🖋️

The Crocus City Hall terrorist attack in Moscow (Mar 24)

Date published

Sep 12, 2024 8:34 AM

Date last edited

Sep 17, 2025 12:37 PM

Newsletter issue

Event in Review: The Crocus City Hall terrorist attack in Moscow (Mar 24)

This review article rounds up all the key information on the 22 March 2024 terrorist attack on Moscow’s Crocus City Hall and its aftermath.

On 22 March 2024, armed gunmen perpetrated Russia’s largest terrorist attack since the 2004 school siege in Beslan when they attacked concertgoers in Moscow. The Islamic State (IS) claimed responsibility for the attack, but the Russian authorities sought to exploit the event and blame Ukraine. This roundup covers the details of the event, the investigation into it, and its repercussions.

Overview

What happened?

On Friday 22 March 2024, armed gunmen entered the Crocus City Hall concert hall in northwestern Moscow and opened fire on people attending a gig by the rock group PikNik.

The attack began around 2000 Moscow time, before the start of the gig, and the hall was reportedly half full at the time. After shooting large numbers of people, the attackers apparently started a fire at the venue, which led to the collapse of part of the roof and created cover for them to escape. The security services stormed the building around 2130, by which point the attackers had already fled (The Bell, 2024).

The hunt for the perpetrators focused on a suspicious Renault Symbol that was seen near the venue (Novaya Gazeta, 2024). The car was tracked to Bryansk Oblast, where the FSB claimed on 23 March they managed to detain the four perpetrators and seven accomplices (Meduza, 2024). Further accomplices were detained in subsequent special operations (Kommersant, 2024; Caucasian Knot, 2024; Meduza, 2024).

The Investigate Committee opened a criminal case into the attack under Article 205 (Terrorist attack) (Meduza, 2024).

Crocus City Hall (Крокус Сити Холл) is part of the Crocus City shopping and exhibition centre. The centre is owned by Crocus Group, a major construction firm that, in turn, is owned by Aras Agalarov, a Russian-Azeri businessman with reported links to the Kremlin. Agalarov denies any such links (Telegram, 2024).

How many people were hurt in the attack?

The FSB initially reported that at least 40 people were killed in the Crocus City Hall attack and a further 100 injured (National Antiterrorism Committee, 2024).

Over time, that figure significantly increased: By 27 March 2024, the Investigative Committee was reporting that it had received 143 missing person reports and identified 84 bodies (Investigative Committee of the Russian Federation, 2024); on 30 March, the number of people it had identified had increased to 134 (Meduza, 2024).

The Emergencies Ministry published its own list, identifying 143 victims by name (Meduza, 2024). On 30 March, it also reported that 551 people were wounded, having provided a figure of 382 only the day before (Meduza, 2024).

In later official statistics, the number of people killed had increased to 145, of whom nearly 80 died as a result of fire or smoke inhalation (Kommersant, 2024). In total, 1,700 people were questioned as victims and 800 people classified as witnesses in the case (Mediazona, 2024).

Who carried out the attack?

Video footage from the scene indicated between three and five people carried out the Crocus City Hall attack (The Economist, 2024).

The FSB reported that it had detained four attackers and seven accomplices in Bryansk Oblast (Meduza, 2024).

Another individual was subsequently arrested for providing financial support to the attackers (Kommersant, 2024).

Four more men were detained during a Counterterrorism Operation (KTO) in Makhachkala and Kaspiysk in Dagestan; the FSB accused them of also providing financial support, as well as of planning a further attack in Kaspiysk (Caucasian Knot, 2024; Meduza, 2024).

On 4 April, the FSB reported that a further three people had been detained in Moscow, Yekaterinburg, and Omsk in connection with the attack. Two of the detainees were accused of providing money to the attackers; the third was accused of recruiting accomplices and providing financial support. All three were reportedly of Central Asian origin (Meduza, 2024).

Vazhnyye istorii noted that this brought the total number currently under investigation to 18, with one more (who appears to have been one of the original seven detainees) having died in custody (Vazhnyye istorii, 2024). By 5 April 2024, 11 people had been arrested by courts (RAPSI, 2024); Mediazona reported on 4 April that a court in Dagestan had arrested a further five men — four citizens of Tajikistan and one native of the country — in connection with the case (Mediazona, 2024). As of 5 April, the cases against the three people detained on 4 April had not yet reached the courts.

On 26 April, RBK cited an Interior Ministry source as claiming that another Tajik citizen had been detained in connection with the attack and charged under Article 205 (3) (RBK, 2024). Moscow’s Basmannyy Court arrested the man on 27 April, making him the twelth such person to be arrested by the courts (Meduza, 2024).

On 1 June, Mediazona reported that 20 people were facing criminal charges over the case: of these 18 were implicated in the attack itself and were being held in detention facilities, and two more were accused of negligence relating to fire safety regulations (Mediazona, 2024).

