SUBSCRIBER+ EXCLUSIVE ANALYSIS — Along with expressions of sympathy for the victims and pledges to bring the perpetrators to justice, Russia’s response to Friday’s deadly attack on a concert hall has been an across-the-board campaign of disinformation. The Kremlin and its surrogates spent the weekend suggesting - with no evidence - that Ukrainians or Americans, or both, were to blame for the worst terrorist attack in Russia in two decades.
As soon as Saturday morning, certain facts had emerged about the raid on the Crocus Concert Hall on Moscow’s outskirts: At least 137 people were dead and more than 150 others injured; gunmen had stormed the arena, shot at concertgoers, and set fire to the main building; the terrorist group ISK (Islamic State Khorasan) had claimed responsibility - a claim U.S. intelligence said was legitimate - and the group released videos taken by its operatives during the attack.
But within hours of the terror, Russian politicians, security officials, influential media commentators and Vladimir Putin himself were pushing different narratives.
The FSB, Russia’s domestic intelligence agency, issued a statement saying the attackers “had contacts on the Ukrainian side” and had planned to escape to Ukraine.
Foreign Ministry spokeswoman Maria Zakharova said in a Telegram post, "Now we know in which country these bloody bastards planned to hide - Ukraine."
And when Vladimir Putin gave his first public remarks on the tragedy, more than 18 hours after the attack, his five-minute speech made no mention of the ISK claim and instead played up the escape-to-Ukraine theory. “According to preliminary information,” Putin said, “a window was prepared for them on the Ukrainian side to cross the border.”
That “preliminary theory” was soon everywhere in the Russian information landscape, despite a forceful denial from Kyiv and American statements that Ukraine had played no role. “ISIS bears sole responsibility for this attack,” the National Security Council said Saturday. “There was no Ukrainian involvement whatsoever.”
None of that altered the Russian narrative. The only thing that did - in some quarters - was a suggestion that if the Ukrainians weren’t the authors of the terror, then the Americans must have been involved.
Andrei Lugovoi, the first deputy chairman of the Russian Parliament’s Commission on Security, went on the popular talk show Evening with Vladimir Solovyov and said, “I have no doubt” that the U.S. was behind the attack.
He was soon joined by other commentators who took a recent State Department warning of a potential terrorism incident in Moscow as proof that the U.S. must somehow have played a role.
No one has presented evidence for either the Ukraine or U.S. theories. Outside Russia, analysts said the Kremlin disinformation was a coordinated effort aimed at deflecting blame for having missed (or ignored) signs of an attack, and to rally the nation once more against Ukraine and the West.
Stanislav Kucher, a long-time Russian journalist who now lives in the U.S., said that for Putin, the Islamic State claim was “inconvenient,” and the Ukraine-did-it narrative a better fit.
“Let's state the obvious: the Kremlin will do everything to use the tragedy to continue and escalate this war,” Kucher told The Cipher Brief.
The Independent journalist Ilya Shepelin, who fled Russia after the February 2022 invasion, agreed.
“Of course, they will take advantage of the tragedy that has happened to reward themselves with an increase in powers and a buildup of the repression apparatus,” Shepelin wrote in a Telegram post.
Russian version 1: Blame Ukraine
In the immediate aftermath of Friday’s terror, Mykhailo Podolyak, a senior adviser to President Volodymyr Zelensky, issued a statement on X: "Let's be straight about this: Ukraine had absolutely nothing to do with these events…Ukraine has never resorted to the use of terrorist methods. It is always pointless…Everything will be decided on the battlefield."
But it soon appeared that word had come down from the Kremlin that the ISK claim would not be the accepted explanation - not in Russia at least - for what had happened at the concert hall. In the 24 hours that followed the terror, beyond the official statements from Putin, the Foreign Ministry and the FSB, these were among the Russian responses:
On a talk show on the state-run Channel 1, the ultraconservative ideologue Aleksandr Dugin said Ukrainian officials and “their puppet masters in the Western intelligence services” had organized the attack in an effort to “undermine trust in the president.”
Olga Skabeyeva, a prominent state television host, said that the Ukrainian military had recruited attackers “who would look like ISIS. But this is no ISIS.” Kommersant - not long ago a respected publication in Russia and beyond - published a report saying the attackers were from a pro-Ukrainian group of young men who “wore false beards and mustaches” to pose as Islamic terrorists. And Margarita Simonyan, head of the powerful media organization RT and perhaps Putin’s best-known media mouthpiece, wrote on her Telegram channel that “the ISIS version is a fake.”
But the “fakes” came from Russia itself. The state media outlet NTV broadcast a video in which a top Ukrainian official was said to acknowledge his country’s role in the terror. “The involvement of the Kyiv regime in the terrorist attack in the Moscow region was confirmed publicly and on television,” the NTV presenter said. In fact, the video in the report had been taken from a March 16 broadcast; the Ukrainian official it cited had said no such thing; and several viewers suggested the audio in the segment had been generated using artificial intelligence.
