On March 22, Russia suffered one of the worst terrorist attacks in recent history, in the course of which 137 people were killed and 182 others were injured. The four terrorists who carried out the attack chose one of the largest exhibition and concert venues in the country, Crocus City Hall, in the city of Krasnogorsk on the outskirts of Moscow, which hosts large events every day.
Even though the investigation is still ongoing, the West has already claimed that the Islamic State (IS) is responsible for the tragedy. This was first reported by some media outlets, including Reuters and CNN, and was later picked up by Western officials. For example, on Monday, this was stated by White House Press Secretary Karine Jean-Pierre.
However, when we compare this terrorist attack with other IS attacks, we notice more differences than similarities.
How IS kills
On that fateful Friday night, a concert by Picnic, a St. Petersburg rock band, was supposed to take place in Crocus City Hall. This fact gave rise to comparisons with the horrible terrorist attack in France in November 2015. Back then, terrorists broke into the Bataclan Theater in Paris, where a concert of the US band Eagles of Death Metal was taking place. IS claimed responsibility for the crime, which left 89 people dead.
In those years, IS became increasingly active throughout the world – but this was actually a sign of its decline. In its heyday, IS didn’t urge its supporters to carry out terrorist attacks, but instead called on them to “fulfill the hijrah” – i.e., move to the territories controlled by the organization. Over ten years ago, this was quite easy to do, since part of the Syrian border with Turkey was controlled by the jihadists, which allowed people to freely cross it and join their ranks.
However, as the terrorists lost many of their territories, their rhetoric changed. Through its information resources, IS urged its followers to commit terrorist acts in places where they lived. This caused an upsurge in violence in Europe: a wave of terror swept through France, Belgium, Germany, the UK, and other countries. In Russia, the North Caucasus became a point of tension.
The strategy was simple – anyone who supported the jihadists, wherever they lived, could record a video with an oath of allegiance to the “caliph,” send it via an automated feedback bot, and then commit a terrorist act. Often it was only the perpetrator who died, but for IS, this didn’t matter – it only cared about being mentioned in connection with the terrorist activity, which is why the organization occasionally took responsibility for crimes that it had nothing to do with.
The terrorist attack in Krasnogorsk, however, doesn’t match this straightforward strategy usually adopted by IS. In fact, the choice of a rock concert as the site of the terrorist attack is almost the only common feature between this attack and other acts of terror it has committed.
What preceded the events at Crocus City Hall
Four people who had not previously known each other were recruited to carry out the terrorist attack. One of them, Shamsidin Fariduni, was in Türkiye in February, and from there he flew to Russia on March 4. He spent at least ten days in Türkiye and investigators are currently determining who he communicated with while there.
According to unofficial information, he met with a certain “Islamic preacher” in Istanbul. However, it is also known that the terrorists corresponded with the “preacher’s assistant.” According to Fariduni, this anonymous person sponsored and organized the terrorist attack.
After arriving in Russia, Fariduni visited Crocus City Hall on March 7 in order to see the site where the crime was to be committed. From this, we may conclude that the attack was to take place soon after his arrival from Türkiye. On the same day, the US embassy in Russia warned its citizens to avoid large gatherings “over the next 48 hours” due to possible attacks by extremists.
The next concert at Crocus City Hall was given by the singer Shaman, who is known for his patriotism. However, his concert on Saturday, March 9 passed without incident. In the following days, there were other performances at the venue, but apparently the terrorists were forced to adjust their plans.
As a result, they chose the concert by the band Picnic, scheduled for March 22. Although this band is not as popular as Shaman, it is also known for its patriotic stance and for donating funds for the needs of the Russian Armed Forces in Ukraine.
What happened afterwards
None of the terrorists planned to “join the Houris in paradise,” as is usual for IS followers. After shooting people in Crocus City Hall and setting the building on fire, they did not attack the special forces which arrived at the scene and instead got in a car and fled from Moscow. Neither did they wear “suicide belts” – a characteristic detail of IS followers who are ready to die after committing their crime.
Another detail which is uncharacteristic for IS is the monetary reward promised to the terrorists. The payment was supposed to be made in two installments – before and after the attack. The terrorists had already received the first payment, amounting to 250,000 rubles ($2,700).
The most important detail is the location where the terrorists were detained. Traffic cameras allowed intelligence services to monitor where they were headed. They were eventually detained on the federal highway M-3 Ukraine – a route which used to connect Russia and Ukraine but lost much of its international importance after the deterioration of relations between the two countries in 2014, and particularly after the start of Russia’s military operation in 2022.
