Malaysian police investigating the killing of the North Korean leader’s half-brother held one woman in custody Wednesday and searched for other possible suspects a day after the apparent lethal poisoning in a busy airport terminal.

The detention of a potential female plotter fit with Malaysian reports Tuesday saying a woman ambushed Kim Jong Nam at Kuala Lumpur’s international airport with a cloth soaked in some kind of deadly liquid.

North Korea’s tightly controlled state media has not made reference to the death of the 45-year-old Kim, who was estranged from the North’s leader Kim Jung Un and had lived outside the country for more than a decade.

But the opaqueness in North Korea also opens room for speculation about the motives behind the killing and whether it could be traced back to high-level decisions in Pyongyang.

Just three years ago, Kim Jong Un had his uncle — and Kim Jong Nam’s mentor — executed on suspicion of building an alternate power base. Meanwhile, a slew of high-profile defections have raised questions about the stability of the regime.

Separately, officials from the North Korean embassy in Kuala Lumpur objected to an autopsy being carried out on Kim Jong Nam’s body, officials told local reporters.

But the authorities continued and completed the autopsy Thursday night. However, the results have not yet been released.

Four black cars bearing North Korean diplomatic plates sped out of Kuala Lumpur General Hospital Thursday night. One, a Lexus, contained a visibly upset man in his 20s who was wearing a pink t-shirt and who honked at reporters on his way out. The man could have been Kim Han Sol, the dead man’s son.

Malaysian authorities described the woman detained at the airport as holding a Vietnamese passport bearing the name Doan Thi Hoang, 29. Police said they identified her from surveillance camera images showing a young woman, wearing a white shirt with the letters “LOL” on the front, waiting for a taxi immediately after the attack.

“Police are looking for a few others, all foreigners,” Malaysia’s deputy inspector general, Noor Rashid Ibrahim, told the Reuters news agency, declining to give the suspects’ nationalities or gender.

North Korea, with its secretive and idiosyncratic leadership, is often the subject of dramatic tales that turn out to be exaggerated or flat-out wrong.

But the Malaysian police chief’s confirmation suggests that at least part of this story is true. What is likely to take much longer to determine is whether the plot was orchestrated directly by Kim Jong Un, who recently celebrated five years at the helm of North Korea and is now locked in a showdown with the international community over his nuclear ambitions.

“Kim Jong Nam was involved in some funny business,” said Michael Madden, editor of North Korea Leadership Watch, a specialist website devoted to the ruling Kim family. He was rumored to have worked in computing in North Korea — now notorious for cyberattacks — and money laundering throughout Southeast Asia.

Analysts had long considered Kim Jong Nam, as the eldest son of second-generation leader Kim Jong Il, to be the natural heir to the family dynasty.

But this assumption was thrown into doubt in 2001 when Kim Jong Nam was caught at Narita International Airport in Tokyo, trying to enter Japan with his wife and son on fake Dominican Republic passports. Kim Jong Nam’s bore the name Pang Xiong — “fat bear” in Mandarin Chinese. He told the authorities that they wanted to go to Tokyo Disneyland.

It was later revealed that he had never been in the running to be leader. Kim Jong Un’s aunt told The Washington Post last year that the current leader was chosen as successor in the early 1990s, when he was only 8 years old.

In 2010, with Kim Jong Il’s health steadily worsening, Kim Jong Un was officially declared heir apparent.

Both before and after the announcement, the usually reclusive Kim Jong Nam said in interviews with Japanese media that he opposed hereditary succession, something that not even Mao Zedong had done in China. “But I presume there were internal reasons. We should abide by such reasons if there are any,” he told TV Asahi.

Kim Jong Nam was born in 1971, the son of leader Kim Jong Il and his consort, an actress named Song Hye Rim. But he grew up largely in secret, the result of founding president Kim Il Sung’s disapproval of his son’s relationship with Song.

He left North Korea to live with his grandmother in Moscow in 1979, according to North Korea Leadership Watch. He spent his childhood at international schools in Russia and Switzerland before returning to North Korea in 1988, the site says.

But the embarrassing incident in Japan was a tipping point, and Kim appears to have never lived in North Korea again. He reportedly lived for a period in Macau, a Chinese region. But in recent years he seems to have had homes — and families — in Beijing and Singapore as well.

He was occasionally sighted in sushi restaurants in Singapore and swanky hotel bars in Beijing but otherwise kept a low profile.

Kim did, however, return to North Korea at least one time after his younger half brother assumed the leadership — for their father’s funeral at the end of 2011.

Madden of North Korea Leadership Watch said Kim Jong Nam could have been involved in financing for the regime and could have run into problems as a result. But at the same time, Madden noted that Kim had publicly said he would do anything to help the new leader.

Their relationship probably took a turn for the worse in 2013, when the young North Korean leader ordered the execution of their uncle, Jang Song Thaek. Jang had been close to Kim Jong Nam and had reportedly backed him as successor.

Brian Murphy in Washington contributed to this report.