On January 15, 2019, a coordinated attack perpetrated by Al-Shabaab occurred at the DusitD2 complex in Westlands District, Nairobi, Kenya. The attack began at around 14:30 EAT (UTC+3), shortly after a suicide bomber blew himself up near the centre of the complex at a restaurant. Four attackers carried out a mass shooting for over 22 hours which left 22 civilians, one Kenyan soldier and all five militants dead.
Al-Shabaab claimed responsibility for the attack in a statement published through the AS-affiliated Shahada News Agency shortly after the attack, with its external operations branch, the Saleh An-Nabhan Battalion, claiming being responsible.
Kenya's President Uhuru Kenyatta said that the five militants that carried out the attack were all "eliminated" by security forces following a 19-hour operation led by Kenyan forces.
Background
Kenya has been subject to major terrorist attacks starting from a devastating bombing that hit the US embassy in Nairobi in 1998, followed by the attacks in Mombasa in 2002, the Westgate shopping mall attack in 2013 and the Mpeketoni attacks in 2014. Kenya had targeted Al-Shabaab during its intervention in the Somali Civil War on behalf of the Federal Government of Somalia and the regional state of Jubaland. The Islamist militant group Al-Shabaab has been opposed to Kenyan involvement in the Somali Civil War.
Location
The attack occurred at the 14 Riverside Drive complex in Westlands, Nairobi, Kenya. This is an upscale hotel and office complex which hosts the DusitD2 Hotel and the Commission on Revenue Allocation. Other clients of the complex include: Adam Smith International, Amadeus IT Group, LG Electronics, I&M bank, Jhpiego, SAP East Africa and Cellulant Kenya Ltd.
Preparation
In the lead-up to the attack, the militants used various methods to prepare. Some of the attackers are believed to have entered Kenya through El-Wak in Mandera Country, and made their way to Nairobi to meet with the operational leader, Ali Salim Gichunge, and to receive instructions on their role on the attack.
A few weeks before the attack, one of the cars, a Toyota Ractis, was allegedly parked near the target location. According to a street vendor, the car was often seen parked by the roadside with the occupants remaining inside or occasionally leaving to get coffee. Two days before the attack, a restaurant waiter noticed one of the terrorists, identifiable by a significant scar on his hand, visiting the restaurant and ordering coffee.
Following ballistic examinations, the weapons obtained by the attackers were found to have been Type 56-2 assault rifles, which are AK-47 variants manufactured in China and are commonly used with attacks carried out by the Al Shabaab. The Somali National Army also uses similar firearms which were purchased from Ethiopia in 2013, likely suggesting these were firearms seized by Al Shabaab in the numerous raids perpetrated on the SNA by the militant group.
Attack
At 14:30 on 15 January 2019, a Toyota Ractis containing four of the attackers pulled into the driveway of the 14 Riverside Drive complex, while a fifth attacker, Mahir Riziki, separately made his way to the Secret Garden Restaurant. Riziki stood near the restaurant for about a minute before blowing himself up, killing seven patrons and hotel staff. Simultaneously, the four other attackers ditched their car near the entrance of the complex, and began firing.
They threw two grenades at nearby parked cars at the entrance gate, setting them alight, then split into groups of two, with the first group making its way to the Hanover office block and the other group heading towards the Secret Garden Restaurant on the other side of the building where Rikizi had detonated his explosive vest. The gunmen regrouped and arrived at the far end of the complex, killing six people. They then entered the DusitD2 Hotel, and fired at the remaining guests inside.
Initial reports were of gunfire and two explosions at the hotel, with one originating from the suicide bomber and the other from the grenades thrown by the shooters. The Recce company, the anti terrorism division of the Kenya police force, General Service Unit, were sent in to combat the militants. Members of private security forces and unarmed individuals along with some off duty police officers were first to respond.
A British SAS operator, who was in the country to conduct training, responded to the attack and entered the complex. Known by his nom-de-guerre, Christian Craighead, he wore a shield badge on his tactical vest and a balaclava over his face, while indicating an "Agent" insignia to bystanders. He was joined by Dan J. Prastalo, a Slovenian and member of the Diplomatic Protective Services Tactical Response Unit (DPS-TRU).
Craighead led the group clearing each floor of the office and car park buildings. They were heard shouting call sign "Eagle Eagle Security Forces" as they tried to call out hostages that were hiding. Both individuals were seen on the mainstream media clips escorting groups of hostages and carrying wounded ones, before running back into the complex while the attackers were shooting down on them. The Australian High Commission security detail also exchanged fire with the terrorists as they made their way into the complex, injuring one attacker. While it had been thought that the attack had been neutralised after a few hours, gunfire and explosions were again heard early on 16 January. Craighead shot and killed two of the attackers and was awarded the Conspicuous Gallantry Cross for his extreme bravery.
Al-Shabaab claimed responsibility in a statement that was released during the attack. They claimed that the attack was in revenge for Kenyan military action in Somalia, as well as "a response to US President Donald Trump's decision to recognise Jerusalem as the capital of Israel".
Casualties
The attack left at least 22 dead including a number who subsequently died of their wounds, and some 30 more injured, some critically. President of Kenya Uhuru Kenyatta initially said that 14 people had been killed. On 16 January, it was reported that 21 civilians and five attackers had been killed. Almost a year after the attack, on 3 January 2020, hotel nurse Noel Kidaliza, who was critically injured during the attack, died of her wounds at a hospital, bringing the death toll to 22. One GSU officer Japhet Ndunguja, was killed in the attack.