The perpetrators

The direct perpetrators of the Crocus City Hall attack were identified as:

Shamsidin Fariduni, born 17 September 1998, citizen of Tajikistan, alleged leader of group;
Murodali Rachabalizoda, born 4 February 1994, citizen of Tajikistan;
Dalerdzhon Mirzoyev, born 23 November 1991, citizen of Tajikistan; and
Mukhammadsobir Fayzov, born 20 May 2004, citizen of Tajikistan.

The accomplices

The accomplices included:

Dilovar Islomov, the former owner of the Renault, a native of Tajikistan with Russian citizenship;
Aminchon Islomov, Dilovar’s brother and reportedly Fariduni’s brother-in-law, a native of Tajikistan with Russian citizenship;
Isroil Islomov, Dilovar’s father, a native of Tajikistan with a Russian residency permit;
Alisher Kasimov, who rented an apartment to Fariduni, a native of Kyrgyzstan with Russian citizenship;
Nazrimad Lutfulloy;
Yakubdzhoni Yusufzoda, a citizen of Tajikistan;
Mukhammad Sharipzoda, a native of Tajikistan;
Dzhumokhon Kurbonov, a citizen of Tajikistan born in 2003
Shakhromdzhon Gadoyev, a 24-year-old citizen of Tajikistan;
Mustakim Soliyev, a 21-year-old citizen of Tajikistan;
Zubaydullo Ismailov, a citizen of Tajikistan;
Umedzhon Soliyev, a citizen of Tajikistan; and
Khuseyn Khamidov, a native of Tajikistan with Russian citizenship (Kommersant, 2024; Rosfinmonitoring, 2024; Kommersant, 2024; Kommersant, 2024; Meduza, 2024; Mediazona, 2024; BBC Russian Service, 2024; Kommersant, 2024; RAPSI, 2024; RBK, 2024; Caucasian Knot, 2024).

In November 2024, Kommersant reported that four additional defendants, all residents of Ingushetia, were added to the list of people accused of involvement in the attack. Investigators claim the men supplied weapons and may be linked to the Batalkhadzhintsy brotherhood, which has already been declared a terrorist organisation but simultaneously enjoys the support of Chechen Head Ramzan Kadyrov:

Khuseyn Medov, a 32-year-old resident of Surkhakhi;
Dzhabrail Aushev, a 23-year-old resident of Surkhakhi;
Khavazh-Bagaudin Aliyev, a 31-year-old resident of Surkhakhi; and
Batyr Kulyayev, a 27-year-old resident of Ekhazhevo.

Medov and Aushev were arrested, while Aliyev and Kulayev were placed on the wanted list (Kommersant, 2024).

Four further members of the Batalkhadzhintsy Brotherhood, aged between 22 and 35, were reportedly detained in Ingushetia at the beginning of December 2024 on suspicion of helping Batyr Kulyayev evade arrest (Caucasian Knot, 2024).

Additional details on events leading up to the Crocus City Hall attack

Investigative newspaper Novaya Gazeta reported that the Renault had been sold by its owner to his brother-in-law a week before attack (Novaya Gazeta, 2024)

Vazhnyye istorii claimed — based on a Telegram channel reportedly linked to the security services — that Fariduni and Fayzov had visited the site of the attack at least five times in the two weeks prior to the attack, but had been dissuaded from carrying it out earlier by security at the venue (Vazhnyye istorii, 2024).

Turkish media outlet Yetkin Report, citing Turkish security services, said that Fariduni had flown to Moscow on 2 March 2024, having arrived in Istanbul on 20 February to renew his Russian via; Rachabalizoda flew with Fariduni to Moscow, having himself arrived in Istanbul on 5 January 2024 (Vazhnyye istorii, 2024). Pro-Kremlin propaganda channels on Telegram had earlier posted a video showing Fariduni in detention and saying he had arrived from Turkey on 4 March and carried out the attack for RUB 500,000 (Meduza, 2024).

Additional details on the subsequent investigation

Pro-Kremlin Telegram channels leaked footage from the perpetrators’ interrogation that showed them being tortured. Signs of physical violence were evident when the men appeared in court (Meduza, 2024). The lawyers for the suspects also reported that they had received anonymous threats (Nastoyashcheye Vremya, 2024).

Reporting was contradictory on the identities of the men detained in Dagestan: Meduza referred to all four as foreigners, while Caucasian Knot reported that two were from Central Asia and one from Dagestan and did not acknowledge the contradiction between initial statements (which mentioned three detainees) and subsequent ones (which spoke of four) (Caucasian Knot, 2024; Meduza, 2024).

On 7 April, First Channel published an edited video released by the FSB showing the interrogation of the four alleged perpetrators. In the video, they confessed to receiving instructions from someone called “Sayfullo” and said they planned to flee to Ukraine after the attack, where they were supposed to receive one million rubles (Meduza, 2024).

