one of the four men who was arrested in the 2012 case, Sohiel Kabir. Kabir, who was convicted and sentenced to 25 years in prison, was the recruiter who helped radicalize others.

The 2012 probe happened in Riverside, California, not far from San Bernardino. Farook was in the social circle of Kabir, officials told CNN.

The FBI initially investigated five men as part of the Riverside group. The fifth wasn't arrested and hasn't been identified. But Farook was not among those investigated at the time, the officials said.

Wednesday
Friend says Farook considered terror plot in 2012

Enrique Marquez is a former neighbor and friend of Farook. He has emerged as a person of interest in the San Bernardino case because he is the one who purchased weapons used in last week's attack. Furthermore, Marquez told investigators that he and Farook conceived a terror plot in 2012, but abandoned their plans after the FBI arrested an unrelated group in Riverside that had been planning to join al Qaeda in Afghanistan.

Marquez checked himself in to a mental health facility after the San Bernardino attack.

He is cooperating with the FBI, but investigators are still trying to corroborate the information he has provided, including details of the alleged 2012 plot.

Marquez claims he knew nothing about the San Bernardino shootings. He has not been charged with a crime.

Friend's marriage under scrutiny

Now that Farook's friend and former neighbor Enrique Marquez has the attention of investigators, his own relationships are being scrutinized.

Federal authorities are "examining the circumstances of the marriage" between Marquez and a woman of Russian descent, according to a source familiar with the matter. Investigators are looking into whether this was a sham marriage for immigration purposes.

The woman came to the U.S. from Russia on a J-1 visa in 2009, according to another law enforcement official. That official says the woman did not appear for an interview earlier this week for her permanent resident application.

FBI recovers some electronic communication from killers

Farook and Malik tried to destroy their electronic tracks, but the FBI has been able to recover some of those communications, two law enforcement officials told CNN.

FBI Director James Comey told a Senate hearing Wednesday the agency has found online discussions about jihad between Farook and Malik from late 2013, before they began dating. Investigators have found data on a tablet computer and other cell phones at the couple's home, he said.

The FBI is still trying to recover information from two smashed cell phones found in a garbage can near the home. They also have not found the hard drive from a computer at the home; investigators believe the hard drive was removed as a way to cover up the crime.

Farook and Malik became radicalized years ago

The online communications recovered so far indicate that the two killers had become radicalized long before carrying out last week's attack.

Comey elaborated a bit on the conversations between Farook and Malik, where they talked to each other about jihad and martyrdom before they were married and before Malik immigrated to the United States.

Asked if Malik was radicalized before she entered the United States, Comey replied: "So far, it looks like she was....she was before she connected with the other killer."

Tuesday
Authorities reveal Marquez bought the weapons

The two AR-15s used in the San Bernardino attack were purchased by Enrique Marquez for Farook back in 2011 and 2012, two law enforcement officials said. Marquez acknowledged that he bought the weapons and soon after gave them to Farook, though he never reported the ownership transfer. Such transactions could be a violation of California law, the officials said.

Farook borrowed $28,500 via online lender Prosper last month

Farook took out a loan for $28,500 in November, multiple law enforcement officials told CNN. Investigators have accounted for all the money and do not believe any of the money was provided to the killers by any outside entity backing the plot, according to one of the sources.

Because of that, the officials said the loan, from the online lender Prosper, is not considered of significant investigative value at this stage.

About half was given to Farook's mother in the last couple of weeks, one official said and some was spent on household items.

It is believed the couple had bought the arsenal they used before the loan was taken out.

A spokesperson for Prosper would not confirm the existence of the loan, but provided CNN the following statement: "Prosper is prohibited by law from disclosing any non-public, personally identifiable information regarding any loan originated through our platform. All loans originated through the Prosper platform are subject to all identity verification and screening procedures required by law, including US anti-terrorism and anti-money laundering laws. As part of our standard procedures, we also confirm that all loan funds are disbursed into a verified US bank account in the borrower's name. Like all Americans, Prosper is shocked and saddened by recent events in San Bernardino."

Man believed to be Farook at gun range days before attack

A man believed to be Farook visited the Magnum Shooting Range in Riverside, California, alone on the Sunday and Monday prior to the attacks in San Bernardino according to a source familiar with the matter.

He practiced shooting an AR-15. The source says sign-in logs at the range were paired with surveillance video that have been turned over to the FBI. The FBI was at the range Monday night asking questions and showing pictures of another male (not Farook) asking if that man had ever been to the range.

Last Week
Facebook comment provides possible ISIS link

As the San Bernardino attack was happening, investigators believe Malik posted on Facebook pledging allegiance to ISIS leader Abu Bakr al-Baghdadi, three U.S. officials familiar with the investigation told CNN.

Malik posted the comment, but it was made on an account with a different name, one U.S. official said. The officials did not explain how they knew Malik made the post.

"There was a post that went up around 11aPT on the account Wednesday that violated the company's community standards (those standards prohibit people using Facebook to promote terrorism or celebrate/glorify violence)," A Facebook official told CNN. "It was taken down Thursday. He said he couldn't go into details about the nature of the post other than it violated standards (pointed to their standards prohibiting terrorism). The official said Facebook is cooperating with law enforcement."

Farook and Malik travel history

Farook traveled to Saudi Arabia in 2013 for the Hajj for a couple of weeks, two government officials said.

One of the officials explained that this is a common occurrence and the trip would not have raised any red flags as many Americans travel to Saudi Arabia during that time.

The feds believe Farook met Malik during that trip. Malik eventually came to the United States on a fiancée visa, the official said. She then obtained a green card.