Profiles of key suspects in last month's terror attack in Nairobi point to the worrying rise of a new generation of Kenyan jihadists, analysts say.
Police are hunting Ali Salim Gichunge, the suspected mastermind of the January 15 attack on the Dusit hotel and office complex that left 21 dead, and Violet Kemunto Omwoyo, described as a Christian convert to Islam.
Their background and ethnic origins are starkly different from that of typical Kenyan members recruited in the past by Al-Shabaab.
Somalia's Al-Qaeda affiliate has mainly used recruits from Kenya's ethnic Somali community or coastal Muslim communities.
In addition, Shabaab's major previous attacks in Kenya, against the Westgate shopping mall in 2013, which left 67 dead, and the University of Garissa in 2015 in which 148 people died, were planned in Somalia.
"Unlike previous attacks that had aspects of external planning and involvement, this particular incident points to local planning," and includes converts from Christianity, a senior police officer told AFP on condition of anonymity.
Gichunge, believed to be aged about 23, is from central Isiolo and is the son of a Kenyan soldier. His name is from the country's largest ethnic group, the Kikuyu.
Omwoyo, aged in her late twenties, is believed to be from Kisii in western Kenya.
The pair shared a home in Ruaka, northwest of the capital, where police say they found guns stashed in a hole in one of the rooms.
Police found the hideout after Gichunge was identified as the owner of a vehicle which transported the attackers to the hotel and office complex.
He was initially thought to be among those killed.
But it emerged both he and Omwoyo were on the run at the time of the operation, and had put household items up for sale in the days before the attack.
Somalia remains epicentre
However, there are still similarities with the Westgate and Garissa attacks.
The five Dusit attackers were all killed during the attack, and at least three of them were from Kenya's ethnic Somali community, one came from the coastal region and another has yet to be identified.
The weapons they used were transported from Somalia via Lamu county where the Islamist group has long held a strong presence in the Boni forest, or via the Mandera town border with Somalia, according to police sources.
Investigators say that Gichunge spent time training in Somalia.
"Somalia remains the epicentre of the Shabaab movement," said Matt Bryden, an analyst with the Sahan think-tank.
However as Shabaab has spread into the region -- hitting five countries with terrorist attacks -- it "has evolved a lot", said Bryden.
In 2015, Sahan warned that to escape scrutiny, the jihadists had shifted their recruiting drive in Kenya away from the big cities of Nairobi and Mombasa to new areas, including the Rift Valley and the west of the country.
The report also noted the increasing recruitment of Christian converts, notably due to the granting of bursaries for Islamic Studies, and of girls and young women.
In this light, Bryden said the involvement of suspects such as Gichunge and Omwoyo was not a surprise but rather a sign that Shabaab's recruitment strategy in Kenya was paying off.
"What we have is a generation that is coming of age. They have just proved that they are able to organise rather complex operations," he said.
The jihadists were recruited by the Kenyan branch of Shabaab, known as Al-Hijra, which the US State Department says has openly recruited in Kenya and facilitated transport to Somalia for "terrorism purposes".
"These are people who know Kenya well, they know the language well, and they can move around the country quite easily," as they do not look ethnically Somali, a Kenyan human rights activist said on condition of anonymity.
The Somali people mainly live in Somalia, but large populations also live in Kenya, Ethiopia and Djibouti.
The new jihadists are radicalised in "areas which are not closely watched" and "they use hideouts in places where the police will not expect them," the source said.
They can do this because of what Human Rights Watch researcher Otsieno Namwaya said is the "ethnic profiling" of jihadists in the country.
"In the minds of many Kenyans, Shabaab are necessarily from the Somali community. The reason for this is they have been blinded by the anti-Somali rhetoric of the government," said Nanwaya.
He referred, among other things, to the government's efforts in 2016 to justify closing the Dadaab refugee camp in the east of the country -- home mostly to Somalis -- by claiming it was there the Westgate attack was planned.
"We're not having the discussions we should have about the reasons that push some Kenyans to radicalise, precisely because we're not asking the right questions," said Namwaya.