Al-Shabaab’s operational tactics in Northern Kenya have evolved from sporadic, large-scale attacks to more insidious, localised and technologically savvy methods, according to locals and security agencies.
While the region remains a high-risk area due to its porous border with Somalia, the tactics have shifted towards exploiting local community dynamics, utilising improvised explosive devices (IEDs) and engaging in economic sabotage.
The Al-Qaeda-linked militants now target security camps, government installations and public transport along major roads in the region.
The Nation
“This attack was carried out by people who understand the area very well. They knew where both the chief and the teacher lived and what routes to use to avoid detection,” Hulugho Deputy County Commissioner Elijah Mutemi said.
Ambrose Kimiti, the Kenyan medic who was captured by Al Shaabab in Somalia on January 10, 2024.
Photo credit: Pool
The sub-County Intelligence and Security Committee chairman insisted that the attack was carried out by locals working with Al-Shabaab.
In Hulugho, the attackers are said to have exploited a wedding ceremony to evade detection by local security agencies.
“There were several wedding ceremonies since Thursday and the last was on Sunday evening. We are suspecting the attackers used these ceremonies to blend in and evade security checks,” a security officer privy to the incident confided.
He added: “When taking advantage of the weddings, the militants disguise themselves as guests and, as vehicles move freely, they ferry their weapons and identify their targets.”
When asked, Mr Mutemi denied knowledge of any wedding in the area but revealed that the chief had been a target for about three years.
“This chief reported threats to his life in 2023 and the necessary action was taken. It seemed those who wanted him dead retreated, only to strike when least expected,” he said.
A teacher in Hulugho said the week-long wedding ceremonies in different homes within the area were suspicious, as new faces could be seen around, but being social gatherings, nobody bothered to question the guests.
Communication towers destroyed
In continued operations in the region, the militants have also sabotaged critical infrastructure, such as destroying communication masts (telecommunication towers), to disrupt security communication and intelligence sharing, isolate communities and target non-locals or non-Muslims.
The Al-Qaeda-linked group has increased its use of digital platforms for propaganda, radicalisation and recruitment, targeting young people in rural Northern Kenya and shifting the battlefield to virtual space.
Al-Shabaab fighters.
Photo credit: File | AFP
In many parts of the region, locals have lived with the burden of paying taxes to the Al-Shabaab group.
There are reports of militants demanding “taxes” or protection money from local businesses and pastoralists, using the proceeds to fund their operations and enhance their logistical capabilities.
In some parts of Mandera, pastoralists reported paying to use certain water points and grazing fields.
The taxes are paid in cash or livestock, with camels or several cattle handed over to the terror group, which later sells them to finance operations.
Border points have also been exploited by the terror group through the corruption of officers manning entry and exit points to facilitate the smuggling of weapons and personnel.
Where officers become difficult, militants apply force to intimidate them.
On January 14, 2026, two National Police Reservists (NPRs) were killed in Mandera after an improvised explosive device exploded.
The two were part of a group of six manning a border point in Mandera town when the incident occurred at about 5pm.
Preliminary investigations pointed to possible Al-Shabaab involvement in the smuggling of goods into Mandera town.
In the region, terrorism continues to thrive primarily due to porous borders with Somalia, deep-rooted historical marginalisation and the exploitation of clan-based conflicts by Al-Shabaab.
The group has maintained its presence by exploiting local grievances against the government, high levels of youth unemployment and the logistical challenges of securing a vast, remote and sparsely populated area.
The long, largely unmonitored Kenyan border with Somalia allows Al-Shabaab militants to cross into Kenya, attack and retreat to safety.
Al-Shabaab militants attacked the Qahira Hotel in Beledweyne, Somalia, where government officials and local elders were meeting.
Photo credit: File
Security analysts say continued instability and the lack of a strong central government in neighbouring Somalia provide fertile ground for Al-Shabaab, which then exports violence into Kenya.
The transition and drawdown of the African Union Transition Mission in Somalia (ATMIS) have also created security vacuums that militants are exploiting.
Mr George Musamali, a security expert, said historical marginalisation and harsh economic conditions aid militant exploitation in Mandera, Wajir and Garissa counties.
He cited the long, porous border and sparse population as key drivers of militant presence in the region.
“Our long and porous border cannot be properly manned by security agencies. They cannot be at every point, and this allows militants to cross in and out with ease,” he said.
Sympathisers enable terror
“Families are spread across the border, making it easy for Al-Shabaab to have sympathisers and plant sleeper cells,” he said.
Mr Musamali said militants exploit vast unoccupied land and plant spies (Aminyat) among the population to gather intelligence.
Al-Shabaab also exploits local clan rivalries, sometimes forcing communities to take sides or aiding them in disputes, complicating law enforcement.
This was echoed by Mr Ali Hussein, a Wajir resident and retired security officer.
He said some militants are of local origin, giving them deep knowledge of terrain and community dynamics.
These sentiments were confirmed by a recent intelligence report shared among security agencies, which identified a former NPR and resident of Elgolicha in Mandera South as a coordinator of Al-Shabaab activities.
Failed security and intelligence strategies have alienated local communities, creating deep mistrust between civilians and security forces.
“We have a Nyumba Kumi plan, but it is not working because we fear retaliation. Anyone suspected of aiding the government becomes a target,” said Ms Halima Shure, a Mandera resident.
“For a long time, Al-Shabaab has exploited religious intolerance, using mosques, madrasas and schools to radicalise youth,” she said.
Low school enrolment, worsened by the flight of teachers, leaves young people vulnerable to extremist propaganda.
Between 2024 and 2025, attacks using IEDs escalated, killing 107 people in 2024, a 19 per cent increase from 2023.
The region remains a “theatre of operations” where Al-Shabaab continues to assert influence through intimidation and violence.
A report by IGAD’s Centre of Excellence for Preventing Violent Extremism (ICEPCVE) noted that although the overall scale of attacks declined, targeted and cross-border incidents persisted.
On January 1, 2026, police at Diif in Wajir County lost their station vehicle to militants during daylight.
The driver, Mr Tonny Githinji, was shot in the head and thrown out as the attackers sped towards Somalia via Hambalash Road.
On January 2, Mr Mohamed Muktar lost his vehicle to suspected militants in Mandera town after his driver was shot and thrown out. The Toyota Land Cruiser has not been recovered.
On December 30, 2025, militants attempted to attack a Special Operations Group camp at Fino in Lafey Sub-County, firing two rocket-propelled grenades.
On December 16, 2025, security agencies repulsed an attempted attack on a Chinese contractor’s residence near Elwak Police Station.
The attackers, about 40 militants, were ferried in four Toyota Probox vehicles. How they assembled undetected remains unclear.
During the firefight, an armoured personnel carrier was disabled, six vehicles were damaged and police expended 2,956 rounds of ammunition.
According to the latest IGAD analysis, Kenya faced heightened vulnerability to cross-border spill overs between July and September 2025, a challenge that extended into the final quarter of the year.
