WASHINGTON (AP) — An intercepted secret message between al-Qaida chief Ayman al-Zawahri and his deputy in Yemen about plans for a major terror attack was the trigger that set off the current shutdown of many U.S. embassies, two officials told The Associated Press on Monday.

A U.S. intelligence official and a Mideast diplomat said al-Zawahri’s message was picked up several weeks ago and appeared to initially target Yemeni interests. The threat was expanded to include American or other Western sites abroad, officials said, indicating the target could be a single embassy, a number of posts or some other site. Lawmakers have said it was a massive plot in the final stages, but they have offered no specifics.

The intelligence official said the message was sent to Nasser al-Wahishi, the head of the terror network’s organization, based in Yemen, known as al-Qaida in the Arabian Peninsula.

Both officials spoke on condition of anonymity because they were not authorized to discuss the sensitive issue publicly.

American spies and intelligence analysts on Monday scoured email, phone calls and radio communications between al-Qaida operatives in Yemen and the organization’s senior leaders to determine the timing and targets of the planned attack.

The call from al-Zawahri, who took over for Osama bin Laden after U.S. Navy SEALs killed the al-Qaida leader in May 2011, led the Obama administration to close diplomatic posts from Mauritania on Africa’s west coast through the Middle East to Bangladesh, east of India, and as far south as Madagascar.

The U.S. did decide to reopen some posts on Monday, including well-defended embassies in Kabul, Afghanistan, and Baghdad.

Authorities in Yemen, meanwhile, released the names of 25 wanted al-Qaida suspects and said those people had been planning terrorist attacks targeting “foreign offices and organizations and Yemeni installations” in the capital Sanaa and other cities across the country.

The Yemeni government also went on high alert Monday, stepping up security at government facilities and checkpoints.

Officials in the U.S. wouldn’t say who intercepted the initial suspect communications — the CIA, the National Security Agency, the Defense Intelligence Agency or one of the other intelligence agencies — that kicked off the sweeping pre-emptive closure of U.S. facilities. But an intelligence official said the controversial NSA programs that gather data on American phone calls or track Internet communications with suspected terrorists played no part in detecting the initial tip. That official spoke on condition of anonymity because the official was not authorized to discuss the spying publicly.

A U.S. official familiar with the threat information said the decision to close the embassies was based on a broad swath of information, not just the intercept. The official said the U.S. has made clear in the past that AQAP makes its own operational decisions — that there are back-and-forth communications between al-Qaida leadership and AQAP, but that they operate independently. The official was not authorized to disclose the information to reporters and thus spoke on condition of anonymity.

Once the plot was detected, NSA analysts could use the programs that leaker Edward Snowden revealed to determine whom the plotters may have contacted around the world. Snowden revealed one program that collected telephone data such as the numbers called and the duration of calls on U.S. telephone networks. Another program searched global Internet usage. Therefore, if a new name was detected in the initial chatter, the name or phone number of that person could be run through the NSA databases to see whom he called or what websites or emails he visited.

The surveillance is part of the continuing effort to track the spread of al-Qaida from its birthplace in Afghanistan and Pakistan to countries where governments and security forces are weaker and less welcoming to the U.S. or harder for American counterterrorist forces to penetrate — such as Syria, Iraq, Somalia, Mali and Libya — as well as Yemen, already home to al-Qaida’s most dangerous affiliate, al-Qaida in the Arabian Peninsula, which is headed by al-Wahishi.

AQAP also has been blamed for the foiled Christmas Day 2009 effort to bomb an airliner over Detroit and the explosives-laden parcels intercepted the following year aboard cargo flights. The CIA and Pentagon jointly run drone targeting of al-Qaida in Yemen.

The Obama administration announced the embassy closures one day after President Barack Obama met with Yemeni President Abdo Rabby Mansour Hadi. A person familiar with the meeting said Obama and Hadi did discuss al-Qaida in the Arabian Peninsula but their talks did not directly result in the embassy closures and travel ban.

That person insisted on anonymity because the person was not authorized to discuss the private meeting.

White House spokesman Jay Carney wouldn’t say whether the threat extends to the United States or whether Americans should be fearful because of the alerts.

“What we know is the threat emanates from, and may be focused on, occurring in the Arabian Peninsula,” Carney said. “It could potentially be beyond that, or elsewhere.”

“We cannot be more specific,” he said.

The U.S. also has stepped up surveillance in Africa, flying unarmed observation drones from Libya, focused in that country on a mix of militant groups in the town of Darna. A newer U.S. operation opened last year at an airfield in Niger, aimed at tracking another affiliate, al-Qaida in the Islamic Maghreb, in neighboring Mali.

The model for both is the U.S. operation in Somalia. CIA officers there provide intelligence, and special operators advise U.N. peacekeeping troops on tactics as well as delivering surveillance and intelligence — carrying out the occasional raid against pirates or militants.

Acting on what it said was an “overabundance of caution,” the State Department on Sunday closed a total of 19 diplomatic posts until next Saturday. They include posts in Bangladesh and across North Africa and the Middle East as well as East Africa, including Madagascar, Burundi, Rwanda and Mauritius. The closure of the African facilities came just days before the 15th anniversary of al-Qaida’s bombings of American diplomatic missions in Kenya and Tanzania.

Those two embassies targeted in the Aug. 7, 1998 attacks were rebuilt as more heavily fortified structures away from populated areas where they would be less vulnerable to attack.

One senior U.S. diplomat in the region said his diplomatic facility was keeping a skeleton U.S. staff working to provide some U.S. citizen services, but was limiting movements in and out of the area and remained closed to the general public. Diplomatic staff were taking precautions standard for the region even in normal times — avoiding areas of known militant activity and varying times and routes for business or personal meetings. The official spoke on condition of anonymity because the official was not authorized to discuss the closures publicly.

The British and German embassies in Yemen also were closed. Norway’s Foreign Ministry, too, restricted public access to 15 of its embassies in the Middle East and Africa, including its post in Saudi Arabia.

“There isn’t much known about the where, so they are trying to gauge their reaction as widely as possible,” Rep. Adam Schiff, D-Calif., said Monday. “The locus of the highest concern is in the area of the (Arabian) Peninsula and emanates from there,” said Schiff, who is a member of the House intelligence committee. “Given al-Qaida in the Arabian Peninsula’s past focus on airlines,” Schiff said Americans should be vigilant about airline travel and mass transportation.