Also on 7 April, the Investigative Committee brought charges for negligence (Article 293 of the Russian Criminal Code) against two Crocus City Hall employees responsible for fire safety at the venue (Meduza, 2024). Investigators blamed them for fire escapes at the venue being blocked, resulting in a higher casualty count; the employees denied the charges, claiming it was the gunmen who blocked access to the fire escapes (Kommersant, 2024).

In November 2024, investigators amended the charges against four people accused of involvement in the attack. As a result, Aminchon Islomov, Dilovar Islomov, Isroil Islomov, and Alisher Kasimov were charged with assisting terrorism, rather than direct participation in the attack. The changes to the charges did not, however, significantly improve their situation: whereas before they faced between 15 and 20 years in prison, under the new charges they face between 12 and 20 years. Moscow’s Basmannyy District Court also extended the four’s period of arrest to 22 February 2025 (Nastoyashcheye Vremya, 2024). Separately, the court extended until 25 February 2025 the arrest of Gadoyev and Mustakim Soliyev, who are accused of preparing a terrorist attack in Kaspiysk and supplying weapons to the Crocus City Hall attackers (Caucasian Knot, 2024). On 26 November, the court extended until 1 March 2025 the arrests of Ismailov, Umedzhon Soliyev, and Khamidov (Caucasian Knot, 2024).

Who claimed (and denied) responsibility?

On 22 March 2024, Islamic State (IS) media outlet Amaq reported that IS fighters had carried out the Crocus City Hall attack (Twitter, 2024). The following day, Amaq issued a longer claim of responsibility, which included video footage from the attack (BBC News, 2024). Attention quickly focused on IS Khorasan Province (IS-KP) as the branch that US officials believed was directly responsible (The Economist, 2024). IS-KP issued a lengthy statement on 25 March that did not directly claim responsibility, but nevertheless praised the attack (Voice of America, 2024).

Vazhnyye istorii identified Abdullo Buriyev as a potential organiser of the attack. According to the media outlet, Buriyev, a citizen of Tajikistan, is wanted by the Turkish authorities for his involvement in an earlier IS-KP attack in the country (Vazhnyye istorii, 2024).

Ukrainian presidential advisor Mikhail Podolyak denied Ukraine had anything to do with the attack (The Economist, 2024). Unnamed representatives of the Russian Volunteer Corps, which fights with Ukraine and seeks the overthrow of Putin’s government, told Novaya Gazeta Europe “it’s definitely not us.” (Telegram, 2024) A representative for the Free Russia Legion also denied responsibility, insisting the group “is not at war with peaceful Russians” and blaming the Russian security services (Barron’s, 2024).

How did the Russian authorities respond?

The initial response

The immediate official response to events at Crocus City Hall focused on physical security measures. For example, the authorities in Moscow cancelled all major public events over the weekend, as did those in numerous other federal subjects (Meduza, 2024).The Telegram channel Baza reported that shopping centres in Moscow and St Petersburg were being evacuated. The Ministry of Education and Science also recommended that higher education institutes cancel any large gatherings and switch to online tuition (Lenta.ru, 2024).

Russian officials blame Ukraine

However, political attention quickly shifted to identifying the perpetrators, and this largely involved pointing the finger at Ukraine. The FSB claimed that the attackers planned to cross the Russian-Ukrainian border after the attack and “had contacts with the Ukrainian side” (Kommersant, 2024; Izvestiya, 2024). Meduza cited two anonymous employees of state media outlets as claiming those outlets had received instructions from the Kremlin about how to cover the event, and these told them to play up any potential Ukrainian links (Meduza, 2024).

On 23 March, President Putin made his first public address about the attack. Describing the attack as “a horrific and savage act of terrorism,” he declared 24 March a national day of mourning and noted heightened counterterrorism measures had been imposed on Moscow and the rest of the country. He claimed the security services were “working diligently to identify and expose the accomplice base behind these terrorists: those who provided them with transport, planned escape routes from the crime scene, and prepared caches with weapons and ammunition.” He threatened that “we will identify and bring to justice each and every individual who stands behind these terrorists, those who orchestrated this atrocity, this assault against Russia and our people” (President of Russia, 2024).

In separate comments made during a video conference with various officials, Putin acknowledged the attack was carried out by radical Islamists but asked “who stands to benefit from it? This act of violence is likely just one in a series of attempts by those who have been fighting against our country since 2014, using the neo-Nazi Kiev regime as a pawn” (President of Russia, 2024).On 2 April, Putin addressed an expanded conference of the Interior Ministry, at which he accused the attackers of seeking to “provoke ethnic strife, xenophobia, Islamophobia, and so forth,” claiming their main goal was to “divide Russia from within” (President of Russia, 2024). On 4 April, Putin addressed trade union delegates and claimed that Russia “cannot be an object of terrorist attacks by Islamic fundamentalists. Our country has demonstrated a unique example of interfaith affinity and unity, interreligious and interethnic unity. And we are acting on the international stage in a manner that can hardly make us an object of attacks by Islamic fundamentalists either.” Instead, he reasserted his claim that the goal of the attack was to divide Russia and “undermine the unity of Russian society.” His comments on this occasion did not explain who was to blame, if not “Islamic fundamentalists” (President of Russia, 2024).

