Director of Criminal Investigations George Kinoti confirmed that they had taken in two more suspects in connection to the attack.
One suspect was arrested in Ruaka estate where one of the attackers is said to have lived for four months prior to the attack.
The other suspect was nabbed in Eastleigh estate by DCI detectives. Kinoti did not disclose how police traced them to their hideouts.
Detectives uncovered a number of leads in the Sh40,000-a-month Ruaka apartment, where a suspects only identified as Farouk had lived since December 1 last year.
The attacker had an assortment of weapons, including grenades and guns believed to have part of the arsenal used during the Tuesday’s attack.
Police were tipped off about the Ruaka apartment by a neighbour who recognised the car — KCN 340E — that was used to ferry the attackers to DusitD2 complex.
According to NTSA records, the car belongs to Cynkim Investment Company Limited, whose email address is registered as daniel.mutongi@gmail.com. It was registered on October 13 last year.
Neighbours described Farouk as a friendly man who interacted freely with them.
Anti-terrorism police on Tuesday night raided the house at Guango estate in Muchatha where Farouk lived with his family.
The man’s real identity was yet to be revealed last evening but police took fingerprints for examination by the Registrar of Persons.
Police said they found a hole in the floor of the three bedroom house where it is believed he was hiding the grenades and guns used in the attack.
A woman, believed to be the Faruok’s wife, was arrested at the home.
Police were still guarding the house yesterday as crime scene officers combed the through the home and interviewed neighbours.
Police officers were also dispatched to Nyeri where the man, who is said to be a Muslim convert, was born and brought up.
Preliminary information obtained by the police indicate the man was born in the Majengo area of Nyeri where his family live.
Police said they had also obtained vital information from a mobile phone found in the vehicle said to have been used by the terrorist.
Forensic examination of the phone revealed that the owner, whom police suspect was among those killed in the hotel, was in constant communication with five other men, some who had been killed in the attack.