Nineteen Kenyan citizens, an American and a British-South African man died during the attack. On the same day, the Australian embassy denied allegations that one of the fatalities was an Australian. US citizen Jason Spindler, who survived the September 11 attacks, was among those killed. Initially both Kenyan and Australian media houses had stated that one of the victims was an Australian citizen and was visiting his girlfriend in Kenya before his death in the attack.
Perpetrators
Five men are believed to have carried out the massacre. Two of the attackers were ethnic Kenyans, while the other three were Somali. Within days of the attack, the Kenyan government had released the names of two of the attackers and was able to confirm the identity of a third attacker but withheld their name, while the other two Somali attackers weren't identified until December 2020 following Al-Shabaab's media wing, Al-Kataib, releasing a film showing them in the days prior to the attack.
Ali Salim Gichunge (born 1995), also known as Abu Sakeena, was the operational leader of the attack. He was born in Isiolo to a Muslim Kikuyu family, with his father being a serving KDF soldier. He studied at Hekima Primary from nursery to Standard Six. He sat his Kenyan Certificate of Primary Education exam in 2007 and scored 355 out of 500 possible marks. After graduating secondary school at Thuura Boys High School in 2011, he studied IT and was hired by a local hotel to manage its internet cafe.
In early 2016, Gichunge informed his family that he had begun working at a construction site in Mombasa after being invited to do so by a friend, however the friend told the family a month later that he had lost all contact with him. Gichunge then told his family that he had begun studying Islam in Uganda. In 2017, he contacted his family saying that he was in Lamu to leave the country, but said he would return soon, however the family did not hear from him for two years.
Mahir Khalid Riziki, (born 5 February 1993), also known as Jibril, was the suicide bomber who blew himself up at the Secret Garden Restaurant on 14 Riverside Drive. He was born and brought up in Majengo area of Mombasa, and was a known extremist with a history of violence. He had been a frequent attender at the Musa Mosque, a place commonly associated for nearly a decade as a key radicalization and recruitment center for Al-Shabaab, where he met Ramadhan Hamisi Kufungwa, a recruiter and member of Al-Shabaab.
In October 2014, Mahir was implicated in the killing of a police officer in Mombasa and following a warrant for his arrest, he fled to Tanzania in November 2014. By early 2015, he had told his family that he was now in Somalia training with Al-Shabaab. Just two days before the attack, on January 13, 2019, Riziki had re-entered Kenya through El-Wak in Mandera Country, and took a bus to Nairobi to link up with the attack cell leader, Ali Salim Gichunge, and to obtain instructions on what his part in the attack would be. He blew himself up just 48 hours later.
Osman Ahmed Hassan, (born 1992), also known as Azzam, was one of the gunman involved in the attacks. He was born in Wajir, Kenya and was of the Degodia tribe. He allegedly received no formal education and was a mechanic. The video released by Al-Shabaab in 2020 shows him speaking to the other attackers in both Swahili and Somali in an apartment block in Nairobi, as a video of Osama Bin Laden plays in the background.
Muhammed Adam Nur, also known as Farhaan Yare, was one of the gunmen involved in the attacks. He was born in Somalia and was of the Hadame tribe.
Abdulqani Arab Yusuf, also known as Farhaan Dheere, was born in Somalia and was of the Muhammed Zubayr sub-clan of the Ogaden clan.
Responsibility for the attack
Al-Shabaab claimed responsibility for the attack shortly after in a statement released via Telegram by Shahada News Agency. Soon after, Al-Shabaab released a two-page statement in both Arabic and English titled "Jerusalem will never be Judaized". The militant group said that it “carried out this operation – code named Operation ‘Jerusalem will never be Judaized’ – in accordance with the guidelines of Sheikh Ayman al-Zawahiri,” and claiming that the attack was executed due to Kenyan military involvement in Somalia, as well as the US recognizing Jerusalem as the capital of Israel. Al-Shabaab stated that the external attack unit known as the "Saleh Nabhan battalion", named after the Al Qaeda operative killed in a drone strike in Somalia, was responsible.
On 22 May 2025, a court in Nairobi convicted Hussein Mohamed Abdille Ali and Mohamed Abdi Ali of helping facilitate the attack by providing funds and fake identification documents. They were sentenced to 30 years' imprisonment on 19 June.
Investigation
Immediately after the incident concluded, the 14 Riverside Drive complex and its immediate environs were closed to public as police termed the area an active scene of crime. Security agencies were able to trace the residence of the terror suspects to Kiambu, Mombasa and Nyeri counties. Further investigations revealed that the suspects had lived in a nearby residence for three months. On the day of the attack, the suspects put their household items up for sale on Facebook, announcing plans to move out of Nairobi.
Hours after the attack, anti-terrorism police raided their home, arresting two women and seizing evidence. The Toyota Ractis driven by Ali Salim Gichunge to the entrance of the DusitD2 complex was later found to have been rigged with explosives, which were detonated by police a short time later. Investigators recovered two mobile phones, a Safaricom SIM card, a Nokia Phone without a sim card and a black HP EliteBook laptop, all of which had been extensively damaged.
The SIM card led investigators to the first person of interest named in the court documents: an individual identified only as Erik. According to investigators, Erik's ID card was used to register 11 other SIM cards, which were linked to two taxi operators, an M-Pesa agent, and a Canadian national. Investigators say Salim's mobile phone numbers were used to call to several phone numbers traced to Somalia. On 19 January 2019, five people appeared in court accused of assisting in the terrorist attack, among them a Canadian-Somali. By the 21st of January, 11 people were detained for allegedly aiding the attackers.