A 15-year-old boy is among five suspects held by the Anti Terrorism Police Unit for 21 days in relation to their possible involvement in aiding the Dusit attack.
The minor was arrested in Mandera town on January 28.
ATPU's inspector Shadrack Mumba said the minor received a parcel from the leader of the attackers Ali Salim Gichunge on July 7 last year and was also found with a mobile phone used to register the Facebook account used by the coordinators of the attack.
Others are Mohamed Hassan Sheik, Mire Abdulahi alias Jeery, Ali Issak Ahmed and Yussuf Maulid Hamud.
Mumba said the five were arrested due to their possible involvement in aiding and abetting the terrorist attack where 21 people were killed in 14 Riverside drive.
Sheik was arrested in Mandera on January 27.
Mumba said Sheik was in constant communication with a mobile phone number whose user facilitated the movement of Gichunge's wife Violet Kemunto from Mandera to Somalia.
The said mobile user also received Kemunto's luggage from Gichunge on January 12.
Jeery is believed to have provided internet services to coordinators of the attacker on diverse dates before and during the attack.
He was found with a mobile phone - using Hormuud telecommunication services provider in Somalia, Modem and Hawala transaction documents suspected to have been financing terrorist activities in and out of Kenya.
Mumba said Jeery was also found with a passport believed to have been acquired fraudulently as the same passport number is allocated to another person.
Ahmed was arrested on January 29 in Mandera town where he worked as a sub-agent of Faramacell communication.
The firm is said to have registered a sim card used by suicide bomber Mahir who blew himself at the Dusit Hotel Complex compound.
The sim card was recovered at the scene of the blast.
Ahmed and Hamud were arrested on January 30 in Mandera.
They are employees of Faramacell communications which registered a sim card at Muntaz Electronics Shop in Mandera using a female's [Isnina Abdirahman] ID card.
The card was also recovered at the scene of the attack.
Mumba said after perusal of the five suspects' phones, they were found to have been in communication with several phone numbers located in Somalia.
In the application filed before the court by state counsel Harrison Kiarie, Mumba said the suspects are being investigated over terrorism and related offences including conspiracy to commit a terrorist act, provision of property and services for the commission of a terrorism act and membership to a terrorist group.
Mumba said intelligence has established the attackers had other associates in the country, therefore, there is need to carry out detailed investigations into their activities.
The detective said the suspects' phones are being analysed and their call data records will be used to aid investigators in tracing other conspirators who worked with them.
He said the five are a flight risk and should thus remain in custody during the investigations.
Senior resident magistrate Caroline Nzibe granted the custodial orders.