The Islamic State has claimed responsibility for an attack on a town in northern Mozambique last week that forced hundreds of foreign contractors to flee amid fierce fighting. Local police and soldiers were reported to have secured control of most of Palma on Monday, after hundreds of Islamist insurgents who overran the small port last week withdrew to surrounding forests and fields leaving a trail of devastation. In a statement issued on official media channels, Isis claimed insurgents killed more than 55 members of local security forces and Christians, including those from “Crusader nations”, and destroyed official buildings and banks. The total death toll in the attack is unclear, though officials in Mozambique have confirmed the deaths of seven people and multiple witnesses have reported roads and beaches strewn with corpses. Authorities in the southern African country said security forces were working to “eliminate some pockets of resistance” after spending three days focusing on rescuing local and foreign citizens. However, diplomats and other observers say the insurgents remain in control of much of the hinterland of Palma, which is a key logistic hub for overseas companies seeking to exploit vast natural gas reserves worth $60bn (£43bn) in the province of Cabo Delgado. Omar Saranga, a spokesperson for Mozambique’s defence and security forces, confirmed on Sunday that at least seven people had been shot dead during an ambush on their convoy as they attempted to flee Palma. Hundreds of people, including many foreigners, were evacuated from Palma over the weekend by helicopter and in a makeshift flotilla of local ships and boats, or fled. Tens of thousands of local people have also fled the attack by road, with some walking up to 31 miles (50km) to safety. With most communications severed, information about the situation remained sketchy. Several security sources involved in the operations said 60 people based in Palma – mostly foreign citizens – who were missing have now been accounted for. Others reported ongoing operations to rescue as many as 30 said to be still hiding in forests between six to 12 miles from the town. “The real question now is how the hell this was allowed to happen? How was this even possible. It’s clear that the insurgents have got better intelligence than the government,” said the owner of one South Africa-based private security firm operating in Palma and the surrounding areas, who asked to remain anonymous. Last week’s clashes came after a series of increasingly audacious operations by militants from the Ahlus Sunnah wal Jamaah (ASWJ) movement. The group remains in control of much of the port of Mocimboa da Praia, 50 miles south of Palma, which it seized last year. Palma is a base for many foreign contractors who have been working for a multibillion-dollar liquified natural gas project run by the French energy company Total. Security sources said insurgents had infiltrated the area around the town before that attack, hiding weaponry in caches. Many were disguised as community members with some wearing army or police uniforms. Government infrastructure in the town was targeted in a systematic manner, with the local police station and military base overrun and destroyed, while at least two banks were raided, local security sources said. A group of at least 120 insurgents came from the northern regions of Cabo Delgado, while a similar size group was said to have crossed over from Tanzania to reinforce the attackers on the second day of the assault, the sources said. Analysts at the International Crisis Group say the biggest cohort of foreigners fighting within the ranks of ASWJ are from Tanzania. The three-year insurgency in Cabo Delgado province has killed more than 2,600 people and displaced an estimated 670,000, according to the UN. Most observers believe the insurgents in Mozambique have limited international links, though the ASWJ is considered as Isis affiliated by the US. “While there is evidence that Isis has had some contact with jihadists in Mozambique, it is unclear how close or meaningful their ties are … Communication between the groups and some coordination in disseminating propaganda does not suggest especially close links,” the International Crisis Group said in a recent report. When the attack began last week, several hundred workers from South Africa, Britain and France sought refuge at hotels in the town, with an estimated 200 under siege in Hotel Amarula alone. After a failed attempt to escape by sea, a convoy of vehicles attempted to flee the besieged hotel and reach the coast before they were ambushed twice. Recordings of security calls reviewed by the Guardian described scenes of chaos as helicopters and boats run by several security companies attempted to extract those trapped in the town. A South African woman, Meryl Knox, told Reuters her son Adrian Nel had died in that ambush. One foreigner who was rescued described the town being overrun before being rescued by security contractors from Dyck Advisory Group (DAG), a private security company. “The Amarula lodge was completely surrounded and under attack from mortar and machine gun fire,” said one South African. “And these guys [from DAG] came in with their choppers and cleared the perimeter to get at least four chopper loads of people out. Twenty-three of us. I was on the last chopper out luckily, because they stopped because of a lack of fuel and daylight.” He added that those people staying in Amarula had to “make a run for it because the place was being assaulted with heavy weaponry”. Lionel Dyck, a South African former soldier who runs DAG, told South African TV that he had warned of such an attack some time ago. The company was recently accused in a report by Amnesty International of killing civilians – a charge it denies. “This is the time of the post-rain fighting season. It’s been on the cards for a long time, and we are disappointed that there has been very little attempt by the people in Palma to protect themselves,” Dyck said. “This insurrection has grown from a well-armed group of bandits to [launching] a very well planned and coordinated attack. They have been very effective [and pose] quite a serious threat now.” On Sunday, boats began arriving at Pemba, a port 155 miles south of Palma, carrying locals and foreigners. One was carrying about 1,300 people, said a diplomat. Total said on Saturday it was calling off a planned resumption of construction at its $20bn development after the attack and would reduce its workforce to a “strict minimum”. The company pulled out the majority of its workforce in January because of security issues. Alexandre Raymakers, a senior Africa analyst at the risk intelligence firm Verisk Maplecroft, said the scale and intensity of the attack on Palma suggested meticulous planning, probably during a lull in the fighting during rainy season in the first three months of this year. “It’s a clearly demonstration that [the insurgency] has steadily increased its military capabilities, grown in sophistication and retains the initiative. The latest attack … is a major setback for [the government of Mozambique] and raises serious questions about its ability to guarantee the security of [gas] projects vital to the country’s long-term financial stability,” Raymakers said.