Fifteen people have died in an Islamist attack on an upmarket hotel complex in Nairobi, Kenyan police sources said Wednesday, as fresh explosions and gunfire rang out in the siege which stretched into its second day.

Security forces worked throughout the night to secure the DusitD2 compound, which includes a 101-room hotel, spa, restaurant and office buildings, after an attack claimed by Al-Shabaab Islamists on Tuesday afternoon.

At least one suicide bomber blew himself up at the hotel while gunmen sprayed fire before engaging security forces and holing themselves up at the premises as civilians fled or barricaded themselves in their offices awaiting rescue.

“We have 15 people dead as of now and that includes foreigners,” a police source told AFP on condition of anonymity.

Among the dead was an American citizen, a State Department official said.

A second police source confirmed the toll but warned “there are areas not yet accessed but that’s what we know so far.”

After 12 hours trapped inside the complex, a group of dozens of people was freed at 3:30am (1230GMT), according to an AFP journalist at the scene, followed by fresh gunfire and a detonation.

“We still believe there are two or three attackers in specific locations,” the first police officer said.

“The situation is far from over.”

The second police officer said that at one point they had been sure the attackers had been neutralised after a long period without shooting, however gunfire resumed again after 2 am.

Further explosions and gunfire were heard shortly before dawn, with no official word on how many people were still trapped inside.

“There is a floor where they are shooting from, we still believe there are people there,” he said, after reports that a large number of people had fled upstairs.

Kenyan police chief Joseph Boinnet said the attack began with an explosion targeting three cars in the parking lot and a suicide bombing in the foyer of the Dusit hotel.

As the explosion and gunfire rang out in the leafy Westlands suburb, hundreds of terrified office workers barricaded themselves in the complex while some fled.

“We have no idea what is happening. Gunshots are coming from multiple directions,” said Simon Crump, an employee at an international firm who was hiding with his colleagues.

Crump was among a first wave of people evacuated from the office buildings surrounding the Dusit hotel, after an hour of sustained gunfire.

A number of heavily-armed foreign forces, who appeared to be from embassies based in Nairobi, were at the scene alongside Kenyan security officers.

One survivor rescued from the building told a local television station the attackers were “very confident; they were people who knew what they were doing”.

CCTV footage broadcast on television showed four attackers, clad all in black and heavily armed, entering a courtyard in the compound at the start of the assault.

John Maingi said there had been “a flash of lights and a loud bang” at the Secret Garden restaurant where he works.

“When I peeped outside I saw a human leg which has been cut off. We hid in the room and then some police officers rescued us,” he said.

Reuben Kimani, a barista who was rescued after several hours trapped inside the hotel, said he recognised one of the attackers as a client.

“I knew one of them because he had a big scar on one of his hands,” he said.

“I saw them. They shot six of my friends, four didn’t die but two succumbed.”

The attack was claimed by the Al-Qaeda-linked Somali group Al-Shabaab, which has repeatedly targeted Kenya since it sent its army into Somalia in October 2011 to fight the jihadist group.

The attack at DusitD2 is the first in Nairobi since gunmen stormed the city’s Westgate shopping mall in 2013, killing at least 67 people.

On April 2, 2015, another Shabaab attack killed 148 people at the university in Garissa, eastern Kenya.

The Westgate attack resulted in many upscale establishments and shopping centres in the capital — including the Dusit — putting up strict security barriers to check cars and pedestrians.

Several Nairobi establishments popular with westerners announced on social media Tuesday that they had closed for security reasons.

In its statement, the group noted the attack came exactly three years after its fighters overran a Kenyan military base in Somalia.

“This attack on Nairobi hotel came as Kenyans and their media are commemorating (the) El Adde attack,” it said.

The Shabaab claimed it killed more than 200 soldiers in that assault. The government has refused to give a toll or disclose details.