Kenyan security agencies have foiled what officials describe as a major terror attack planned for Nairobi during the holy month of Ramadhan, disrupting a network believed to be linked to the Somalia-based extremist group Al-Shabaab.
The operation, executed late Tuesday night, was the culmination of what sources describe as weeks — possibly months — of intelligence work led by officers drawn from the National Intelligence Service (NIS) supported by the multi-agency Special Operations Group.
Suspects were arrested at a hideout in Kajiado County where they were allegedly finalising plans for a coordinated strike.
Security agents seized 10 Kenyans, two Tanzanians and a Ugandan as they planned to leave for Nairobi. The Dadaab refugee camp has been identified as their operation base.
The terror cell was prepared for sustained combat and endurance. Kenyan security forces seized five AK-47s, 600 rounds of ammunition, six hand grenades and a Makarov pistol.
Photo credit: Pool | Nation
Among items seized were five AK 47 assault rifles — powerful automatic weapons capable of sustained fire — along with 20 magazines loaded with 600 rounds of ammunition, enough to fuel prolonged gun battles.
The multi-agency team also found six hand grenades, small but deadly explosives designed to cause maximum damage in close quarters, and a Makarov pistol with 24 rounds of 9mm ammunition, a compact handgun often used as a backup weapon.
Sources said this arsenal alone demonstrated the group’s readiness to inflict mass casualties and destabilise communities had the plot not been disrupted.
Gilbert Masengeli, Deputy Inspector-General of Police
Photo credit: File | Nation
“This was an intelligence-led operation carried out in collaboration with the Special Operations Group (SOG), a multi-agency unit. We managed to thwart their plan, foiling it at the planning stages. From our initial investigations, the plan was to target densely populated areas in Nairobi during the holy month of Ramadhan. We must remain vigilant and we appeal to the general public to volunteer information on anything that may threaten the peace should they notice anything suspicious,” Mr Gilbert Masengeli, Deputy Inspector-General of Police, told the Nation on Wednesday evening.
Beyond the weapons, investigators discovered a range of medical and logistical supplies. These included elastic bandages for treating injuries, vitamin K3 injections used to help blood clotting, diclofenac (Powermole) — a painkiller and anti-inflammatory drug, paracetamol (Tekomol) for fever and pain relief, and Nexstep 40mg, a medication that reduces stomach acid, often prescribed for ulcers or reflux. The NIS and SOG officers also seized four disposable syringes and two cartons of dates, a high-energy food source.
The terror cell was prepared for sustained combat and endurance. Kenyan security forces seized five AK-47s, 600 rounds of ammunition, six hand grenades and a Makarov pistol.
Photo credit: Pool | Nation
Together, these items reveal the cell’s preparedness not only for combat but also for sustaining operations over time. The medical supplies point to an ability to treat battlefield wounds and manage pain, while food provisions suggest plans for endurance.
“This is a major operation and one which thwarted what would have been a significant terror attack. We have them in custody. At this stage we do not wish to disclose the number of suspects or the intended target because we are still interrogating them to disrupt the entire network and support system they had established,” a highly placed Office of the President source briefed on the mission said.
Security sources said materials intercepted in recent days indicated that Al-Shabaab operatives intended to stage attacks during Ramadhan, which has just begun. This year has a rare coincidence of Islam’s Ramadhan and Christian’s Lent starting together.
Intelligence also pointed to discussions involving kidnappings — a tactic terrorists have previously deployed to generate global attention and ransom.
Behind the arrests was a quiet choreography: communication intercepted and analysed, financial deals tracked, safe houses monitored, and movements mapped long before the suspects realised they were under watch.
Officers from NIS — often referred to within security circles as the country’s “sentinels” — are said to have pieced together fragments of encrypted digital communication that hinted at a Ramadhan operation. That information was relayed to specialised teams, who moved in once surveillance confirmed the suspects’ location and the operational stage of the plot — culminating in the Tuesday night success.
A view of Uhuru Park and the Nairobi Skyline.
Photo credit: Jeff Angote | Nation Media Group
In recent years, Kenya’s counter-terror strategy has shifted decisively toward prevention rather than reaction — a hard-learned lesson from past tragedies. Officials say coordination between intelligence officers and tactical responders has improved significantly, enabling pre-emptive disruption.
“This was not luck,” one security official said on condition of anonymity. “It was layered intelligence work, cross-agency cooperation, and disciplined execution.”
“They (suspects) were also identified as conduits for receiving and transferring funds to support extremist activities across East Africa. Nairobi remains secure due to the tireless efforts of our security agencies. Our detectives continue to track down all individuals linked to these dangerous networks,” counter terrorism policing unit said in a statement.
The foiled plot is the latest chapter in a security story that has defined Kenya’s modern history — the spillover from decades of instability in neighbouring Somalia.
Since the collapse of Somalia’s central government in 1991, Kenya has faced the consequences of a protracted civil conflict that created fertile ground for militant groups. The emergence of Al-Shabaab in the mid-2000s transformed that instability into a direct and organised threat.
Kenya’s 2011 military incursion into Somalia under Operation Linda Nchi, later integrated into the African Union mission known as AMISOM, marked a turning point. While aimed at neutralising cross-border threats, it also placed Kenya squarely in the group’s crosshairs.
Over the past decade, Kenya has endured high-profile attacks — from the Westgate Mall siege in 2013 to the Garissa University massacre in 2015 and the DusitD2 complex attack in 2019 — each claimed by Al-Shabaab. These incidents forced a sweeping overhaul of intelligence sharing, urban surveillance, and rapid-response capabilities.
Hussein Mohamed Abdille Ali (left)and Mohamed Abdi Ali, the DusitD2 attack financiers, when they appeared before Kahawa Law Courts. They were each sentenced to 30 years each in jail.
Photo credit: Simon Ciuri | Nation Media Group
Security analysts note that extremist networks have since adapted, shifting from large, spectacular assaults to smaller, decentralised cells that are harder to detect. Tuesday’s operation suggests that Kenyan agencies are evolving as well.
Security officials say extremist propaganda has historically framed Ramadhan as a period of heightened ideological significance, often encouraging followers to mount attacks. As a result, Kenyan security agencies typically elevate alert levels during the month.
Intercepted communications in this case reportedly referenced both direct attacks and kidnappings — indicating a possible multi-pronged strategy designed to sow fear and erode public confidence.
Authorities are now analysing seized electronic devices and documents to map the network’s financing, recruitment pathways, and potential foreign handlers.
