They claim to have intercepted several chats on instant messaging site Nimbuzz between Riyaz and Tehseen Akhtar, the Mujahideen man reportedly running the group since its leader in India, Yasin Bhatkal, was arrested from Bihar in August.
Riyaz Bhatkal, investigators believe, has been giving direct orders on terror strikes. After his arrest, Yasin Bhatkal allegedly told interrogators that he did not know about the Bodh Gaya blasts and that many IM modules now work simultaneously on multiple instructions.
Both Yasin and Riyaz belong to the same village in Karnataka, where they are believed to have begun their careers in terror.
The terrorists were emboldened to strike before a Narendra Modi rally at Patna's Gandhi Maidan on October 27, by the fact that investigation agencies had made no arrests or breakthrough in the Bodh Gaya case in which two monks were injured, investigators now say.
Earlier this week, the National Investigation Agency or NIA raided a small hotel in Ranchi in pursuit of Haider Ali, one of the main suspects in the Patna blasts which killed six people and injured 83.
Haider Ali had escaped by then, but the NIA found 27 live bombs and a chart that lists the men who allegedly planted a total of 13 bombs in Bodh Gaya in July.
The similarities between the two attacks are many; investigators say they were both conducted by the newly-formed Ranchi branch of the Indian Mujahideen.
Both teams had six members and in both cases they allegedly worked in teams of two assigned to plant three bombs each.
Among the bombers in both cities, say investigators, is Imtiaz Ansari who was caught while trying to escape from the Patna railway station where the first bomb exploded just hours before Mr Modi, the BJP's prime ministerial candidate, addressed a massive rally.