Kenyan security agencies have disrupted a planned mass-casualty attack in Nairobi allegedly orchestrated by operatives linked to Al-Shabaab. The plot was reportedly timed to coincide with the holy month of Ramadan, which began on February 18, 2026, and was designed to strike crowded urban locations in the capital.

According to the Counter Terrorism Policing Unit (CTPU), the operation followed months of surveillance and intelligence-led investigations tracking a suspected extremist network with logistical and facilitation links extending from the Dadaab Refugee Complex in Garissa County to Nairobi. Authorities believe elements of the cell exploited refugee settlements as cover while coordinating movements of personnel and material toward the capital.

Weapons and Equipment Seized

During coordinated raids, security officers recovered a substantial cache of weapons and operational materials allegedly intended for deployment in the Capital. The seized items included:

  • Five AK-47 assault rifles
  • Twenty 30-round magazines (approximately 600 rounds of ammunition)
  • One pistol with 24 rounds
  • Six grenades
  • Additional explosive materials
  • Narcotics
  • Injectable Vitamin K
  • Assorted medical supplies

Investigators assess that the quantity of firearms, ammunition, and grenades points to a coordinated, multi-site attack scenario rather than a lone-actor operation. The inclusion of narcotics suggests possible use for operational financing, coercion, or logistical exchange within criminal-terror networks.

Network Composition and Financial Links

Authorities have identified a transnational dimension to the disrupted network. Parallel financial investigations led to the freezing of 13 bank accounts linked to suspected terrorism financing activities. The accounts were held by:

  • 10 Kenyan nationals
  • 2 Tanzanian nationals
  • 1 Ugandan national

Officials believe the accounts were used to receive, store, and transfer funds in support of extremist operations, highlighting regional facilitation channels extending beyond Kenya’s borders.

Intended Modus Operandi

Preliminary intelligence assessments indicate that, in addition to planned bombings or armed assaults in high-density civilian areas, the suspects were exploring secondary operations including:

  • Kidnapping of foreign nationals
  • Hijacking of vehicles to support mobility and potential follow-on attacks

Some operational indicators also suggest attempts to embed operatives within civilian settings in Nairobi, including settlements such as Katche, in order to reduce detection risk prior to execution.

Strategic Context

Kenya remains a high-priority target for Al-Shabaab due to its continued military engagement in Somalia under the African Union stabilization framework. The group has historically demonstrated the capability to conduct complex attacks inside Kenya, combining local facilitation, cross-border infiltration, and financial networks.

The latest disruption underscores both the persistent intent of Al-Shabaab to conduct high-impact urban terrorism and the effectiveness of sustained intelligence operations by Kenyan security agencies. However, the case also highlights enduring vulnerabilities, particularly the exploitation of refugee environments, cross-border financial flows, and decentralized recruitment and logistics cells.

Security agencies have heightened patrols, reinforced checkpoints, and expanded surveillance operations in Nairobi and other major towns as investigations continue. Authorities maintain that the capital remains secure but warn that the threat landscape remains dynamic, especially during religious or nationally significant periods.