The March 22 Crocus City Hall attack in Moscow was the deadliest terror attack in Russia in over 20 years. As of March 27, authorities had reported that the armed assault killed at least 143 people and wounded 360 others. At least four gunmen carried out the attack. Details of the assault, including graphic footage of the attack and its aftermath, rapidly circulated on Russian social media in real time, galvanizing an intense public reaction. In response to the incident, key figures in the Russian government have emphasized the supposed involvement of Ukraine and its Western allies in the attack at the expense of focusing on Islamic State – Khorasan Province (also known as Wilayat Khorasan, referred to throughout as IS-K), the organization that claimed responsibility for the assault. By attempting to redirect the Russian public’s attention to the state’s key rhetorical enemies rather than IS-K, Moscow is likely attempting to politically instrumentalize public outrage to justify an escalation of its confrontation with Kyiv and the West, while avoiding blowback for the intelligence failures leading to the deadly attack.
Background: IS-K and the Road to Russia
IS-K is an Afghan offshoot of the Islamic State (IS) group that is largely based in Afghanistan’s northern provinces along the border with Tajikistan. Though originally only focused on its home territories, IS-K has increasingly sought to conduct attacks abroad in recent years. In July 2023, German and Dutch authorities announced the arrest of nine alleged IS-K affiliates accused of planning attacks in Germany and collecting funds for the group. Following this, IS-K completed its first major attack outside its territory on Jan. 4, when it conducted the double bombing of a crowded memorial ceremony in Kerman, Iran. The attack killed nearly 100 people and wounded 284 others was the deadliest terror incident in Iran in decades.
IS-K has been a known threat to Russian security forces for years. The group claimed responsibility for a September 2022 bombing at the Russian Embassy in Kabul that killed six people, including two members of the Russian diplomatic mission. At a speaking engagement in October 2023, Alexander Bortnikov, director of the Federal Security Service of Russia (FSB), noted that “in the near future, [IS-K] may reach a potential that will allow it to carry out terrorist attacks outside of Afghanistan.”
Missed Signs
There were two crucial indicators of elevated security risks in Russia in the weeks prior to the attack. First, In the first week of March, Russian authorities announced multiple actions targeting armed Islamist cells that were reportedly planning attacks on crowded areas. On March 2, the FSB launched a broad counterterrorism operation aimed at targeting an IS cell in the Republic of Ingushetia, specifically focusing on the town of Karabulak. In announcing the operation, authorities alleged the group was planning armed attacks against crowded public areas. Following this, on March 7, the FSB announced that it had neutralized an IS-K cell in Kaluga Oblast, immediately southwest of Moscow. In this case, authorities claimed the group was planning an attack on a synagogue in Moscow.
The second indicator was far more explicit: on March 7, the US Embassy in Moscow published a security alert calling on American citizens to avoid public spaces for the next 48 hours. The alert noted that “extremists have imminent plans” and specifically mentioned “concerts” as possible targets. Following the attack, officials in Washington asserted that they had provided Russian intelligence services with advanced private warnings as well. While it is unclear to what extent Russian intelligence services acted upon these notes, Moscow publicly dismissed the embassy alert. While addressing the FSB board on March 19, President Vladimir Putin referred to the US Embassy alert as “outright blackmail” aimed at destabilizing Russia.
Roots of an Intelligence Failure
In the last two decades, Russian security forces have proven highly effective at targeting radical cells and preventing large-scale attacks. The FSB regularly announces successful operations against members of IS and other radical Islamist groups in Russia, and while some attacks have occurred in recent years, they have typically involved lone-wolf actors. Given this, how did Russian security and intelligence agencies fail to prevent the Crocus City Hall attack.
Three significant issues likely diverted the Russian intelligence community’s attention away from Islamist threats both in the last several years as well as in the last several weeks. Firstly, Moscow has likely dedicated internal and external intelligence services to countering Ukrainian sabotage operations in occupied territories and border regions, as well as conducting espionage and other operations within Ukraine. Secondly, the March 15-17 presidential election saw significantly heightened security around the country during the vote and in the following days. Thirdly, since March 12, Russian security forces have been engaged in armed fighting in the Belgorod and Kursk oblasts with Ukraine-based anti-Putin militant groups. The last point is particularly noteworthy: the March campaign represents the most significant incursion into Russia from Ukraine since the start of the conflict in February 2022, and has seen consistent damaging bombardments of Belgorod city and the evacuation of thousands of civilians. It is also notable that the FSB oversees defensive operations against these attacks.
