The deadly terrorist attack on Crocus City Hall outside Moscow has triggered a flood of unsubstantiated assessments spread widely in Russia.
They include suggestions that the Islamic State (IS) militant group, which claimed responsibility, could not have carried out the attack because its attackers die for the cause and never accept payment.
But experts say such conclusions are inaccurate and based on false assumptions.
Russian President Vladimir Putin has blamed "radical Islamists" for the attack that left at least 143 people dead, while questioning whether members of a group who "position themselves as faithful Muslims” would carry out an attack during the holy month of Ramadan.
That, along with Putin's steadfast avoidance of specifically identifying IS as behind the attack and allegations of Ukrainian involvement, has highlighted the doubt the Kremlin has tried to cast on both IS’s claim of responsibility and on foreign intelligence identifying a regional branch of the militant group as the perpetrator.
Experts widely agree that the attack was "classic IS," while noting the claim was backed by video evidence released by IS's multilingual propaganda machine and that the militant group had made its hostility to Russia publicly known.
"The attack in the Moscow region has been claimed by the Islamic State's central leadership and its official propaganda apparatus," said Lucas Webber, co-founder of Militant.Wire.com. "The attack was almost certainly conducted by the Islamic State and the brutal and indiscriminate nature of the attack fits with the MO [modus operandi] of the Islamic State's international terrorists and operations."
IS, which Russia has fought in Syria, Iraq, and Africa and which has regional affiliates near Russia's borders, first identified Russia as one of its primary enemies in 2014. The enmity "intensified in 2015 when Russia intervened militarily in Syria to support [Syrian President Bashar al-Assad]'s government, and it continued to intensify after Russia's various military and private military-contractor interventions across Africa," Webber said.
Another common assumption is that all IS attacks are suicide missions, with those who carry them out either blowing themselves up or fighting to the death for the cause.
Moscow has detained at least 11 people in connection with the attack and has charged four of them, all said to be Tajik nationals apprehended 350 kilometers southwest of Moscow, near the border with Ukraine and Belarus, and accused of taking part in the attack.
"Just because attackers aren't suicide attackers doesn't mean they aren't IS," said Colin Clarke, director of research for the New York-based Soufan Group think tank.
"For one, the terrorists could've avoided procuring large amounts of explosives for suicide vests as part of their operational security," Clarke said. "Second, they may have intended to escape so they could strike again, and thus decided against a martyrdom operation. There isn't one uniform approach to conducting these kinds of attacks."
While IS claimed responsibility as a whole, U.S. and French intelligence among others have specified that Islamic State-Khorasan, the Afghanistan branch, carried out the attack.
That four of the suspects captured and charged by Russia are believed to be Tajik has also steered many observers to pin blame on IS-K, which has also been accused of carrying out recent attacks in Afghanistan, Iran, and Turkey, among others.
IS-K is made up of Afghan and foreign fighters, particularly from Central Asia.
Riccardo Valle, director of research for The Khorasan Diary, an online platform that tracks militant groups in Afghanistan and Pakistan, said there is no direct evidence at this point clearly tying IS-K specifically to the attack.
"Some people are bringing pieces of evidence, such as the ethnicity of the attackers, as clear evidence that Islamic State-Khorasan is behind the attack, but that isn't sufficient," Valle said.
"There are several things, some stronger, some weaker that could suggest the possible involvement to different degrees by the Islamic State-Khorasan," Valle said. "What I mean is that the Islamic State-Khorasan might have actually provided support, whether financial, logistical, or communications, to a local cell that carried out the attack."
Valle explained that the IS network is fluid and includes regional affiliates and local cells. In the case of IS-K, the group may have influenced the attackers even if not directly involved.
Valle singled out IS-K's extensive propaganda arm, which "for the past three years has been majorly focusing on Russia." That effort, which includes the dissemination of material in English, Pashto, Russian, Uzbek, and Tajik, among other languages on a variety of platforms, "might have galvanized local cells and sparked the idea of planning attacks in Russia."
Experts said it is not unprecedented for perpetrators of IS attacks to attempt to flee.
Abdul Sayed, a Sweden-based researcher who tracks militant groups in South Asia, said the IS playbook allows for attacks that do not involve suicide and that "it is not the first time that an IS attacker escaped."
As one example, Sayed noted an attack targeting Chinese citizens at the Longan Hotel in Kabul in December 2022 in which one of the attackers escaped and reemerged a few days later to carry out a suicide bombing.
Specifying other IS attacks tied to IS-K, Webber mentioned the Kabul hotel attack, a church shooting in Istanbul in January, and a mosque attack in Shiraz, Iran, last August.
Russia has not acknowledged IS's claim of responsibility for the March 22 attack near Moscow.
In his latest comments on March 25, Putin did not blame the attack on IS, saying that unnamed "radical Islamists" were behind the attack. In a backhanded reference, he alleged that the United States was "trying to convince its satellites and other countries" that "there is supposedly no Kyiv trace in the Moscow terrorist attack" and that it was committed by followers of the "IS organization banned in Russia."
Meanwhile, Russian Foreign Ministry spokeswoman Maria Zakharova, in an article published by the Komsomolskaya Pravda newspaper, accused Washington of using the "bogeyman" of IS to cover for its "wards" in Kyiv.
Zakharova followed up on March 27 by saying that it was "extremely hard to believe" that IS had the capabilities to carry out the attack on Crocus City Hall, the deadliest Russia has suffered in 20 years. She continued to double down on the assertion that Ukraine was involved, without providing evidence.
Ukraine, which Russia invaded in 2014 prior to its all-out invasion in 2022, has strongly denied any involvement in the attack.
Russian politicians, pro-Kremlin pundits and media, and online voices and bots have taken the baton from Putin and Zakharova, feeding the notion that the alleged attempt by the suspected attackers to flee to Ukraine cast doubt on whether they were really members of IS.
One argument being made to support that idea comes from an alleged confession apparently made under duress by suspects after their capture.
Unverified coverage of an interrogation of one of the alleged attackers quoted the man as saying he had been offered 500,000 rubles (about $5,000) to carry out the attack on Crocus City Hall.
Valle of the Khorasan Diary emphasized that "these statements made by the captured attackers have been made under conditions that are near torture, if not blatantly torture, and that under those conditions people tend to say things that might not be true."
But Valle said that even if attackers are paid, it should not be taken as an indication that they are not working for IS.
"Fighting for the Islamic State does not mean that someone is not also interested in money," Valle said, suggesting payment could not only go to the attacker but to the attacker's relatives, friends, or others in their circle. "There is also the possibility that attackers in such cases might survive, so they might use this money for other potential operations."
Sayed said it is common for the authorities where IS attacks have taken place to claim the attackers were paid, although he personally has not seen evidence to support those claims.
Clarke said perpetrators of terror attacks could potentially accept payment or carry them out in the pursuit of their ideology, or both.
"There were instances of attacks in Iraq where individuals rolled up as part of Al-Qaeda in Iraq were paid to emplace improvised explosive devices (IEDs). Some families of Palestinian suicide attackers reportedly received payments following their deaths," Clarke said. "But to say that terrorists do this for money would be inaccurate. They aren't criminals; there is a political and ideological element at play."
