By: Nicoleta Banila
March 26 2024
On the evening of March 22, armed individuals shot at random and deployed incendiary devices inside the Crocus City Hall in Moscow, killing at least 143 and injuring over 360 in the deadliest shootout on Russian soil since the Beslan school siege in 2004.
As expected, the incident fueled speculation of Ukrainian and U.S. involvement, accompanied by false videos purportedly portraying a fierce Russian bombardment of Kyiv, among other misleading content that Logically Facts has fact-checked. Before showing you what we found, let’s sort through all the information we have gathered about the attack from relevant public sources to paint a clearer picture of what we know so far.
A day after the attack, the Director of the Russian Federal Security Service Alexander Bortnikov announced the arrest of 11 people, including four terrorists who directly participated in the terrorist attack. Not long after, Margarita Simonyan, editor-in-chief of state-owned news outlet Russia Today, published two videos on Telegram of agents interrogating two men who allegedly committed the attack, while Telegram channel Baza shared another video with a third suspect on the same day; all videos were picked up by another state-owned Russian news agency, Ria Novosti.
While authorities were looking for the suspects, ISIS claimed responsibility for the attack in a statement published by its official news agency Amaq on Telegram and a day later released a photo allegedly showing the four attackers wearing black baseball caps and face scarves with the IS black flag in the background. "The attack comes within the context of a raging war between the Islamic State and countries fighting Islam," read a statement accompanying the photo.
(Selfie of the alleged attackers shared on X/Screenshot)
On the same day, it released footage of the gunmen recording themselves as they pursued people through the lobby of the concert hall, shooting at them up close with assault weapons. The New York Times matched the clothes of the terrorists in the photo to the ones the suspects were wearing during the shootings and during the interrogations.
On March 25, the Basmanny Court of Moscow officially indicted four individuals for carrying out the deadly attacks, sentencing them to pre-trial detention until May 22. All four suspects claim to be from Tajikistan, and their names are, as announced by the Courts of general jurisdiction of the city of Moscow Telegram channel, Mirzoev Dalerjon Barotovich, Rachabalizoda Saidakrami Murodali, Shamsidin Fariduni, and Muhammadsobir Fayzov. All four appear to have been severely beaten, and various videos were published on Telegram that allegedly depict the torture of Fariduni and Rachabalizoda. Asked by CNN about these images, Kremlin spokesman Dmitry Peskov said, "It is inappropriate to comment on them until the investigation is complete."The other three suspects, a father and his two sons, were brought to Court on March 25, according to the state-owned Russian news agency TASS.
The seven suspects were charged by a Moscow Court with carrying out the armed attack. Source: Courts of general jurisdiction of the city of Moscow Telegram channel/Screenshots/ Edited by Logically Facts)
Two messages posted on X claim that Iranian media published a threat released by Al Azaim, an IS-Khorasan propaganda network in Tajikistan, vowing to take revenge "very soon" for Russian authorities' torture of the suspects arrested in connection with the Crocus attack City Hall. IS-Khorasan, or ISIS-K, is a branch of the Islamic State that has been active mostly in Iran and Afghanistan.
In his statements on March 25, President Vladimir Putin admitted for the first time that the perpetrators of the attack in Moscow are "radical Islamists, whose ideology the Islamic world itself has been fighting for centuries," but resumed accusations against Ukraine being involved in the attack and suggested that the U.S. is trying to convince its "satellites" and other countries that "there is supposedly no Kiev trace in the attack." This is the same position Putin maintained a day after the attack when he accused Ukraine, without evidence, of preparing a "window" for the attackers to cross the border.
In this context, Belarusian President Aleksandr Lukashenko’s statements that the men who attacked the Crocus Hall were initially headed to Belarus, and not Ukraine, came as a surprise. According to Lukansenko, the terrorists couldn’t get into Belarus, so they changed direction and headed toward the Ukrainian-Russian border.
White House National Security Communications Advisor John Kirby said on March 22 that "there is no indication at this time that Ukraine or Ukrainians were involved in the shooting." Russian Foreign Ministry spokesperson Zakharova condemned his remarks, demanding that the U.S. "hand over any information on the attack" and slamming officials in Washington for "drawing any conclusions about someone’s innocence in the midst of a tragedy."
