A soft target frequented by Westerners, a weak, volatile country and a terror group emerging from a deadly split — it is a lethal combination experts say is the new normal for jihadist groups operating across East Africa, the Maghreb and the Arabian Peninsula.
With smoke still rising from the Westgate mall in the Kenyan capital of Nairobi after an attack that has left at least 72 people dead and more than 150 wounded, forensics experts have begun to piece together evidence from the smouldering ruins while the Kenyan government struggles for answers.
There is little doubt who carried out the attack - al-Shabab, the al-Qaeda-linked militant group has claimed responsibility - but there is scepticism about whether it marks a resurgence of the power of al-Qaeda and its affiliates in the region.
Al-Qaeda's central influence has been waning since the assassination of its leader, Osama bin Laden, two years ago, so it is increasingly forced to rely on local groups such as al-Shabab and the radical Boko Haram in Nigeria as its proxies, experts say.
But is their complex, cross-country co-ordination of fighters and terror attacks for global jihad?
Not likely, says Nigel Inkster, the director of transnational threats and political risk at the International Institute for Strategic Studies and the former director of operations and intelligence for Britain's MI6.
"We can expect to see networks coming together, doing something, breaking apart and moving into something else," Inkster says.
"This was the way that al-Qaeda worked before 9/11 - a band of brothers, a group of people sharing an agenda, looking for opportunities to collaborate."
But it mostly relies on informal links established by individual jihadists and "not in any way indicative of any structural or organisation relationships between groups", he says.
Inkster is sceptical of those who argue that "al-Qaeda Central" drives the international movement.
"Al-Qaeda is very adept at exploiting developments as they occur and seeking to gain credit for activities that take place in other parts of the world with which in practice they have had very little to do," he says.
"What is constant in all of this is a narrative and an ideology, which can attach itself to lots of different causes that are essentially local."
And the primary aims of al-Shabab are very local indeed, he says.
Fighting to create an Islamic state in Somalia, al-Shabab was forced on to the back foot after being expelled from Mogadishu in August 2011 and the port of Kismayo in September 2012 by forces from Kenya and other African Union countries.
The attack on the Westgate mall - frequented by diplomats, Westerners and Nairobi's middle class - was all about punishing Kenya and its allies for their role in that expulsion, Inkster says.
Al-Shabab lost not only control of the towns and cities in southern Somalia but a significant stream of revenue from the taxes it was collecting from Kismayo, a strategic port that allowed the easy transfer of arms and other supplies.
But, he warns, there has been a current in al-Shabab that has been more outward-looking and internationalist since it formally sought an allegiance with al-Qaeda last year.
Shaul Shay, a senior research fellow at the Begin-Sadat Centre for Strategic Studies and the former deputy head of Israel's National Security Council, also argues that al-Shabab's agenda has broadened since it affiliated with al-Qaeda.
"It is now the East Africa branch of al-Qaeda . . . which means that its agenda is not just engaging in local terror operations but also fighting the enemies of Islam," Shay says.
After they were driven from southern Somalia, the group returned to a strategy of guerilla warfare - small attacks on churches, shops and other sites that did not attract a high degree of international interest. "That is why this attack is so different - it is large-scale, typical of a global jihadist organisation, and the modus operandi is similar to the Mumbai operation in 2008," he says.
"Those who are perpetrating the attacks are not afraid to die, in Islamic terms it is a 'self-sacrifice' operation. They . . . chose a target that has significant symbolism. They aim to capture foreigners in order to multiply the effects of the terror attack."
Far from a traditional hostage-taking operation, al-Shabab's aim was not to bargain. Instead,Shay says, they planned to use the hostages as human shields for as long as possible and then kill them.
"The purpose is to embarrass the state and show that it is unable to protect either its own citizens or foreign interests," he says.
The instability that grips the Sahara-Sahel strip and extends to East Africa provides al-Qaeda with the perfect conditions in which to reinvigorate its terrorist campaign against the West by exploiting local grievances, a recent report from Britain's Royal United Services Institute says.
From Yemen, where al-Qaeda in the Arabian Peninsula has been actively trying to win over local tribes, to al-Qaeda in the Maghreb and al-Shabab, these local groups have "undertaken similar patterns of strategic, tactical and propagandistic evolution and refinement".
In the Westgate attack, al-Shabab has sought "to demonstrate that they have strike capacity abroad", says Barak Seener, associate fellow of RUSI and the chief executive of Strategic Intelligentia, a Middle East risk consultancy firm.
"It is precisely due to the split between those with a local agenda and those with an ideological agenda that the latter has been able to overtake the former and link up with al-Qaeda's global agenda of targeting the West."
And jihadist organisations are always at their most dangerous after a leadership split or other damaging event, experts warn.
Hardliner Ahmed Abdi Godane, also known as Mukhtar Abu Zubair, emerged as al-Shabab's leader after months of infighting. Another key leader, Sheikh Hassan Dahir Aweys, recently broke away from the group and is now reportedly in federal custody in a safe house in Somalia.
"It is precisely at a time when an organisation like this is weakened that it is more likely to want to undertake a spectacular attack to reassert its continuing relevance - that is what we are looking at here," Inkster says.
"This is not going to be a one-off - al-Shabab before they were displaced from Kismayo were actively recruiting and proselytising in the shanty towns of Nairobi and other Kenyan cities promising young, unemployed men money and the prospect of a pension for their family in the event of martyrdom."
The Kenyan authorities have previously frustrated a number of plots to be carried out by al-Shabab, he says, and al-Shabab-related individuals have also been involved in attacks against Uganda.
"Indeed, I think a lot of people are surprised something this big hasn't happened in Kenya before," Inkster said.
Follow Ruth Pollard on Twitter @rpollard