[8] The Sunday Telegraph claimed that it had seen United Nations documents that warned that in the previous month the threat of an "attempted large-scale attack" in Kenya was "elevated.

An Al-Shabaab team, led by the Somali national Adam Garaar, conducted extensive reconnaissance of the building, noting entrances, exits, security systems, and other details.

The team visited Nairobi several times to inspect the mall and built a network to covertly obtain weapons, ammunition, SIM cards and a Mitsubishi Lancer.

[12][13] On 17 June 2013, one of the attackers, Mohamed Abdinur Said, known by his nom de guerre as Umayr al-Mogadish,[5] boarded East African Express flight 803 from Mogadishu's Aden Adde International Airport to Nairobi via Wajir and Entebbe, Uganda.

Abdinur, believed to be the group’s leader, made frequent calls to Mohamed Abdi, who was later convicted for his role in planning the attack.

One of the gunmen, Abu Baara al-Sudani (later identified as Hassan Abdi Dhuhulow), entered the Urban Burgers restaurant and fired at the patrons, mostly foreign tourists and expats, killing three and injuring numerous others.

[28][29] Rob Van Dijk, an employee of the Dutch embassy, said that while he was eating at a restaurant the attack started with grenades and was followed by gunfire as patrons screamed and dropped to the ground.

In the aftermath, the Recce Squad members withdrew from the operation, followed by the withdrawal of the army, leaving no significant Kenyan presence in the mall for several hours.

[34][35][36][5][37][38] Goran Tomasevic, Reuters chief photographer for East Africa, recorded the first few hours of the attacks in which he described extremely distressed people including children, women and men bleeding from the impact of shrapnel and gunshots.

An ex-SAS man, Taff Groves, a former member of the Irish Army Ranger Wing, Lorcan Byrne, an off duty member of Diplomatic Protective Services Tactical Response Unit (DPS-TRU), Peter Bach and former British Armed Forces Major Dominic Troulan helped to save lives in the immediate aftermath of the attack.

In Nairobi, daily business returned to normal; appeals replenished blood banks, and over US$650,000 was raised to support the affected families.

[79] From its start, the investigation was hampered by a wide range of conflicting eyewitness testimony about the number of attackers, the gunmen's true identities, and even their ultimate fates.

[80] Over sixty persons were listed by the Red Cross as missing, though police asserted that they were all among the dead; in news reports, some have been described as additional terrorists who escaped alive, though the Kenyan government firmly denies this.

[5] Police recovered the attacker's body under rubble and performed DNA analysis to identify the assailants, who died of smoke inhalation according to autopsy results.

[84][85] Norway's intelligence agency, the PST, later announced in early October that it had sent officers to Kenya to investigate reports alleging that a Norwegian citizen of Somali origin, named as Hassan Abdi Dhuhulow, was also involved in the planning and execution of the attack.

[87] In September 2013, the attackers were publicly identified as Hassan Abdi Mohamed alias Dhuhulow (Abu Baara al-Sudani), Ahmed Hassan Abukar (Khattab al-Kene), Mohammed Abdinur Said (Umayr al-Mogadish), and Yahye Osman Ahmed alias Arab (Omar Nabhan; aka Yahya Golis).

[84][93] Insurance registration found inside of the attackers car led the DCI to two co-conspirators, Abdikadir Mohamed and Abdullahi Dugon Subow, who fled Kenya for Somalia.

[84] Data obtained for the five SIM cards found inside of the car led investigators to Entebbe Airport in Uganda which allowed the NCI to identify the gunmen and two co-conspirators, Hussein Hassan Mustafa and Mohammed Ahmed Abdi.

[94] Identified as Mohammed Ahmed Abdi, Liban Abdullah, Adnan Ibrahim and Hussein Hassan, they were accused of supporting terrorist elements in Kenya, harboring the gunmen in their homes, illicitly registering as a Kenyan citizen, and obtaining false identification documents.

[94] On 7 October 2020, a Kenyan court sentenced three defendants accused of helping Islamic militants in 2013 in preparation for an attack on Nairobi’s shopping mall.

In the verdict, Nairobi Chief Magistrate Francis Andayi ruled that Hussein Hassan Mustafa and Mohammed Ahmed Abdi found guilty of conspiracy to commit a terrorist act.

However, after proving the prosecution's charge, Otsieno Namwaya, a senior Africa researcher at Human Rights Watch, claimed that neither the attackers nor the masterminds had been brought to justice now, the convicts were only bystanders in the case.

Before it was banned, a Twitter account claiming to represent al-Shabaab posted a series of messages alleging that the attacks were "just retribution" for crimes committed by Kenya's military.

[100] The group official spokesman, Sheikh Ali Mohamud Rage, said: "If you want Kenya in peace, it will not happen as long as your boys are in [Somalia].

"[44][103] Foreign Minister Amina Mohamed said that Al-Shabaab was not acting alone and the assault was part of an international campaign of terror; and that "two or three" US citizens and a Briton were among the attackers.

[106] The United Nations Security Council condemned the attack and called on Kenya to note that any response must comply with international human rights law.

[98] Interpol Secretary-General Ronald Noble condemned the assault and pledged full support to Kenyan authorities in their investigation, offering to deploy an Incident Response Team consisting of specialised forensic officers, counter-terrorism experts, operational assistants and analysts.

[107] Noble, in an interview with ABC, indicated that in the face of large 'soft' targets, governments have a choice: security clearances at entrances or allow the citizenry to carry guns for self-defence.

[108] Many countries expressed their condemnation of the attacks and sympathy for those affected, including Argentina,[109][110] Canada,[111] Chile,[112] China,[113] Colombia,[114] Eritrea,[115] Hungary,[116] India,[117] Iran,[118] Israel,[27][119] Italy,[120] Serbia,[121] Somalia,[122] Tanzania,[123] the United States,[124] Venezuela,[125] and Trinidad and Tobago.

"[129] Sahrawi Arab Democratic Republic President and Secretary-General of the Polisario Front, Mohamed Abdelaziz expressed "sadness and dismay about the shocking and cowardly massacre" and offered his country's "deepest condolences" and "heartfelt sympathy".