The Foreign Affairs Ministry in Ukraine categorically rejected accusations from Russian officials that Ukraine was involved in the shooting, labeling them as a Kremlin-planned provocation to fuel anti-Ukrainian sentiment in Russian society, create conditions for increased war mobilization, and discredit Ukraine internationally.
U.S. National Security Council spokesperson Adrienne Watson said in a statement that "ISIS bears sole responsibility for this attack. There was no Ukrainian involvement whatsoever." As early as March 7, the U.S. Embassy in Moscow warned U.S. citizens to avoid large gatherings over the respective weekend due to fears of a terrorist attack.
On March 24, U.S. Vice-President Kamala Harris told ABC that ISIS-K is "by all accounts, responsible for what happened," rejecting Putin’s claim that Ukraine played a part in the terrorist attack.
In a further attempt to suggest Ukraine’s involvement in the attacks, Russian Ministry spokeswoman Maria Zakharova said that it is "extremely hard to believe" that the Islamic State would be able to launch such an attack. Zakharova is also claiming that the West has rushed to pin responsibility on ISIS to shift the blame from Ukraine and its Western allies.
As expected, several false claims about the incidents started circulating after news broke out. One of them happened in the first hours of the incident when NEXTA published a photo of the five terrorists, supposedly natives of Ingushetsia, but later published a disclaimer saying that Russian media removed their photos because they were killed during a shootout in early March.
Russian TV aired a deepfake video of Oleksii Danilov, Secretary of the National Security and Defence Council of Ukraine, claiming that the country was involved in the attack. In the video, which Ukraine’s Center for Countering Disinformation called "the weak work of Russian propagandists," the face of Chief of Ukraine's Defence Intelligence Kyrylo Budanov was replaced with Danilov's face. The two original interviews can be found here and here.
Above: a deepfake video aired by Russian TV. Below: The two videos used to make the deepfake. Source: Russian TV/Screenshots/Telegram,YouTube/Composite by Logically Facts)
Logically Facts has debunked more false claims related to the attack. Here's a roundup of all the misinformation narratives we have fact-checked so far.
Social media users claimed that a white van with old-style Ukrainian license plates was seen near Crocus City Hall, alleging that it indicates a Ukrainian connection to the incident. Upon examining the video, Logically Facts determined that the license plates do not resemble Ukrainian plates, neither old nor those currently in use, but those used in Belarus.
Read the fact-check here.
Another viral claim was that one of the suspects of the terror attack being interrogated in a video shared online by Russia Today editor-in-chief is Rustam Azhiev, the leader of a Chechen Islamist faction who has fought in the Russian invasion of Ukraine on the Ukrainian side. Russian authorities charged four men, including the individual seen in the video, identifying him as Dalerdzhon Mirzoyev. According to the Russian state-run news agency Tass, the man claimed he is a citizen of Tajikistan.
Read the fact-check here.
Some social media users claimed the U.S. knew of the attack in advance and circulated screenshots of a 48-hour security alert issued by the U.S. Embassy & Consulates in Russia on March 7. The warning advised those in Moscow to avoid large gatherings due to an increased risk of an attack. However, the warning was issued for only two days and was published two weeks before the attack.
Read the fact-check here.
Social media posts claimed to show the bombing of Kyiv on March 22, following the terrorist attack at Crocus City Hall. The footage was accompanied by captions such as "Ukraine is getting bombed to hell right now." and "Kyiv on Saturday 22 March has been bombed into absolute oblivion, all Water, Electricity, Gas, critical infrastructure, such as roads, railways, bridges have been all but destroyed." Upon a reverse video search, we could see that the footage does not show Kyiv or any other city in Ukraine, but captures scenes from the Iraqi capital of Baghdad in 2003 at the beginning of the U.S.-led invasion of Iraq.
Comparison between the viral footage and archive footage of the 2003 bombing of Baghdad. (Source: YouTube/Screenshots/Annotated by Logically Facts)
Read the fact-check here.
Another viral video claiming that the attack was staged shows a truck full of body bags. The camera zooms in on one of the bags, showing a person smoking a cigarette. Using reverse image search, we found that the video originates from a Russian TikTok account and was uploaded in 2021. The video shows the same footage but with rap music, and its description reads, "Husky music clip filming - Never Ever."
Read the fact-check here.
This story was updated on March 28 with the latest number of casualties and injured, as well as with statements from Belarusian President Lukashenko and Russian Foreign Affairs Ministry spokeswoman Maria Zakharova.