UnitedHealthcare CEO murder suspect's Atlanta connection: What we know

ATLANTA - Law enforcement agencies continue to search for the masked gunman wanted for stalking and killing UnitedHealthcare CEO Brian Thompson as the hunt continues into its third day.

Some possible leads have emerged about the man's travel before the shooting and a message scrawled on ammunition found at the crime scene.

Thompson, 50, died in a dawn ambush as he walked from his midtown hotel to the company's annual investor conference at a Hilton across the street, blocks from tourist draws such as Radio City Music Hall, the Museum of Modern Art and Rockefeller Center, where the famed Christmas tree was lit Wednesday night. The reason for the killing remained unknown, but New York City police say evidence firmly points to it being a targeted attack.

Investigators are now trying to piece together what the man believed to be the gunman did in the days and hours before the deadly shooting, examining security footage and searching for DNA evidence that they hope will reveal his identity.

MORE: Companies remove executive bios, photos from websites after CEO's murder

Here's what we know about the investigation.

Suspected gunman may have traveled to New York by bus from Atlanta

On Thursday, law enforcement officials confirmed with FOX News that the suspect may have traveled to New York in late November on a bus from Atlanta.

The gunman arrived in New York City on Nov. 27, stepping off the bus at the Port Authority bus terminal in Manhattan before going to a hostel. 

Police and federal agents have been collecting information from Greyhound to try to identify the suspect and learn exactly when he purchased the ticket and if he got on the bus in Georgia.

"We are fully cooperating with authorities on this active investigation. As it is ongoing, we cannot provide further comment at this time," a Greyhound spokesperson told Fox News Digital. 

His movements between then and when he was caught on camera pulling the trigger in front of the Hilton Midtown early Wednesday morning are slowly being revealed.

Police testing DNA, fingerprints on evidence near murder scene

Police sources told FOX News the suspect dropped a burner phone in an alley after the shooting. Police are looking into data that was on the phone, as well as fingerprints that were left on the device, sources say.

On Thursday, investigators said they found a water bottle and protein bar wrapper in a trash can near the scene of the ambush that they think the suspect bought from a nearby Starbucks minutes before the shooting. The items were being tested by the city’s medical examiner.

SEE ALSO:

• Fake bomb threat made at UnitedHealthcare CEO's home the night of his killing
• Police release photo of person of interest's face as manhunt continues
• UnitedHealthcare CEO shooting suspect, unmasked in new photos, believed to have left message on bullet casings

What do we know about the shooter?

Joseph Kenny, the NYPD chief of detectives, said the shooter wore a black face mask, black-and-white sneakers and a distinctive gray backpack.

He arrived outside the hotel about five minutes before Thompson did, then waited and ignored other pedestrians before he approached Thompson from behind.

After the assailant began to fire, his 9 mm pistol jammed, but he quickly fixed it and kept firing, Kenny said.

Based on surveillance video and evidence from the scene, investigators believe the shooter had at least some firearms training and experience with guns and that the weapon was equipped with a silencer, one of the law enforcement officials said.

"From watching the video, it does seem that he’s proficient in the use of firearms as he was able to clear the malfunctions pretty quickly," Kenny said.

Suspect checked into New York hostel days before killing 

Police also released photos of a "person of interest" wanted for questioning in connection with the killing of UnitedHealthcare CEO Brian Thompson.

The images, showing an unmasked man in the lobby of a Manhattan hostel, add to a collection of photos and video that have circulated since the shooting - including footage of the attack itself, as well as still frames of the suspected gunman stopping at a Starbucks beforehand.

Investigators believe the suspect used a fake New Jersey identification card when he checked in at the hostel, said one official who spoke with the AP.

Employees at the hostel said they remembered a man who almost always wore a mask when interacting with them. That person wore a jacket that looked like the one worn by the man pictured in surveillance images released after the shooting, the official said.

Spokesperson Danielle Brumfitt said the hostel is cooperating with the police and can’t comment on the investigation.

The shooter ran into an alleyway near the hotel and later got on an e-bike that he took into Central Park.

Police initially said the shooter rode into Central Park on a bicycle from the city’s bike-share program, CitiBike. But a spokesperson for the program’s operator, Lyft, said police officials informed the company Wednesday afternoon that the bike was not from the CitiBike fleet.

‘Deny’, ‘defend’, and ‘depose found on shell casings

Investigators say the words "deny," "defend" and "depose" emblazoned on his ammunition, echoing a phrase used by industry critics, two law enforcement officials said Thursday.

The words were written in permanent marker, according to one of the officials, who were not authorized to publicly discuss details of the investigation into the shooting early Wednesday outside a Manhattan hotel and spoke to The Associated Press on the condition of anonymity. 

The messages on the ammunition mimic the phrase "delay, deny, defend," which is commonly used by lawyers and insurance industry critics to describe tactics used to avoid paying claims. It refers to insurers delaying payment, denying a claim and then defending their actions. Health insurers like UnitedHealthcare have become frequent targets of criticism from doctors and patients for denying claims or complicating access to care. 

Investigators recovered several 9 mm shell casings from outside the Hilton and a cellphone from the alleyway through which the shooter fled.

Investigators were also looking into whether the suspect had pre-positioned a bike as part of an escape plan, the official said.

Who was Brian Thompson?

Thompson, a father of two sons who lived in a Minneapolis suburb, had been with Minnetonka, Minnesota-based UnitedHealthcare since 2004 and served as CEO for more than three years. 

His wife, Paulette, told NBC News on Wednesday that he told her "There were some people that had been threatening him." She didn't have details but suggested the threats may have involved issues with insurance coverage. 

The insurer's parent company, UnitedHealth Group Inc., was holding its annual meeting in New York to update investors on its direction and expectations for the coming year. The company ended the conference early in the wake of Thompson's death.

UnitedHealthcare provides coverage for more than 49 million Americans and brought in more than $281 billion in revenue last year. It is the largest provider of Medicare Advantage plans in the U.S. and manages health insurance coverage for employers and state and federally funded Medicaid programs.

In October, UnitedHealthcare was named along with Humana and CVS in a Senate report detailing how its denial rate for prior authorizations for some Medicare Advantage patients has surged in recent years.

The insurance company said it’s focused on ensuring the safety of employees and assisting investigators.

"While our hearts are broken, we have been touched by the huge outpouring of kindness and support in the hours since this horrific crime took place," the company said.

AtlantaCrime and Public SafetyNew YorkNews