Reuters quotes diplomatic and Somali intelligence sources that say the attack may have involved Godane’s secret service, the Amniyat, which has its own chain of command and finances. It may also have included a Shebaab unit called Iktihaam, Arabic for “to storm in.”

Anneli Botha is a senior researcher with the Transnational Threats and International Crime Division of the Institute for Security Studies in Pretoria. She said al-Shabab has always been violent, and is not sure it’s necessarily a change in the group’s leadership that moved the group to an extreme.

"I don’t think the hardliners took control," said Botha.

"Gadane who is still the leader is still a hardliner, and the fight was not between moderates and extremists but between locals and foreigners. There were quite a few eliminations of foreign fighters considered to be potential traitors. Losing ground in Somalia led to suspicion between different factions of al-Shabab and that foreigners may be selling them out."

Yet, the purge within al-Shabab did not eliminate foreign participation. Botha said the Islamic extremist group relies on the participation of regional recruits to help plan and carry out attacks. She said, for example, that a Ugandan cell was instrumental in the 2010 bombings in Kampala that killed over 70 people.

And Kenyan authorities say foreigners appear to be among those involved in the mall assault. Botha said her colleagues in Nairobi had also received tweets claiming to be from al-Shabab naming the nationalities of the attackers. Other news agencies have also received notes allegedly sent by the group. Most have not been independently verified.