Editor’s Note: Early March 23 local time in Russia, the Islamic State claimed responsibility for the attack in a post on the group’s Telegram channel.

The worst terrorist attack in Russia in decades exposes vulnerabilities in the country's security and intelligence services, and while it may have been carried out by Islamist extremist or North Caucasian groups, it opens the door for the Kremlin to blame the attack on Ukraine and the West, and to intensify its domestic crackdown on dissent and expand its war efforts against Ukraine. More than 40 people were killed and over 100 were injured in a mass shooting and bombing attack at a large theater on the outskirts of Moscow on March 22, marking the deadliest terrorist incident Russia has seen since the 2004 Beslan school siege, and the deadliest incident in the capital city has seen since the 2002 Nord Ost theater siege. According to Russian authorities, the attack was conducted by at least four individuals, who burst into the Crocus City Hall — located some 20 kilometers from Moscow's city center — after quickly subduing the building's unarmed security forces. The attackers then opened fire and detonated explosives as a concert was taking place for which over 6000 tickets had been sold. The building was set on fire and fire brigades reportedly arrived before special forces could confirm whether the building had been cleared of the attackers. Initial reports suggest the perpetrators are either still hiding in the concert hall or have escaped by vehicle and are being pursued by authorities, as there was no confirmation any of them were subdued.

• Since the 2000s, mass casualty events of this type have been rare in Russia, mostly isolated to the country's southern Caucasus region. 

While the attack was likely conducted by Islamic State militants or domestic Islamist or successionist groups, Russian authorities will probably seek to tie the incident to U.S. foreign policy. The most likely perpetrators appear to be an Islamist extremist group, particularly Afghanistan-based Islamic State Khorasan Province, which has increasingly plotted attacks beyond Afghanistan in recent months. The group has intensified its recruitment of Central Asians in recent years, and has held grievances against Russia for its involvement in Central Asia and its support and conduct of counter-Islamic State operations, among other things. Just over two weeks before the Moscow concert hall attack, the U.S. Embassy in Moscow issued a security alert on March 7 warning of ''reports that extremists have imminent plans to target large gatherings in Moscow, to include concerts,'' within the next 48 hours. The alert was issued several hours after Russia's Federal Security Service (FSB) disrupted a plot allegedly orchestrated by a cell of ISKP members to attack a synagogue, which suggests that U.S. authorities did not believe Russian action had fully eliminated the threat or that the embassy's warning was completely unrelated to the synagogue raid. However, on March 19, speaking at the collegium of the FSB, Putin called such warnings from Western countries about the possibility of terrorist attacks in the Russian Federation ''outright blackmail'' and mere ''provocative statements intended to intimidate and destabilize our society.'' However, Chechen, Ingush, and other North Caucasian Islamists and successionist groups also cannot be ruled out as the potential perpetrators due to their continued activity inside Russia and their history of proving at least willing to conduct mass casualty attacks. 

• There may also be a precedent for Russian false flag operations against its own population. Some Russian historians and investigators have alleged that Russia's FSB was behind a series of apartment bombings in the 1990s in order to help bring Putin to power and justify the initiation of the Second Chechen War. This context — combined with the lack of details about the recent Moscow attack's perpetrators, and the fact that the incident will help the Kremlin justify escalating its war in Ukraine — will likely continue to fuel speculation that Russian security forces were potentially involved in the terrorist attack. 

Moscow will use the mass casualty incident to justify greater mobilization of society in support of the war in Ukraine, while also pointing to Russia’s vulnerabilities to terrorism and other ways it may respond. Before information on the perpetrators was available, notable pro-government media outlets like Rybar, as well as numerous nationalist bloggers and public figures, were quick to claim that no matter who was the direct perpetrator of the terrorist attack, Russia must remember it was committed in the context of Ukraine and in the interests of Ukraine, and called on the Russian government to escalate the war in response to the incident. Such an escalation could take the form of further mobilization measures in order to bring more Russian men into the army or other security agencies, such as the National Guard (Rosgvardiya). The incident may also be used to justify a shakeup in Russia's security leadership and greater devotion of internal security personnel to Islamic terrorism threats amid the inability to completely control and monitor threats emanating from the North Caucasus and radicalized individuals in nearby Central Asian countries who can enter Russia with relative ease. But as resources are scarce and effective measures may not sufficiently assuage public demand for a response, more demonstrative measures, such as large-scale counterterrorism operations in the Caucasus or strikes on ISKP camps in Afghanistan, cannot be excluded.

• In response to the March 22 Moscow attack, a White House spokesperson warned against prematurely connecting the incident to Ukraine, and said there was ''no indication at this time that Ukraine or Ukrainians were involved in the shooting.'' 
• Russian Foreign Ministry spokeswoman Maria Zakharova decried the White House statement, asking on what basis officials in Washington had in drawing any conclusions about Ukraine's innocence, and saying that if the United States has or had reliable data in this regard, then it must be immediately transferred to the Russian side.
• Former Russian President and current deputy head of Russia's Security Council Dmitry Medvedev said that all of the perpetrators must be found and mercilessly destroyed as terrorists, ''including officials of the state that committed such an atrocity…if it is established that these are terrorists of the Kyiv regime'' — a potential reference to Moscow's intention to contrive Ukrainian involvement.