Three Kenyan nationals and two Somalis linked to the Dadaab refugee camps in northeastern Kenya carried out Al-Shabaab's January attack on the DusitD2 hotel complex in Nairobi, according to a report by United Nations experts.
A fourth Kenyan citizen based in Mandera served as "a key financing link between Al-Shabaab in Somalia and the attacking cell in Kenya," adds the report issued on November 12.
The findings lend some substance to Al-Shabaab's claim in June that it has recruited "an army of fighters from the Kenyan population itself."
The Dusit attack also highlights what the UN experts describe as "a newly observed dimension of Al-Shabaab's recruitment strategy."
"The possession of criminal skills, including knowledge of evading law enforcement, are privileged over ideology or affiliation with certain mosques or religious networks," the report says.
Ali Salim Gichunge, born in Isiolo in 1995, is named as the organiser and coordinator of the Dusit attack which left 26 people dead, including a suicide bomber and four gunmen.
"Unusually for a Kenyan operative within Al-Shabaab," the report notes, "Gichunge was given wide discretion and autonomy over the particulars of the plot -- including the selection of the target -- rather than being directly overseen from Somalia."
Gichunge and his wife, Violet Wanjiru, established a safe house in Guango Estate, Muchatha, a small urban centre on the outskirts of Nairobi, about nine months prior to the attack, the report reveals.
Another Kenyan national, Osman Ibrahim Gedi, served as Gichunge's lieutenant.
The assault on the Dusit complex began at 3.28pm Nairobi time on January 15 when a third Kenyan, Mombasa-born Mahir Khalid Riziki, detonated a suicide bomb, the report recounts.
Siyat Omar Abdi, a Somali born in the Dadaab refugee complex in 1992, was among the gunmen who stormed the hotel.
The UN experts say they obtained a Dadaab identification and ration card number attributed to Abdi through his fingerprint. But officials with the UN refugee programme in Dadaab say there is no record of Abdi in their databases, the report notes.
A fifth member of the Dusit attack unit has not been identified but is presumed to be of Somali origin, the report says. He activated a new Kenyan phone number in Dadaab's Dagahaley camp on December 15, 2018, the report states.
Abdi Ali Mohamed from Mandera was the financing link. He used three phone numbers to transmit close to Sh70,000 to Gichunge via M-Pesa.
"A conservative estimate of the total cost of the DusitD2 operation was between $45,000 (Sh4.59 million) and $50,000," the experts suggest.
Riziki, the suicide bomber, was recruited in 2014 by Ramadhan Hamisi Kufungwa, described in the report as "a well-known Kenyan al-Shabaab recruiter now located in Somalia."
The recruitment was centred on the Musa Mosque in Mombasa, which the experts say "has long been associated with radicalisation, recruitment for al-Shabaab, and religious violence."