Russian authorities claimed to have arrested the four attackers and seven others involved in the March 22 “Crocus City Hall” concert venue attack, which Russian authorities reported killed at least 133 civilians. Russian sources claimed that the attackers entered the Crocus venue on March 22 and began firing machine guns at civilians at 19:55 Moscow time, reached the main auditorium by 20:03, and fled the scene in a car at 20:13 – conducting the entire attack and laying explosives that ignited the venue in only 18 minutes. The Russian Investigative Committee and Moscow authorities reported that the attack killed at least 133 and injured at least 140 as of March 23, but this number may grow as Russian authorities find more casualties trapped under rubble in the concert hall. The Russian Federal Security Service (FSB) reported that it detained four individuals it claims are the attackers in Bryansk Oblast on March 23 as well as seven others whose involvement is not yet specified. Russian sources widely circulated geolocated footage of Russian security forces detaining four individuals alleged to be the attackers before they could flee near Kommuna, Bryansk Oblast (about 14km southwest of Bryansk City). Russian authorities claimed that they detained two individuals in the vehicle that the four were driving and chased down two others who fled into the surrounding forest. Russian sources also amplified footage of Russian security forces interrogating the individuals, all of whom either spoke little Russian or communicated with Russian personnel via translators. Russian sources largely claimed that the attackers are all citizens of Tajikistan, and Russian Ministry of Internal Affairs (MVD) Spokesperson Iryna Volk claimed that none of the individuals whom Russian authorities claimed conducted the attack are Russian citizens.
ISW assesses that the Islamic State (IS) is very likely responsible for the Crocus City Hall attack. IS Amaq’s News Agency took responsibility for the attack on the night of March 22, claiming that IS fighters attacked a “large gathering of Christians” on the outskirts of Moscow, “killing and wounding hundreds and causing great destruction…before they [the attackers] withdrew to their bases safely.” The Amaq News Agency later posted a blurred-out image of the four fighters who it claimed conducted its “fiercest attack in years” standing in front of an IS flag. The Amaq News Agency announcement is consistent in terms of style, branding, and language with previous Amaq claims for other attacks. IS media organs make deceptive or false claims only ”infrequently” and carefully and try to maintain “high credibility” in their communiques in order to define clear ideological objectives and maintain fundraising streams. IS propaganda enables the group to fundraise and disseminate its guidance to lower-level commanders and supporters–IS risks discrediting itself within the competitive Salafi-jihadi community by falsely taking credit for very high-profile attacks. The conduct of the attack itself is also consistent with previous IS attacks, including the 2015 Paris terror attacks. The IS fighters in the Crocus City Hall and some of those involved in the 2015 Paris attacks exfiltrated the target and subsequently evaded security forces for a time.
The Islamic State’s Afghan branch IS-Khorasan (IS-K) may have conducted the Crocus City Hall attack. This branch has conducted at least four high-profile attacks outside of central Asia in the last 18 months. US Central Command Commanding General Michael Kurilla notably stated in March 2023 that IS-K would be able to conduct “external operations against US or Western interests abroad in under six months,” meaning that Western intelligence had already assessed that IS and IS-K would be able to field the capabilities for such external attacks by September 2023. US intelligence most recently confirmed that IS-K was responsible for a bombing attack in Kerman, Iran as recently as January 2024, further highlighting IS external attack capabilities. Allegations that the Crocus City Hall attack was a false flag operation are inconsistent with the evidence ISW has observed from the attack itself correlated with other reports of previous IS external attacks that ISW and CTP have covered since the emergence of the Islamic State, as well as the IS claim pattern following the attack. It is also highly unlikely that IS would have conducted the attack on the orders of Ukrainian special services, which several Russian sources have alleged. Amaq News Agency is IS’s central media arm. IS would not falsely claim an attack that may have been conducted by one Christian state against another (or by the Kremlin against Russia’s own people in some sort of false-flag operation), because the implications of IS conducting an attack at the behest of a predominantly Christian country would damage IS credentials within the Salafi-Jihadi community.
The Kremlin nevertheless and without evidence quickly attempted to tie Ukrainian actors to the Crocus City Hall attack but has yet to formally accuse Ukraine of involvement in the attack. Russian President Vladimir Putin addressed the Russian public on March 23 and claimed that the attackers’ “contacts” had prepared a “window” for the attackers’ exfiltration across the international border into Ukraine (without mentioning how the attackers were supposed to get through the defenses the Russians have established along the border). The Russian Federal Security Service (FSB) claimed that it apprehended the four attackers as they were attempting to reach their alleged contacts on the Ukrainian side of the border. Russian Ministry of Foreign Affairs (MFA) Spokesperson Maria Zakharova falsely asserted that Ukraine has been spreading terrorism for the past ten years at the behest of the West and that this is why the attackers attempted to flee to Ukraine. The Russians describe Ukrainian military strikes against legitimate targets in Russia as terrorism. Russian State Duma Defense Committee Head Andrey Kartapolov claimed that Ukraine and its allies are the main “stakeholders” in the attack at the Crocus City Hall. Kremlin officials likely aim to indirectly tie Ukraine to the attack to set conditions for information operations that seek to attribute the attack to Ukraine without having to issue an immediate official accusation. Russian opposition outlet Meduza reported that an employee at an unidentified Russian state-owned media organization stated that state-owned media received instructions from the Kremlin to emphasize the alleged “Ukrainian trace” in the Crocus City Hall attack. Russian ultranationalists responded to these indirect accusations and explicitly claimed that Ukrainian and Western special services orchestrated the Crocus City Hall attack. The Kremlin likely hopes that perceptions about Ukrainian involvement in the attack will increase Russian domestic support for the war in Ukraine, and the Kremlin may still issue an official accusation to this end if it believes that indirect accusations are insufficient to generate the domestic response it likely desires.
Key Takeaways:
- Russian authorities claimed to have arrested the four attackers and seven others involved in the March 22 “Crocus City Hall” concert venue attack, which Russian authorities reported killed at least 133 civilians.
- ISW assesses that the Islamic State (IS) is very likely responsible for the Crocus City Hall attack.
- The Kremlin nevertheless and without evidence quickly attempted to tie Ukrainian actors to the Crocus City Hall attack but has yet to formally accuse Ukraine of involvement in the attack.
- Russian ultranationalists responded to the attack by reiterating typically xenophobic calls for anti-migrant policies, reflecting the growing tension in Russian society over the mistreatment of migrants and the impacts migrant disenfranchisement could have on expanding a viable recruitment base in Russia for Salafi-Jihadi groups.
- Russian sources accused Ukrainian actors of reportedly conducting a successful drone strike against a Russian oil refinery in Samara Oblast on the night of March 22 to 23.
- Russia is reportedly delaying the delivery of two S-400 air defense systems to India, likely due to limitations in Russia’s production of S-400 systems, an increased need for air defense systems to protect cities and strategic enterprises in Russia from Ukrainian drone strikes, and a reported souring of Russian relations with India.
- Russian forces made confirmed advances near Avdiivka and Donetsk City and in western Zaporizhia Oblast.
- Russian President Vladimir Putin signed a law on March 23 that will release individuals from criminal liability if they are called up for mobilization or sign military service contracts.
For full report: https://www.understandingwar.org/backgrounder/russian-offensive-campaign-assessment-march-23-2024