Fresh details suggest Ali Salim Gichunge, the gunman said to have been residing in Ruaka, is alive.
Earlier reports had suggested that Gichunge was among the six gunmen who stormed Dusit2D hotel-complex.
The reports of him being one of the attackers emerged after Ruaka residents identified the car the gunmen used to access Dusit2D, a KCN 340E, as that of Gichunge alias Salim aka Farouk.
However, by Thursday evening, police investigations had a different account of the crime that left 21 people dead.
According to police sources, Ali did not carry out the attack but was instead the one coordinating it through bit-by-bit communication with the attackers.
He has since reportedly been arrested as well as his wife identified as Violet Kemunto.
Kemunto was arrested on Tuesday night at their house in the swanky Guango estate in Ruaka.
It is not yet clear where Ali was arrested at but police sources said a CCTV footage that captured the gunmen eating lunch at a joint along Limuru Road helped trace him.
The CCTV footage showed him in the company of the attackers but did not accompany them to Dusit2D premise; instead, he gave them his car to use.
The gunmen had also reportedly spent the night in his house.
As Farouk was being trailed in Nairobi and Ruaka, another squad of officers was combing a village in Isiolo.
The squad arrested his mother, Sakina Mariam alias Mama Ali in Waso village.
Three more suspects, a woman from Ushirika village in Coast, and two men – one arrested at Two Rivers mall and another at a restaurant along Kimathi Street – have been arrested.