The Hawks' crimes against the state (Cats) unit has been brought in to trace the bomb-makers behind a string of attacks in Durban.

This is the same detachment tasked to probe elements of extremism at the Imam Hussain mosque attack in Verulam, north of Durban, in May.

Five explosive devices have been planted at key locations around the city in a matter of days, with prominent shopping malls and social events the apparent targets.

Impeccable sources within the Hawks and the crime intelligence said that arrests were imminent as the probe into the attacks entered its sixth day.

The Cats unit usually picks up extraordinary cases, and crimes that are specifically targeted against the state.

The setting of the devices, several of which detonated, has placed shopping outlets on tenterhooks, with mall management at the Pavilion calling in the police's explosives unit yesterday after a "suspicious device" was found in an underground parking lot.

The Woolworths store at the mall had effectively been ground zero, with a device detonated in the men's clothing section in the early hours of Thursday morning.

A fire sparked by the device was quickly confined by the sprinkler system.

Police spokesman Brigadier Vishnu Naidoo said yesterday's scare had been a false alarm - the device was actually a shopping security tag which had been discarded.

The discovery of other devices - which resembled pipe bombs - were made at the Gateway Woolworths on Thursday and again on Saturday, with the final attacks seeing devices set under parked cars on the fringes of the Durban July in Greyville later on Saturday evening.

Hawks spokesman Brigadier Hangwani Mulaudzi said their team had taken charge of the dockets yesterday, and that it was too soon to comment on the "sensitive" investigations.

He did, however, confirm that members of the serious organised crime unit, as well as members from Cats, had been given a mandate.

Ryan Cummings, a security risk analyst from Signal Risk, said that the message sent by the planting of the devices should be brought to the fore.

"There haven't been any casualties and that is key - are they [the devices] there more to burn and create arson and sending a message rather then inflicting casualties?

"The problem now is we don't know [the] motivation [behind the attacks] and we don't know intent and what we hope is not the case is that this messaging then progresses into something meant to inflict casualties."

He said with the discovery of the latest devices - outside Woolworth stores - the focus had been drawn away from a personal dispute.

"There is no way to say for sure, this might still be an extension of a very personal dispute playing out in the public sphere to send a message."

Cummings said that it was highly unlikely that the devices were the work of transnational extremists.

Africa director for the Terrorism, Research and Analysis Consortium, Jasmine Opperman, said the devices appeared rudimentary in construction and were unlikely to be the handiwork of sophisticated terror groups.

"Durban has seen extremist activity but the important question is this; if an extremist group was executing attacks, one would expect them to be far more sophisticated," Opperman said.

"This is too rudimentary and that diverts from extremism," she said.

Opperman said explosives, no matter how basic, were becoming widely employed.

"You see this when you look at the way . in context bombs are used in a broader manner" Opperman added.

"Bomb-making is easy enough to do from YouTube and this brings with it a certain fear if this is going to become the go-to."

Opperman said that irrespective of the motive behind the attacks, if police are not quick to action the vulnerability of the public would increase.