FSB Director Aleksandr Bortnikov continued the theme of blaming Ukraine, accusing Ukrainian and Western security services of assisting the radical Islamists who carried out the attack: “We believe that the action was prepared both by the radical Islamists themselves and, naturally, by Western intelligence agencies, and that the Ukrainian intelligence services themselves are directly related to this” (Interfax, 2024). He also said that Russia should declare Ukraine’s Security Service (SBU) a terrorist organisation (Interfax, 2024).

The Investigative Committee then claimed it had discovered evidence that the attackers were linked to Ukrainian nationalists and had received cash and cryptocurrency from Ukraine (Investigative Committee of the Russian Federation, 2024). It subsequently claimed that the attackers had confessed to receiving voice messages from an anonymous man on Telegram, who had instructed them to head to Kyiv after the attack to receive their “reward” (Telegram, 2024).

Dmitriy Medvedev, the former president and current deputy head of Russia’s Security Council, said that the political leaders of Ukraine should be eliminated if their involvement in the attack were proven (Kommersant, 2024). Nikolay Patrushev, head of the Security Council, said that the search for the organisers and sponsors “leads to the Ukrainian security services,” which are “fully under the control” of the United States; he accused the US of creating IS and Al-Qaeda (Kommersant, 2024).

Calls to bring back the death penalty

More broadly, members of the Russian elite renewed debates over bringing back the death penalty — a move supported by three of five factions in the State Duma. Changes to the Russian Constitution would likely be necessary for this to happen (Kommersant, 2024; Kommersant, 2024).

What was the reaction elsewhere?

Western countries reject Ukraine links to Crocus City Hall attack

Shortly after the attack, US national security spokesperson John Kirby stated that the US had no information to suggest Ukraine was involved in the attack. Fear that Russia would use the attack to blame Ukraine swiftly emerged as a theme among Ukraine and its Western allies. The Economist, for example, cited an anonymous “high-level intelligence source” in Ukraine who voiced fears Russia would exploit the attack to blame Ukraine and drive a wedge between it and its Western supporters (The Economist, 2024).

French President Emmanuel Macron urged Putin not to use the attack to blame Ukraine, describing any such effort as “cynical and counterproductive” and claiming French intelligence supported the claim that it was linked to IS. European Commission foreign policy spokesman Peter Stano similarly called on Moscow not to use it as a “pretext” for action against Ukraine or further repression at home (Financial Times, 2024).

Debates over effectiveness of counterterrorism response

Kirby later reported that the US had repeatedly warned Russia in recent weeks about a forthcoming attack by radical Islamists, and again dismissed any connection to Ukraine as “nonsense and propaganda” (The Guardian, 2024).

Putin had publicly dismissed warnings as “outright blackmail” and an attempt to “intimidate and destabilise our society.” US intelligence officials fed information to the New York Times that its warnings had included information about a plot by IS-K. The New York Times likewise reported on an internal Russian intelligence report obtained by Dossier Center (funded by exiled former oligarch Mikhail Khodorkovskiy) that warned of the increased domestic threat posed by IS-K — raising questions about the competence of the Russian security services (The New York Times, 2024). Foreign Intelligence Service Director Sergey Naryshkin acknowledged that Russia had received information about a terrorist threat, but claimed that it was “too general” to take preventative action on (TASS, 2024).

The implications for minorities

Tajikistan’s Interior Ministry denied the involvement of three other citizens whose details had circulated on social media, insisting that two of them were in Tajikistan at the time of the attack and providing photographs of the men with their passports (Meduza, 2024). On 12 April, Tajikistan’s Foreign Minister Sirojiddin Muhriddin called on Russian law enforcement to observe international norms of the presumption of innocence and the prohibition on the use of torture (Meduza, 2024).

BBC reported that Central Asian migrants were experiencing an increase in racially motivated violence and discrimination as a result of the attackers’ links to the region (BBC News, 2024).

Chechen Head Ramzan Kadyrov accused Russian nationalists of attempting to exploit the situation by inciting ethnic tension (Kavkaz Realii, 2024).

Members of Akhmat-Rossiya, one of the Chechen units in the Russian Ministry of Defence, received awards for their involvement in the response to the attack. The Chechen authorities claim the unit participated in the operation in Bryansk Oblast (Kavkaz Realii, 2024).