Who is behind the armed attack in Moscow: ISIS or Ukraine? The accusations of the Russians, dismantled step by step. BBC analysis

Vladimir Putin admitted on Monday that “radical Islamists” carried out the March 22 armed attack that left 140 dead at the Crocus City Hall concert hall near Moscow.

By the Observator editorial team on 28.03.2024, 11:16

But although the Islamic State group has claimed responsibility, the Russian president continues to insist that Ukraine was involved. And the heads of Russian espionage contributed to the narrative that Ukraine is behind the armed attack, helped by the West, especially the American and British services. Statements by Russian officials, media reports, and social media posts circulated this information. The BBC analyzed the Kremlin’s campaign to blame Ukraine for the armed attack in Moscow.

The first accusations

Accusations that Ukraine was to blame began pouring in on Friday night, almost immediately after the first news of the Crocus City Hall attack broke at around 7:15 p.m. Less than an hour after the attack was first reported, commentators pro-Kremlin and Russian officials posted messages on Telegram blaming Ukraine.

For example, Russian political analyst Sergei Markov wrote on Telegram as early as 20:25 that the attackers looked like “Islamist radicals”, but then added, without evidence, that the attack “was most likely organized by Kiev”.

40 minutes later, military expert Roman Shkurlatov told the Moskovsky Komsomolets tabloid that the attack could have been organized with the support of the SBU and GUR, Ukraine’s intelligence services. The former president of Russia Dmitry Medvedev vowed revenge on Telegram as early as 21:27 if Ukraine turns out to be involved.

False claim attributed to Ukraine

A few hours later, after midnight, one of Russia’s main TV channels NTV broadcast footage it claimed showed a senior Ukrainian official confirming Ukraine’s involvement in the attack.

“It’s fun in Moscow today, I think it’s a lot of fun. I like to think that we’ll arrange this kind of fun for them more often,” Oleksiî Danilov seems to say in the respective images.

The BBC has determined that the footage is actually a montage, taken out of context, of two interviews broadcast last week on Ukrainian television. Both can be found on YouTube.

The first is an interview with Danilov from March 19. The other was published three days earlier and features the head of military intelligence, GUR, Kirilo Budanov.

Danilov’s words in the clip broadcast by NTV do not appear in the original interview. An audio analysis, carried out for the BBC by experts at Liverpool John Moores University, suggests that NTV manipulated the sound. However, the researchers could not determine whether the voice was generated by artificial intelligence. The BBC also found information stored in the audio file suggesting it had been put through editing software.

Border crossing “window”.

President Putin said in a speech on Saturday that the attackers were caught while trying to flee to Ukraine where “a window was prepared for them to cross the border”. However, Russia did not present the evidence of the “window” to let the attackers through.

The BBC cannot independently confirm where the suspects were headed, but has checked several footage and photographs of those detained. Despite Putin’s statement, the arrests took place far from the border with Ukraine.

Through geolocation, the BBC has learned that two of the suspects arrested on Saturday were filmed about 145km from the border with Ukraine. While Ukraine denied any involvement, the Islamic State group claimed responsibility through its self-titled Amaq news agency.

Among the visual evidence, released by ISIS, is an image of the four attackers with their faces blurred and an explicit video clip shot from the perspective of an attacker. Several details – such as the features of the concert hall and the weapons used by the attackers – match those in images shared online at the time of the attack.

But despite this evidence, Russia continues to accuse Ukraine. Margarita Simonyan, editor-in-chief of the RT television network (formerly known as Russia Today), wrote on the X platform that the attackers did not represent the Islamic State group because they did not carry suicide vests and “did not intend to die.”

It is true that ISIS has repeatedly warned its attackers not to be captured alive, but there have been cases of the group’s terrorists escaping in the past. For example, according to the BBC, in late 2022, one of the militants involved in an attack on a hotel in Kabul managed to escape and later carried out a suicide attack.

What we know about the suspects

Before being apprehended, the attackers drove a white Renault, which matches the vehicle used to flee the concert hall and which appears in another video.

According to Russian MP Alexander Khinshtein, one of the suspects was arrested near the said vehicle, while the other three fled into the nearby woods and were apprehended after searches. Weapons and Tajik passports were found in the Renault, according to Khinshtein.

On Sunday, images were released of the four men being escorted to a Moscow court. They were identified by the Russian authorities as: Dalerdzhon Mirzoîev, Saidakrami Murodali Rachabalizoda, Shamsidin Fariduni and Muhammadsobir Faîzov. In the picture released by ISIS, three of the suspects appear in light brown, light green and gray T-shirts. The clothes appear to match those worn by three of the suspects at the time they were arrested.

For example, two logos on the light brown T-shirt worn by the man identified as Rachabalizoda also appear in the picture released by ISIS. The suspect later identified himself by that name during an interrogation.

Dalerdzhon Mirzoîev’s clothes are not visible in the photo published by ISIS. When he was apprehended he was wearing a green long sleeve shirt, blue jeans and a black belt. These three items of clothing appear to be worn by a gunman in the video released by ISIS.

This visual evidence shows that the men arrested by the Russian authorities look the same as those in the images published by ISIS.

How credible is the claim attributed to ISIS?

The fact that there is an extremely explicit video shot by an attacker during the killings, the fact that the attackers are said to be using slogans typical of ISIS followers, and that the images were distributed through official ISIS media channels are consistent with the group’s modus operandi.

Russian media even shared a picture of one of the attackers inside the Crocus concert hall more than two weeks before the attack, suggesting the attack was planned.

Before issuing an announcement claiming an attack, ISIS usually waits for confirmation about the fate of the attackers. If an attacker dies, intelligence agencies cannot obtain information through interrogation or torture.

It can therefore be considered unusual that ISIS claimed responsibility for the attack while the perpetrators were still at large. This indicates the terrorist group’s willingness to publicly confirm its role. This is not the first time ISIS has targeted Russia. Two other major attacks occurred in 2015 and 2018, apart from smaller attacks in recent years.