The terrorists were detained after passing the turn to route A240, which leads to Belarus. At that moment, it became obvious that there was only one place where they could be headed: Ukraine.
Despite the fact that the terrorists were armed, only one of them, Mukhammadsobir Fayzov, put up resistance. All of the terrorists were detained alive, which was most likely an order given to the security forces involved in the operation. However, as we mentioned above, the terrorists themselves did not want to die.
Moreover, they knew where to go to save their lives: to the Ukrainian border. Later, in his address to the nation, Russian President Vladimir Putin said that a “window” for passage had been opened for them on the Ukrainian side.
This, too, is uncharacteristic for IS, since someone who carries out a terrorist act, especially an outsider, is always considered “disposable.” Even if he makes it out alive, no one will help him. Moreover, in earlier years, IS usually didn’t take responsibility for an attack if the perpetrator remained alive, as this could harm him during the investigation. However, later the organization no longer cared about this due to the deplorable state in which it found itself.
All this comes down to the fact that compared to other attacks carried out by IS in the past few years, this one is strikingly different when it comes to the level of preparation, detailed planning, and financial compensation.
What does Ukraine have to do with it?
Having already mentioned Ukraine several times, we must note its links with terrorists. Since 2015, it has been known that the Security Service of Ukraine tried to recruit radical Islamists with the goal of carrying out sabotage and terrorist attacks, etc. on Russian territory. Ukraine’s intelligence services were also active among the terrorists in Syria. This cooperation was marked in particular by the arrival in Ukraine of Chechen terrorist Rustam Azhiev, who served in the International Legion controlled by the Main Directorate of Intelligence of Ukraine's Defense Ministry.
Azhiev participated in the second Chechen campaign against the Russian Armed Forces and eventually fled to Türkiye. In 2011, he moved to Syria, where he headed the terrorist group Ajnad Al-Kavkaz. Under his command, the militants participated in hostilities against the Syrian Armed Forces and were noted for terrorist attacks directed against civilians. Azhiev operated side-by-side with groups that are recognized as terrorist organizations not only in the United States, but throughout the world. The main ally of Ajnad Al-Kavkaz was Jabhat Al-Nusra in Syria.
Over time, the Russian Armed Forces and Syrian Armed Forces liberated territories from terrorists and significantly reduced their supply base. As a result, Azhiev and his associates became involved in contract killings, extortion, torture, and racketeering. In 2019, Azhiev even had to publicly apologize for the actions of his associates, who kidnapped the wrong person.
The terrorists had been “unemployed” for several years when in 2022, Azhiev and his associates were approached by Ukrainian intelligence services through an intermediary – field commander Akhmed Zakayev. Azhiev and his associates took part in combat operations against the Russian Armed Forces and as a reward, Azhiev was given a Ukrainian passport.
In 2024, led by Azhiev, the terrorists participated in an attack on border settlements in Belgorod Region. In a video, Azhiev publicly admitted that the purpose of the operation was to destabilize the situation in Russia before and during the presidential elections. This was confirmed by the fact that the attacks stopped right after the elections.
After the terrorist attack in Crocus City Hall, the Austrian newspaper Heute discovered another link between Ukraine and radical Islamists. According to the publication, which cites information from intelligence services, many suspected terrorists had entered the EU from Ukraine. For example, in December 2023, a Tajik citizen and his wife, along with an accomplice, were detained in Vienna. They were preparing an attack on St. Stephen’s Cathedral. The couple had come to the EU from Ukraine in February 2022.
***
Ukraine is the place of residence not only for many terrorists, but also IS administrators and those who sympathize with the terrorists. Some of these people are actively involved in raising funds for imprisoned IS fighters in Syria and Iraq. Some of this money goes to purchasing food and medicines. But quite often, it is spent on buying weapons to carry out attacks inside prisons, and for bribing guards. Since some of the terrorists are officially “employed” in Ukraine’s Defense Ministry and others work for the Security Service of Ukraine, they can both push their employers to organize a terrorist attack or do so on their own, without formally consulting the authorities. Currently, one of the versions is that an employee of the Ukrainian intelligence services could’ve been hiding under the guise of the “preacher’s assistant.”
Moreover, Kiev has prior experience in carrying out terrorist acts on Russian territory – both directly, as in the case of Daria Dugina, and through intermediaries, as in the case of Vladlen Tatarsky. Therefore, using radical Islamists, such as IS followers, to carry out terrorist attacks fully corresponds to Ukraine’s strategy, which comes down to inflicting maximum damage on Russia and its residents.