In this file photo a man passes in front of the rubbles of the popular Medina hotel of Kismayo, Somalia. Al-Shabaab claimed responsibility for a similar style attack on Kismayo s Medina hotel in 2019. AFP
The port city is the latest to be hit following a resurgence of bloody attacks in recent months by the Al-Qaeda-linked group, which has mainly targeted the capital Mogadishu and central Somalia.
Sunday's assault began at 12:45 pm (0945 GMT) when a booby-trapped car rammed the entrance of Hotel Tawakal.
"Another dead body of a civilian was discovered, making four the overall civilian casualties we have confirmed so far," police officer Abdullahi Ismail said, updating the toll of three given by officials earlier.
"This is not a government target," Ismail said. "It is just an ordinary, civilian-frequented hotel."
As security forces sought to bring the siege to an end, they killed "two of the attackers", he added. "They are clearing the hotel building and will soon announce the siege is over."
Witness Abdikarin Yare told AFP the forces "managed to storm the main building and we can still hear gunshots", adding: "Two dead bodies of the attackers were dragged out."
Another witness Farhan Hassan, who was outside the hotel when the attack happened, said "a suicide bomber drove a vehicle into the entrance of the hotel before the gunmen entered the building".
Al-Shabaab claimed responsibility for the attack, saying members of the federal government of Jubaland, where Kismayo is located, were meeting in the hotel at the time.
Al-Shabaab has been trying to overthrow the government for more than 15 years and regularly attacks civilian and military targets.
Kismayo was once an Al-Shabaab stronghold before it was taken over in 2012 by local militias backed by Kenyan forces.
In August it launched a 30-hour gun and bomb attack on the popular Hayat hotel in Mogadishu, killing 21 people and wounding 117.
In 2019, the group conducted a similar attack on a hotel in Kismayo, killing 26 and injuring 56.
Somali President Hassan Sheikh Mohamud, who was elected in May, vowed after the siege in August to wage "all-out war" on the Islamists.
In September he urged citizens to stay away from areas controlled by the jihadists, saying the armed forces and tribal militia were ratcheting up offensives against them.
A joint US-Somali drone strike killed one of the militants' most senior commanders on October 1.
Just hours after his death was announced, a triple bombing in the southern city of Beledweyne killed at least 30 people.
In addition to violence, Somalia -- like its neighbours in the Horn of Africa -- is in the grip of the worst drought in more than 40 years. Four failed rainy seasons have wiped out livestock and crops.
Some 7.8 million Somalis -- nearly half the population -- are affected by the drought and 213,000 are on the brink of famine as a result, according to the United Nations