"All efforts are underway to bring this matter to a speedy conclusion," the Kenyan military announced on Twitter.
It said that "most of the hostages have been rescued and security forces have taken control of most parts of the building."
Earlier, police had tweeted that a "MAJOR assault" by security forces was ongoing.
The developments come some two days after Al-Shabaab militants first stormed the shopping center, spraying bullets and unleashing chaos.
There are believed to be between 10-15 gunmen involved in the attack, officials said.
Sources within Al-Shabaab told CNN that nine names listed on a Twitter site -- now suspended -- were people who were among the alleged hostage-takers.
Three of the alleged attackers are from the United States, two are from Somalia and there is one each from Canada, Finland, Kenya and the United Kingdom, according to the list.
Kenyan President Uhuru Kenyatta vowed Sunday to hold those responsible for the violence, accountable.
The tragedy is personal for the president; one of his nephews and his fiancee were among the dead.
"They shall not get away with their despicable, beastly acts. Like the cowardly perpetrators now cornered in the building, we will punish the masterminds swiftly and indeed very painfully," Kenyatta said.
'Bunch of cowards'
Sporadic gunfire could be heard throughout the day Sunday, and at least one explosion. Those sounds were followed by periods of tense silence.
Soldiers kept vigil outside the mall, guns dangling from their shoulders. Later in the day, helicopters approached.
The Kenyan Red Cross tweeted that nine bodies were recovered Sunday night, bringing the death toll to 68.
More than 175 were injured in the attack, Kenyatta said. He and other Kenyan officials visited hospitals Sunday morning.
"No one should lose their life so needlessly, so senselessly and no family should have to receive news that their loved ones have been killed by a criminal bunch of cowards," the president said.
The mall siege was the deadliest terror attack in Kenya since al Qaeda blew up the U.S. Embassy there in 1998, killing 213 people.
Al-Shabaab, al Qaeda's proxy in Somalia, claimed responsibility, and said it was not backing down. In a message on its Twitter feed, the group said "all Muslims" were escorted from the mall before the attack.
"When justice is denied, it must be enforced," it said in a tweet Sunday. "Kenyans were relatively safe in their cities before they invaded us & killed Muslims #Westgate"
Since Kenya launched attacks against Al-Shabaab in Somalia in 2011, the group has hurled grenades at Kenyan churches, bus stops and other public places.
Last year, the Kenyan military played a major role in handing Al-Shabaab forces a defeat when as part of a peacekeeping mission, they liberated the key Somali port of Kismayo.
The attack Saturday targeted a popular weekend meeting spot. Kenyans and expatriates gather at the luxurious Westgate Shopping Mall on weekends to drink lattes, catch a movie or browse through the more than 80 stores.
Police in Kenya grew irritated as people took to social media to describe what they were seeing and hearing.
"If you must Facebook or tweet, then talk about football or your favourite music but NOT MISINFORM the public on security operations!" authorities said on Twitter.
Three injured security forces were taken out of the besieged mall, but the severity of their injuries was unclear.
By Sunday afternoon, at least 1,000 people had been freed from the mall, Kenyatta said.
One apparent hostage left the building Sunday, and said she had been hiding in the basement of the mall, CNN affiliate KTN reported.
Al-Shabaab vowed not to negotiate with Kenyan authorities.
"The Mujahideen are still strong inside #Westgate Mall and still holding their ground," the group tweeted late Saturday.
Israeli special forces were at the scene and were working with their Kenyan counterparts in the hostage crisis, Kenyan government sources told CNN.
Kenyatta said several nations had offered help but "this remains an operation of the Kenya security agencies."
State House spokesman Manoah Esipisu said there were reports of a white woman among the hostage takers. Kenyan intelligence officials were investigating the claims, he said.
Esipisu was asked if the reported woman was thought to be the infamous Al-Shabaab-affiliated "White Widow," Samantha Lewthwaite. "Nothing is being ruled out," he said.
But CNN terrorism analyst Peter Bergen said it was unlikely.
"It would be very unusual for a woman to be involved in one of these operations," he said. "Typically these groups are misogynist. Their view is the woman should be in a home and shrouded in a body veil."
Lewthwaite's husband, Germaine Lindsey, was one of the suicide bombers killed in the 2005 attack on London's transportation system. His Buckinghamshire-born widow is wanted by Kenyan authorities for her alleged role as an Al-Shabaab and al Qaeda-linked financier.
A day of horror
The calm was shattered around noon local time Saturday. Gunshots erupted as shoppers picked up groceries, savored lunch and browsed through the racks at stores.
Before long, pools of blood smeared pristine hallways. Bodies lay strewn across the floor.
Uche Kaigwa-Okoye was sipping coffee when he heard what first sounded like a fallen table, then the continuing rat-a-tat of gunfire. As the gunshots became louder, screaming crowds headed for the exits.
He joined 20 people who took shelter for about five hours in a women's bathroom cubicle.
"They had grenades, and it was really, really loud," he said of the attackers. He noticed tear gas in the hallways as well.
"All of us felt like they were close," he said.
As people texted family and friends outside the mall, word spread that nobody could be trusted. And even if the good guys could be sorted from the bad guys, the intermittent barrages of gunfire made any escape attempt seem futile.
Sara Head, a Washington resident, experienced similar horror in the mall's parking garage. As her car pulled up, she heard gunfire. She crawled underneath and hid behind cars before getting into a stairwell.
Eventually, the stairwell lights came back on and the door to a nearby supermarket opened. She dashed through, passed a nearby loading dock and fled to safety.
"There was blood throughout the supermarket," Head said. "It wasn't clear if it was OK to exit."
Several Kenyan agencies made a plea for blood donations.
"Hospitals are appealing for more blood, the response is incredible but more is needed," tweeted Francis Kimemia, secretary to the Cabinet.
Foreigners among casualties
Most of the casualties are Kenyan, authorities said. But the mall is popular with expatriates and foreign nationals, who were among those killed and injured.
Those killed include three British citizens, two French nationals and two Canadians, including a diplomat, their governments said.
Several American citizens were among the wounded, including Elaine Dang, a University of California, Berkeley, graduate.
Dang worked as the general manager for Eat Out Kenya, which confirmed her injuries on its Twitter and Facebook pages.
A State Department spokeswoman said Sunday there were five Americans among the injured, but none among the dead.
"Obviously it's an enormous offense against everybody's sense of right and wrong," said Secretary of State John Kerry. "It represents the seriousness and the breadth of the challenge we face with ruthless and completely reckless terrorists, and we're going to pursue them."
The U.S. Embassy asked personnel to stay in place Sunday and avoid the Westgate Mall area and any large gatherings. All U.S. citizens in Kenya were urged to register online so the embassy can provide them with updated information on travel and security -- and can contact them in case of emergency.
Israel's Foreign Ministry said one national was slightly wounded and three escaped. A cafe at the mall is owned by an Israeli, but the ministry does not believe the mall was targeted because of that.
The Ghana president's office said literary figure Kofi Awoonor was among those killed in the attack.
"Such a sad twist of fate to place Prof at the wrong place at the wrong time," President John Mahama said in a statement.
CNN's Steve Almasy, Faith Karimi, Holly Yan and Greg Botelho reported and wrote from Atlanta; Lillian Lesposo reported from Nairobi. CNN's Tim Lister, Nima Elbagir, Joseph Netto, Boriana Milanova, Jamie Crawford, Stefan Simons, Karen Smith and Azadeh Ansari contributed to this report.