Inspector-general of police Khalid Abu Bakar said two men have been arrested in connection to the attack, and that they received direct instructions from Muhammad Wanndy Mohamed Jedi, a known Malaysian IS fighter.
"The two of those arrested had received instructions from Muhammad Wanndy, who had commanded them to carry out attacks in Malaysia, on our government leaders, top police officials and judges. These three groups are considered as threatening to IS activities," Khalid said at a news conference.
Police are hunting for two more people believed to have been directly involved in the nightclub attack, Khalid added.
Police had on June 28 ruled out terrorism as a motive for the pre-dawn attack, which took place as customers were watching a live screening of the Euro football tournament.
Investigators initially said that a business rivalry, or a targeted attack on someone in the bar, were the more likely motives, but were forced to reassess their position a day later after an IS claim of responsibility was posted on Facebook.
Khalid said police also arrested 13 others, including two low-ranking police officers, in a counter-terrorism crackdown in the aftermath of the grenade attack.
Khalid said those detained during the crackdown had all received instructions to carry out attacks on top officials "and also entertainment centers, which they consider un-Islamic".
All those detained, including the two linked directly to the attack, are Malaysians.
The IS recently released a video of its fighters from Southeast Asia calling on its supporters to stay home and unify under one umbrella group to launch attacks in the region.
Related news: