Islamists and the ‘Ukrainian trace’. The Moscow concert hall terrorist attack

The photo shows firefighters in front of a burning building
wikicommons / Governor of Moscow Oblast

In the afternoon of 22 March, four masked gunmen carrying automatic weapons stormed into the Crocus City Hall in Krasnogorsk on the outskirts of Moscow (next to the north-western section of the Moscow ring road). They opened fire at random on the civilians who were present in the concert hall and then detonated explosives, setting the building on fire, which led to the collapse of the roof. At least 137 people were killed and around were 140 injured as a result of the terrorist attack.

The terrorists fled the scene. They were driving a sedan (with plates from Tver oblast). Shortly thereafter, the Amaq agency representing Islamic State issued a short message in which it announced that ISIS claimed responsibility for the attack in Krasnogorsk; a photo of four terrorists was shown in its next broadcast in the afternoon of 23 March followed by short clip from their bodycams.

Lists with the names of between four and six alleged suspects, reportedly citizens of Tajikistan, began to be circulated on Russian social media. In the morning of 23 March Russian law enforcement authorities announced that there had been a shootout the previous night during an attempt to stop a car driven by the suspects in the town of Khatsun near Bryansk (around 100 km away from Russia’s borders with Belarus and Ukraine), leading to the arrest of two citizens of Tajikistan. According to initial reports, the incident took place near the village of Teply, 15 km away from the Belarusian border. Later, the Kremlin’s press service issued a statement informing that Vladimir Putin had received a report from the FSB director Aleksandr Bortnikov on the arrests of 11 individuals involved in the terrorist attack, including four of the direct perpetrators. The FSB claimed in its statement that they intended to cross the Russian-Ukrainian border after the attack, and that they had “appropriate contacts on the Ukrainian side”.

President Putin only made a statement in the afternoon of 23 March. In a televised address he described the attack as a barbaric act, and announced that additional anti-terrorist measures would be introduced throughout the country. He confirmed the arrests of the perpetrators and emphasised that they had attempted to flee to Ukraine, “where a window had been prepared for them on the Ukrainian side to cross the border”. He pledged ‘fair’ punishment for all the perpetrators, organisers and initiators of the attack. At the same time, he called for national unity and urged other countries to cooperate in the fight against terrorism.

Reactions in Russia

The Russian interior minister Vladimir Kolokoltsev was dispatched to the scene late in the evening of 22 March. Even before the authorities made a formal response, pro-Kremlin oligarch Konstantin Malofeev accused Ukraine of orchestrating the attack, pointing out that Russia won the war in Chechnya after the terrorist attack at the Dubrovka Theatre in 2002. He added that Russia was ready for another victory, and suggested that residents of Ukraine should be evacuated from cities within 48 hours, which in his opinion would finally bring an end to the war.

Dmitry Medvedev, the former President and current deputy chairman of the Russian Security Council, stated that if it turned out that the attack had been carried out by “the Kyiv regime’s terrorists, then it will be impossible to deal with them and their ideologists otherwise. All of them must be tracked down and ruthlessly destroyed as terrorists”. Some Russian propagandists also began spreading information suggesting there was a ‘Ukrainian trace’. Overnight, several pro-Kremlin electronic media outlets, followed by the NTV television station, released a fake recording created using artificial intelligence, purportedly featuring the voice of Ukraine’s Secretary of the National Security and Defence Council of Ukraine, Oleksiy Danilov, expressing joy over the attack and announcing that there would be more to come.

The initial reactions from the Russian public included gestures of mourning and solidarity. Spontaneous memorials emerged, where flowers were laid. Many people donated blood for the injured. Russian media reported numerous condolences pouring in from around the world.

Ukrainian reactions

The Main Intelligence Directorate of the Ministry of Defence of Ukraine (HUR) and the Centre for Countering Disinformation of the National Security and Defence Council made similar statements, claiming that the terrorist attack in the Moscow region was a “deliberate provocation by Putin’s secret services”. The Ukrainian Ministry of Foreign Affairs issued a statement categorically denying the accusations of Ukrainian involvement, and suggesting that these allegations had been aimed to justify the announcement of another wave of mobilisation in Russia in order to continue the invasion of Ukraine. Russian volunteers fighting on the Ukrainian side expressed similar opinions.


  • Based on the information currently available, an attack by an Islamist militant group seems to be most likely. This version is supported by reports about the identity of the perpetrators and the fact that on 7 March, the US Embassy in Moscow issued a public warning to American citizens about the threat of extremist attacks in Moscow, advising them to avoid public gatherings for the next two days (the British embassy issued a similar statement). During a meeting at the FSB’s headquarters on 19 March, Putin dismissed these warnings, accusing Western countries of “blackmail” and of making attempts to spread panic and provoke destabilisation in Russia. In recent weeks there have also been reports that the Russian authorities have been taking active measures against Islamic extremists.
  • American media have reported that Washington informed Russia about the threat of terrorist attacks in recent weeks. According to some reports, the preparations were reportedly being made by groups linked to Islamic State – Khorasan (ISIS-K). This terrorist group was established in 2015 in Afghanistan as a branch of Islamic State in Syria, with Tajiks and Uzbeks, among others, playing a large role in its structures. This group has some influence – the extent of which is difficult to clearly assess – within various migrant diasporas (including in Russia and Turkey). Despite having its HQ in Afghanistan, it has been in sharp conflict with the Taliban, and in recent months it has carried out attacks in Iran, Pakistan, Turkey and other places.
  • An alternative version, which is much less probable, is that the attack was orchestrated by the FSB in order to justify the announcement of the next stage of mobilisation in Russia and a serious escalation of the war with Ukraine, on the basis of allegations that the Ukrainian secret services were cooperating with ISIS. In this version of events, the real organisers will remain undetected, and the blame would be limited to the selected immigrants involved in the terrorist attack.
  • Regardless of who was really behind the attack in Krasnogorsk, the Kremlin will exploit this tragedy in an attempt to consolidate the Russian public behind an external threat. The tone of the propaganda and the initial statements from Russian politicians, including Putin, suggest that the Kremlin wants to link the perpetrators to Ukraine and the West. Russian propagandists were already claiming – even before the attack – that Ukraine has been consistently sheltering Islamic radicals, including ISIS terrorists. The Kremlin may use the attack as a pretext to escalate aggression against Ukraine (with intensified attacks, further mobilisation and more military offensives) and Western countries (possibly with ‘hybrid’ attacks).
  • Since the Russian government and law enforcement agencies downplayed the Western warnings and did not provide any increased protection for mass events, the conspiracy theories about Ukrainian and Western ties to the perpetrators will be pushed even harder to distract attention from the incompetence of the state’s decisionmakers. The huge number of casualties of the attack and the slow response from law enforcement agencies may escalate public dissatisfaction, including with the government, but no serious political consequences should be expected. It should be taken into account that anti-immigrant sentiments are growing in Russia, and so isolated acts of violence against individuals originating from the Caucasus and Central Asia are possible. The government may even deliberately allow such incidents, to make space for the Russian public to give vent to their irritation.