NAIROBI - One month after Somalia's Shebab fighters stormed Kenya's Westgate shopping mall and massacred dozens of people, the threat from regional sleeper cells or local sympathisers remains high, analysts warned.
"If you haven't learnt the lesson Westgate, more is coming," read posters put up this week at rallies in the southern Somali port of Barawe, a stronghold of the Al-Qaeda linked militants.
"For every Muslim killed in Kismayo, Kenya will pay the price," another read, referring to a city Kenyan troops captured last year.
The attack on the Nairobi mall which left 67 dead marked a significant and worrying step up in Shebab operations, and had required long periods of surveillance and planning, security experts said.
Richard Dowden, head of Britain's Royal African Society, has warned that the Westgate attack suggests Shebab commanders have shifted from "Somali internal politics and closer to Al-Qaeda's global agenda."
Tackling the Shebab is on two key fronts: militarily inside Somalia where African Union troops have been battling the Islamists since 2007, but also in the wider region, especially those countries whose armies are in Somalia, including Burundi, Ethiopia, Kenya and Uganda.
Earlier this month US Assistant Secretary for African Affairs Linda Thomas-Greenfield told the Senate Foreign Relations committee the Westgate "attack suggests that violent extremism in the Horn of Africa may be evolving." Security remains on high alert, with the US embassy in the Ugandan capital Kampala warning this week it "continues to assess reports that a Westgate-style attack may soon occur".
The AU force in Somalia has requested its size be boosted by a quarter to 23,000 troops and President Hassan Sheikh Mohamud urged "total war" on the Shebab "to deny them territory and the space to train and plan".
Shebab recruits across east Africa
But territorial gains inside Somalia alone will not eliminate the Shebab - or Islamist forces aligned to the extremists - across the wider region.
Foreign fighters from Western or Arab nations with the Shebab in Somalia have gained much of the focus in recent years.
On Friday, a Norwegian citizen of Somali origin, a 23-year old Hassan Abdi Dhuhulow, was named by the BBC as being suspected of being one of the attackers, although relatives in the Norwegian town of Larvik denied the claim.
But dozens, if not hundreds, of young men from countries across the Horn of Africa have also trained with the Shebab inside Somalia, according to United Nations experts.
Others are feared to have been radicalised at home.
"There are local sympathisers of the Shebab or aligned groups across eastern Africa, but so far their actions have been limited to fairly low scale attacks such as throwing grenades or shooting security forces," said a Western security source.
"The attack at Westgate was of a different scale, requiring far more planning, funding and training. The Shebab has the capability of sending specially trained recruits, waiting for the order to carry out specific large scale action." The UN monitoring group on Somalia noted in its latest report in July the dangers posed by Kenya's Islamist Al-Hijra group, a radical organisation formerly known as the Muslim Youth Center, linked to the Shebab as well as groups in neighbouring nations.
Those include Tanzania's Ansar Muslim Youth Center, as well as groups in Rwanda and Burundi.
"Al-Shebab continues to pose a regional and international threat through its affiliates," the UN report read, noting that as AU troops have seized more territory in Somalia, there has been an "increasing exodus" of foreign fighters, some of whom left "with the intention of supporting jihad in the region".
Exactly who the attackers at Westgate were is not known, whether it was a team specifically sent from Somalia or even if they were a "homegrown" team recruited in Kenya itself.
The Shebab have carried out large scale attacks in Somalia and the region before, such as an attack on a UN compound in Mogadishu in June or bombings that killed 76 in Kampala in 2010.
"More than a dramatic jump in capacity, the (Westgate) attack shows a change in focus and motivation by Al-Shebab's core planners," said Devon Knudsen, of the US-based Africa Center for Strategic Studies.
Some argue that the Westgate masterminds hoped to spark reprisals against Somalis in the country - including both the half a million refugees and Kenya's sizable ethnic Somali citizens - that would radicalise more to join the Shebab.
The Shebab emerged as a force in Somalia with attacks on Ethiopian troops during its 2006 invasion of Somalia.
"Al-Shebab's greatest recruiting tools are revenge, nationalism and exclusion," wrote EJ Hogendoorn of the International Crisis Group.
He said the public claim of responsiblity for Westgate was aimed to "trigger a backlash against Somalis - and Muslims - in Kenya and in southern Somalia." For the Shebab, their propaganda message at least is clear, warning in another placard paraded on trucks loaded with heavily armed fighters: "Westgate was just the beginning."