From our analysis, they also spent the money on entertainment, lunches and Christmas gifts while eyeing to cause damage to Kenyans; mass killing and maiming.
To jog your mind on how the terror group manages to infiltrate the country, we look at the just concluded Merti case.
Lydia Nyawira Mburu is the poster girl.
The court ordered Nyawira to cool her heels behind bars for three years after finding that she forged IDs that aided the Merti masterminds in accessing the country.
Nyawira told the court that she got instructions from her boss to print the documents while her employer said he was always out of the business premises at River Road. Money changed hands although it was not indicated how much.
Bomb experts told the court that from what he found in the car, anything within a radius of 351 metres would have been destroyed.
This means that if the plot was not foiled, hundreds, if not thousands of Kenyans, would have either been killed or maimed.
Director of Public Prosecution Renson Ingonga told the court that Nyawira was equally responsible and culpable as the terrorists as she opted to enrich herself but put the lives of Kenyans at risk by enabling them get access to the country.
In all cases, it emerges that terrorists first acquire identification cards, then use the crucial documents to register M-Pesa accounts and receive money. The money is either wired through the money transfer bureaus or Hawala and in some instances, through M-Pesa.
An analysis by the police on the Dusit D2 mastermind Ali Salim Gichunge indicated that he received through Mpesa Sh809,900.
Before the attack, Gichunge received Sh70,000 and Sh69,500 in two tranches.
The money was used to rent a house at Muchatha, Kiambu County, purchase a Toyota Ractis KCE 340E and entertain other attackers at a restaurant near Village Market.
In the Merti case, it emerges that the terrorists spent at least Sh3.6 million in moving around and renting houses within Nairobi and Kajiado Counties.
Milimani Magistrate Zainab Abdul sentenced Abdimajit Hassan and Mohamed Osman to 25 years in prison after they were convicted of plotting a terror attack.
Stay informed. Subscribe to our newsletter
The two have, however, served six years meaning they will spend 19 years in prison.
From our analysis, Hassan was the man with the money and it was tabled in court that he used more than Sh3.6 million in the planning.
He told court that he was a livestock dealer, moving animals between Nairobi's Kiamaiko and the North Eastern region.
He later met Yusuf Adan who helped him venture into the same business in Somalia, where he would export animals to the Gulf region.
The two businessmen frequented Somalia and Kenya to run their businesses and he said that they would pay for services in cash and using money transfer bureaus.
Osman, in his testimony, said that he was initially employed by Adan to look after the livestock and that is how he met Hassan who would later become his employer.
According to Hassan, his business grew and that is how he ventured into buying and selling motor vehicles.
He purchased a Mitsubishi Airtek registration number KBM 200D from Fortis Limited for Sh600,000.
He then bought a Honda Civic KBE 449M from Simon Kibuti for USD3,700 (Sh518,000 using the current exchange rate).
Hassan also spent Sh3,000 to rent rooms in Ngara where he spent the night with Antony Kitila and two women.
Due to the nature of his livestock business, he rented a house in Lang'ata that was to be used by Osman. He paid Sh48,000 as rent for three months.
One time, Hassan received USD10,000 and USD5,000 from Somalia via Dahabshil and it was noted that he only filled an anti-money laundering form for the USD10,000.
For his own house, he opted to move to Rongai where he rented an apartment paying USD2,000 (Sh280,0000) after meeting the caretaker at the Galleria Mall where they took coffee.
According to the caretaker, a two-month deposit and rent would have seen Hassan pay Sh180,000 but he ended up paying the Sh280,000 instead.
Hassan later purchased a Toyota Mark X KCL 621K which he sold to Adan.
He said in court that he owed Adan Sh40,000 and that he instructed him to send the money to Antony Kiarie. He received Sh3,000 from Hussein and he told the court that he had been instructed by Adan to send the money to him as a Christmas gift. He later sent Kiarie the Sh40,000. Four assault rifles and twenty-six magazines believed to have been used by terrorists during the Dusit 2 attack in 2019. [Denish Ochieng, Standard]
During one of his movements, he allegedly got into an accident with the Honda Civic, and his taxi driver Kitila advised him to take it to Ngara for repairs.
Hassan sent Kitila Sh18,000 for the works but later called him seeking to have the money back.
Charged alongside Hassan, Osman and Nyawira was John Maina (now deceased).
He received Sh43,000 from Hassan, of which Sh3,000 was a Christmas gift that he said he had been instructed to send by Adan. Hassan later sent Sh40,000 to Maina and he told the court that it was a debt he owed Adan and that he instructed him to share with Maina.
KICC attack plan
Police said that a man who worked as an exhibitor at KICC collected intel about the building's security arrangements and weaknesses in preparation for an attack.
Victor Odede worked for AL-Tc Africa and Protect Exhibitors in 2017 at KICC, but his employers did not know that they were pawns in a big terror game that he planned to take part in.
Investigators believe that Odede was recruited to Al Shabaab by his cousin convicted terrorist Elgiva Oliacha Bwire. He was jailed after confessing that he plotted to carry out grenade attacks in Nairobi County back in 2011.
He was found guilty and jailed for life but the sentence was reduced to 10 years after his legal team exploited botched investigations by police.
He was freed in October 2021 but he was abducted by unknown people at the Globe roundabout together with his mother Jacinta Bwire and driver Willis Otieno and has never been seen since then.
Police claimed that he had gone under and was plotting to carry out attacks and even placed a Sh10 million bounty on him.
Otieno and Jacinta were released by their captors a day later but did not give information about what transpired.
Bwire's lawyer Prof Hassan Nandwa was also abducted by unknown people after he went to file a report with the police about the abduction of his client.
Nandwa was freed 10 days later and was found in a thicket in Mwingi, Kitui County but never gave details of his captors or his experience in their hands.
Following a six-year trial, Odede was sentenced to 20 years in prison for engaging in terror activities. Investigators told court that Odede was in constant communication with his handler on Facebook identified as Mohamed Yare Abdalla.
According to police, Yare who was based in Jilib, Somalia used his account to communicate with Odede who kept on switching between different accounts.
The prosecution said that Yare instructed Odede, to ride a motorcycle from Nairobi to Moyale in Marsabit County and back and repeat the exercise using a bus.
The trips aimed to collect intel on the number of roadblocks on the road and the kind of searches that police were carrying out on passengers.
He was to send the reports to Yare via Facebook. Investigators believe that the intel was to be used to transport terrorists and weapons to carry out different attacks in Nairobi's Central Business District.
After getting satisfied that they had enough to carry out an attack, Al Shabaab heads okayed the mission. Data extracted from the Mitsubishi's GPS tracker showed that after the purchase it was driven from Nairobi on February 1, 2018, at around 3pm. It was then seen in Meru the following day then in Isiolo on February 3 and eventually at Bur Ache, Somalia two days later.