Attempting to Control the Narrative
Even while the attack was still in progress, notable figures in Moscow rushed to assign responsibility to Ukraine. In the closing minutes of the assault, Deputy Chairman of the Security Council and former Prime Minister Dmitry Medvedev wrote on his official Telegram raising the possibility of Ukrainian involvement. Following this, Maria Zakharova, Director of the Information and Press Department of the Ministry of Foreign Affairs and in effect, a Moscow spokesperson, has repeatedly made social media posts characterizing IS (and, by extension, IS-K) as a group subordinate to US interests, saying, “after the creation of Al-Qaeda, the Americans had a hand in creating… ISIS.” Additionally, Zakharova has pointed out past attacks by IS targeting groups not allied with the US, particularly the Afghan Taliban and Iran, as evidence that the US influences IS activity. Furthermore, on March 28, the Investigative Committee of the Russian Federation, Russia’s main legal investigative authority, arrested a suspect in connection with the attack. The body claimed that this suspect helped direct funds from Kyiv to participants in the assault.
Russian officials and media figures have also made repeated references to FSB assertions that the suspects fled toward the Ukrainian border after the attack, allegedly hoping to enter Ukraine and revealing Ukrainian involvement in the plot. However, a statement by Belarusian leader and close Putin ally Aleksandr Lukashenko appears to contradict this: on March 26, Lukashenko stated that the fleeing attackers intended to enter Belarus rather than Ukraine but were dissuaded by heightened security at the Belarusian border. While Lukashenko’s claim could not be verified, Bryansk Oblast (where the attackers were reportedly arrested) shares borders with both Belarus and Ukraine.
Moscow has a heavy incentive to focus its rhetoric on Ukraine and the West rather than IS-K. Since the start of the invasion of Ukraine, Russian authorities have sought to portray Ukraine as an existential threat, claiming their military campaign aims to “de-Nazify” the country. Russian propaganda frequently highlights the key role that the US and other Western countries play in supporting Kyiv and accuses them of being “politically radical” along with the supposed Nazi regime in Kyiv. Throughout the conflict and particularly in the run-up to the presidential election, Putin has portrayed himself as protecting Russia against these key threats and characterized the goal of Ukraine and the West as the destruction of Russia. Therefore, the fact that a new, unrelated actor conducted such a damaging attack in Russia could cause members of the public to doubt the Putin administration’s ability to follow through on its commitment to ensure Russians’ security as well as question its focus on fighting Ukraine in the first place. It is, consequently, in Moscow’s interest to assign responsibility for the Crocus City Hall attack to its prioritized enemies, Ukraine and its Western backers, so that the incident strengthens public resolve in fighting the supposed existential threat posed by these actors rather than weaken public confidence in the state’s ability to manage security risks.
Outlook: Ukraine, Ukraine’s Allies, and Central Asian Immigrants
As Russian authorities continue to characterize the attack as having heavy Ukrainian and Western involvement, escalation in Ukraine becomes increasingly likely. This may take several forms. In the hours after the attack, Russian forces launched their largest-scale attacks on Ukraine’s energy infrastructure since the start of the war. Ukrainian media reported that the strikes, which began late on March 22, resulted in EUR 100 million in damage and would take months to repair. While the strikes could also be read as a response to recent Ukrainian attacks targeting Russian hydrocarbon facilities, the timing and magnitude of the attacks were noteworthy and likely influenced, at least in part, by the Crocus City Hall assault.
Additionally, Moscow could attempt to capitalize on public outrage over the attack to pursue renewed mass mobilizations. Russia’s first large-scale mobilization campaign in September 2022 proved highly unpopular among the public and, despite heavy battlefield losses, Moscow has not called for another mobilization. By painting Ukraine and the West as ultimately responsible for the Crocus City Hall attack, Moscow may be able to channel popular anger into increased support for the war effort and thus reduce the political cost of drafting further troops.
Moreover, Moscow may hope that its portrayal of Western intelligence agencies as heavily involved in a terror attack on Russian soil may justify an escalation of its conflict with the US and NATO. This escalation could take several forms, including increasingly overt misinformation campaigns, covert funding for fringe political parties, and increased cyberattacks on government agencies and critical infrastructure.
The attack will also likely result in a wide-ranging law enforcement crackdown in Russia, particularly targeting the country’s Central Asian migrant worker communities. The four alleged Crocus City Hall attackers are from Tajikistan, and at least one additional individual suspected of involvement in the attack is from Kyrgyzstan. Russia is home to several million migrant workers, mostly from Central Asia, and the fact that the attackers are from the same region will likely increase both state-backed repression and the frequency with which members of the public carry out xenophobic acts targeting this demographic group. Likely addressing the potential for such incidents, both the Tajik Embassy in Moscow and the Foreign Ministry of Kyrgyzstan have called on citizens to stay indoors as much as possible and avoid public areas; additionally, the Foreign Ministry of Kyrgyzstan has asked citizens to delay travel to Russia.
Lastly, Russia may attempt to increase pressure on Central Asian countries to target suspected IS-K cells. While Russia maintains extensive security ties with countries across Central Asia, it is unlikely that Moscow can spare much intelligence and security capacity given the prioritization of the conflict in Ukraine. Moscow is, therefore, likely to use diplomatic means to push Central Asian states, particularly Kyrgyzstan and Tajikistan, to prioritize operations targeting IS-K. This may result in increased tensions and potential diplomatic conflict in the coming months.
Author(s)