Along with blame for Ukraine came calls for retribution.
Andrei Kartapolov, a senior Russian lawmaker, said Russia must deliver a "worthy, clear and concrete" response on the battlefield. And former Russian President Dmitry Medvedev said that “if it is established that these are terrorists of the Kyiv regime…all of them must be found and mercilessly destroyed as terrorists. Including officials of the state that committed such an atrocity.”
Neither comment mentioned the ISK claim.
Russian version 2: Blame the U.S.
Two weeks before the attack, the U.S. State Department issued a public warning that terrorists might be planning a large-scale operation in Moscow. The March 7 alert cited “reports that extremists have imminent plans to target large gatherings in Moscow, to include concerts.” While it was a message meant for American citizens, U.S. officials said they had privately alerted Russia about the intelligence behind the warning.
On Tuesday, three days before the Crocus attack, Putin blasted the State Department message. “All this resembles outright blackmail and an intention to intimidate and destabilize our society,” Putin said in a speech to the F.S.B., referring to the U.S. warnings.
Outside Russia, the U.S. warnings looked prescient, but the Kremlin wasn’t about to credit Washington for intelligence that its own operatives had missed, and which Putin himself had derided. Instead, after the carnage, some Russian media took the American warnings and twisted them into an argument that the U.S. must have had a hand in the attack.
A Putin media favorite, Komsomolskaya Pravda, ran a piece quoting Rodion Miroshnikov, a senior Russian Foreign Ministry official, saying, “For some reason, the United States knew about the terrorist attack in Crocus City Hall in advance.”
Andrey Medvedev, a military correspondent and longtime Kremlin propagandist, said the attack had been carried out with “a lot of money from the American budget.”
And Lugovoi, the Russian parliamentarian, suggested the State Department warning was evidence of American involvement.
“The British and U.S. embassies were very careful to inform and warn their citizens to be careful in Moscow, without saying what was happening…I have no doubt that (the U.S.) is the main customer (who ordered the attack).”
By Sunday, the Russian foreign ministry was blasting U.S. intelligence for its assessment of the Friday attack.
“I wish they could have solved the assassination of their own President Kennedy so quickly,” said Zakharova, the ministry’s spokesperson. “But no, for more than 60 years they have not been able to find out who killed him after all. Or maybe that was ISIS, too?”
Putin’s problem
Given the near-total control Putin now wields over the flow of information in Russia, it’s possible - likely, even - that the public will accept the evidence-free narratives the Kremlin is pushing about the Crocus Hall terror.
Outside the world of Kremlin propaganda, however, Russian exiles and analysts said the attacks posed a potential problem for Putin, who has for decades positioned himself as the strong law-and-order leader the country needs.
Since Putin ordered the “Special Military Operation” in Ukraine in February 2022 (he still will not call it a war), he has offered a basic bargain to the Russian people: while a critical “operation” is carried out in Ukraine, and the West seeks to punish Russia with sanctions, life will carry on inside the country, Russian citizens will not feel undue pain, and - most relevant in the wake of Friday’s attack - there will be nothing to fear. Putin’s recent presidential campaign featured a consistent message: Russians needed him, to keep them safe and secure.
Now, as Rob Dannenberg, a former chief of the CIA’s Central Eurasia Division, wrote for The Cipher Brief Sunday, there is no avoiding the fact that “Russian authorities missed the real operational cells in Moscow that carried out the attack.”
"For decades we have been told that the curtailment of our rights is necessary for security," Ivan Zhdanov, the former head of the late opposition leader Alexei Navalny's Anti-Corruption Foundation, said Sunday. "But the terrorist attacks do not stop, and the FSB is busy with everything except its direct responsibilities – killing their political opponents, spying on citizens and prosecuting people who are against the war."
Shepelin, the exiled journalist, also noted that for all the focus on law and order, the security apparatus had “missed” Friday’s terrorist attack. He chastised the Kremlin for focusing its attention instead on designating Navalny a “terrorist” and - only hours before Friday’s attack - giving the same label to the LGBTQ movement in Russia.
“They use cameras to identify and find people who came to (Alexei) Navalny’s funeral, and LGBT people are recognized as an international extremist organization,” Shepelin said.
At this early stage, it’s unclear whether the intelligence and security failures will puncture Putin’s image in any way. By the end of the weekend, as mourners left flowers at the scene of the attacks, this much seemed clear: the aftermath of the terror would bring a fresh crackdown on dissent, a spike in attacks against Ukraine, and a disinformation campaign that takes what happened Friday and turns it to the Kremlin’s advantage. And while an Islamic terrorist organization carried out the worst attack in Russia since 2004, Russian authorities were ignoring that narrative, in favor of one that better suits their interests.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief.
