Investigation Reveals Terror Network Behind KICC and DusitD2 Attacks

A meticulous investigation has uncovered a definitive connection between the thwarted 2018 bombing attempt at the Kenyatta International Convention Centre (KICC) and the devastating 2019 attack on the DusitD2 hotel complex in Nairobi, authorities announced following a May 22, 2025, court ruling. 

The link, established through extensive analysis of communication records and physical evidence, exposes a sophisticated terror network operating within Kenya and underscores the critical importance of preemptive counterterrorism measures.

The investigation reveals that the same network was responsible for the two attacks. Authorities foiled the initial attack at KICC in February 2018 when counterterrorism units intercepted a vehicle laden with explosives in Nairobi's central business district, preventing a potential mass-casualty event. 

The vehicle was linked to the Al-Shabaab extremist group. While this intervention averted disaster, it also triggered an in-depth inquiry into related terror activities. Nearly a year later, on January 17, 2019, the DusitD2 complex was struck, resulting in numerous fatalities and injuries. The attackers, armed with firearms and grenades, launched a coordinated assault that plunged the upscale hotel into chaos. In the aftermath, investigators meticulously examined the attack's logistics and patterns, seeking connections to previous incidents. 

Their efforts revealed a complex web of coordination among individuals involved in both events. Testimony from Titus Lagat, an officer with Kenya's Anti-Terror Police Unit (ATPU), provided crucial evidence linking the KICC plot to the DusitD2 attack. Mobile phone records played a central role in this discovery, revealing direct communication between suspects involved in both incidents.

One particular phone number, registered to an individual named Abdi Jilo, was identified as a critical node in coordinating activities related to the KICC attack. Subsequently, investigators traced this number to another phone line used to execute the DusitD2 assault. This second number was used by Hassan Kemunto, a key figure in the DusitD2 attack, providing conclusive evidence of the network's coordinated operations.

Investigators determined that Jilo had registered multiple SIM cards, complicating investigative efforts and underscoring the terror group's adaptability in concealing their operations. The use of multiple registered SIM cards not only complicated investigative efforts but also underscored the adaptability of terror groups in masking their operations.

Further analysis of materials seized from ATPU's database corroborated these findings. Additionally, weapons recovered in Meru and Isiolo Counties, including grenades, further cemented the link between these two attacks. Ballistic assessments confirmed that some of the explosives uncovered in those regions matched those used in the DusitD2 operation, strengthening suspicions of coordinated logistics and supply chains among extremists.

The evidence presented during the court proceedings highlighted the network's operational capabilities, including its ability to coordinate attacks despite heightened security measures. Authorities have emphasised the necessity of enhanced monitoring of suspect communications, improved cybersecurity measures, and strengthened cooperation among intelligence agencies. 

While the successful prevention of the KICC attack demonstrated the effectiveness of counterterrorism efforts, the tragic events at DusitD2 underscored the ongoing need for preemptive action against potential threats. Law enforcement officials are urging citizens to remain vigilant and report any suspicious activity, emphasising that vigilance is crucial in dismantling terror operations.

The case and subsequent court ruling highlight the persistent efforts of Kenyan security agencies to dismantle terrorism networks within the country. By leveraging digital forensics, analysing weapon caches, and cross-referencing intelligence, investigators have pieced together a comprehensive picture of how these attacks are conceived and executed.