Intelligence-led operation conducted by National Intelligence Service (NIS) and SOG elite group from the APS foiled what officials describe as a major terror attack planned for Nairobi during the holy month of Ramadan, disrupting a network believed to be linked to the Somalia-based extremist group Al-Shabaab.

The operation, executed late Tuesday night, was the culmination of what sources describe as weeks — possibly months — of painstaking intelligence work led by NIS officers. 

The suspects were arrested at a Nairobi hideout as they were allegedly finalising plans for a coordinated strike.

A cache of weapons and supplies was recovered during the raid, painting a vivid picture of the cell’s capability. 

Among the items seized were five AK 47 assault rifles — powerful automatic weapons capable of sustained fire — along with twenty magazines loaded with 600 rounds of ammunition, enough to fuel prolonged gun battles. 

Officers also found six hand grenades, small but deadly explosives designed to cause maximum damage in close quarters, and a Makarov pistol with 24 rounds of 9mm ammunition, a compact handgun often used as a backup weapon. 

Security analysts say this arsenal alone demonstrated the group’s readiness to inflict mass casualties and destabilise communities if the plot had not been disrupted.

Beyond the weapons, investigators discovered a range of medical and logistical supplies. 

These included elastic bandages for treating injuries, vitamin K3 injections used to help blood clotting, diclofenac (Powermole) — a painkiller and anti-inflammatory drug, paracetamol (Tekomol) for fever and pain relief, and Nexstep 40mg, a medication that reduces stomach acid, often prescribed for ulcers or reflux. 

Officers also seized four disposable syringes and two cartons of date fruit, a high-energy food source. Taken together, these items reveal the cell’s preparedness not only for combat but also for sustaining operations over time. 

The medical supplies point to an ability to treat battlefield wounds and manage pain, while the food provisions suggest plans for endurance and mobility.

“This cache is chilling in its scope. In the wrong hands, five assault rifles, hundreds of rounds of ammunition, grenades, and medical supplies translate into the ability to wage sustained violence, survive in hiding, and terrorise innocent civilians. Neutralising it before it could be deployed was critical to saving lives,” a senior security official briefed on the matter and who requested anonymity due to the sensitivity of the investigation said.

Security sources confirmed that materials intercepted in recent days indicated that Al-Shabaab operatives intended to stage attacks during Ramadan, which has just begun. 

Intelligence also pointed to discussions involving kidnappings — a tactic the group has previously deployed to generate international attention and ransom revenues.

Behind the arrests was a quiet choreography: communication intercepted and analysed, financial trails traced, safe houses monitored, and movements mapped long before the suspects realised they were under watch.

Officers from the National Intelligence Service — often referred to within security circles as the country’s “sentinels” — are said to have pieced together fragments of encrypted digital communication that hinted at a Ramadan operation. 

That information was relayed to specialised teams, who moved in once surveillance confirmed the suspects’ location and the operational stage of the plot — culminating in the Tuesday night success.

In recent years, Kenya’s counter-terror strategy has shifted decisively toward prevention rather than reaction — a hard-earned lesson from past tragedies. 

Officials say the coordination between intelligence collectors and tactical responders has improved significantly, enabling pre-emptive disruption.

“This was not luck,” the senior security official said. “It was layered intelligence work, cross-agency cooperation, and disciplined execution.”

The foiled plot is the latest chapter in a security story that has defined Kenya’s modern history — the spillover from decades of instability in neighbouring Somalia.

Authorities are now analysing seized electronic devices and documents to map the network’s financing, recruitment pathways, and potential foreign handlers.