Reeling from an apparent security lapse that allowed a group of heavily-armed men to massacre dozens of concertgoers in Moscow last week, Russia has gone into overdrive advancing a narrative that pins the blame on a usual suspect: Ukraine.
Western officials have said Islamic State is responsible for the March 22 attack on the Crocus City Hall concert venue, which killed at least 143 people and left hundreds wounded. The group claimed responsibility through the ISIS-affiliated news agency Amaq. But Russian authorities, embroiled in a costly war with Ukraine and having convinced Russians that Kyiv and its Western backers are the source of its ills, quickly reverted to form.
“Islamists couldn’t prepare such an action alone,” Alexander Bortnikov , the head of Russia’s Federal Security Service, told Russian state TV. He accused Western security services of involvement and echoed earlier comments by President Vladimir Putin that the attackers planned to flee to Ukraine where “they were supposed to be greeted as heroes.”
This week’s cover of Russia’s biggest weekly newspaper shows portraits of Western leaders engulfed in flames. “We know the architects of the Crocus terrorist act. We hope they burn in hell,” reads the banner headline. “They can tell lies about ISIS to each other.”
Putin acknowledged on Monday that the attack was conducted by Islamist radicals, but hinted that Kyiv and its U.S. backers were involved and linked the attacks to armed raids into Russia by Kyiv-backed commandos and Ukrainian drone strikes on Russian energy infrastructure.
Neither he nor the other Russian officials gave evidence of Ukrainian complicity. Kyiv has vehemently denied any involvement in the attack, and the U.S. on Tuesday dismissed Russia’s claim.
“It’s simply not true,” State Department spokesman Matthew Miller said. “Those comments by Russian officials, including from President Putin, are just propaganda to justify their continued aggression against Ukraine.”
But senior members of Putin’s government have in recent days stepped up their allegations, explicitly blaming Ukraine and now its allies in the West, too. On Wednesday, Russian investigators said they were probing reports that the U.S. and other Western countries had been financing and helping perpetrate terrorist attacks in Russia.
Analysts say the coordinated campaign to blame Ukraine is part of a push to divert attention away from security failures that appear to have allowed the attackers to enter the concert hall despite a police presence inside the building. Putin has placed Russia’s economy on a war footing and mobilized Russian society for the war effort in Ukraine, which he has portrayed as an existential struggle between Russia and the West. Evidence that few resources were allocated for other threats would be damning.
“They want to categorize this attack as part of a broader standoff with the West and Ukraine and not just a failure of the Russian security services,” said Kirill Shamiev , a fellow at the European Council of Foreign Relations. He said Russia is hedging its bets by acknowledging that radical Islamists were responsible, but avoiding the humiliation of depicting them as operating separately from the war in Ukraine.
“It’s a very careful public engagement game,” he said.
Four of the alleged gunmen, who authorities said all hailed from the Central Asian republic of Tajikistan, appeared in court on Sunday, and Russia has since arrested four other suspects. Authorities say they have received more than 140 requests for information on missing relatives and friends, and a makeshift memorial outside the concert hall has swelled with flowers laid by passersby.
Graphic videos showing the suspects being tortured after their arrest in Russia, with one having part of his ear sliced off, were shown across Russia after they surfaced online on Saturday, with some pro-Kremlin figures gloating over what they described as just comeuppance and others calling for a reinstatement of the death penalty for the shooters.
Members of Russia’s sizable Tajik community, which props up the tiny Tajik economy by sending remittances home, expressed fears that a backlash over the attack would target Tajik residents in Russia.
“Notwithstanding all this horror and darkness, we have to remain human beings,” Tajik-Russian singer Manizha, who represented Russia in the Eurovision Song Contest in 2021, said in a video posted to Instagram.
For more than a decade, Russia has expended vast resources on a propaganda campaign focused on chalking up the country’s problems to nefarious schemes orchestrated by the West and portraying Ukraine as a puppet regime acting on Western orders, an effort that moved up a gear after Putin launched his invasion of Ukraine in February 2022.
After Russian-backed separatists shot down Malaysia Airlines flight MH17 over Ukraine in 2014, Russian state media spun stories suggesting, variously, that the flight was full of corpses before it was struck by a missile or that Kyiv was aiming to down a plane carrying Putin. After two investigative news organizations identified the Russians responsible for the attempted murder of a former Russian spy in the British town of Salisbury in 2018, Russian state TV aired interviews in which the men claimed to be visiting Salisbury as tourists.
Now the war in Ukraine has also prompted Russian authorities to expand their definition of what qualifies as terrorism. A vast crackdown on dissent has targeted thousands of government critics, many of whom have been branded terrorists and extremists by the state in a campaign that rights activists say has moved resources away from investigating national security threats.
The campaign to pin the latest incident on Ukraine and divert attention from Russia’s security failings was aimed not just at a domestic audience, according to research by ActiveFence, a cybersecurity company that advises social-media platforms on fighting disinformation. ActiveFence has found tens of thousands of newly-launched X accounts that have been publishing posts backing the Russian line on Ukrainian and Western complicity, in at least seven languages including Arabic.
“The scale and investment is something that’s usually indicative of state actors,” said Rachael Levy, who focuses on geopolitical risk at ActiveFence and who says the disinformation push on social media has hallmarks of past campaigns by Russia. “They very much target international audiences on a range of issues. This is a tool in their toolbox, and a strategic one.”
Some X posts, which appeared within 48 hours of the Moscow attack, feature cartoons showing a British officer commanding a soldier to attack the concert venue. “Blaming ISIS is a sidetrack. The main focus should be on Kiev and London,” says one post retweeted thousands of times, using the Russian name for Ukraine’s capital.
Write to Matthew Luxmoore at matthew.luxmoore@wsj.com
