Analysis of Crocus City Hall terror attack in Moscow, Russia

Analysis of Crocus City Hall terror attack in Moscow, Russia

On 22 March 2024, at around 20:00 MSK (UTC+3), a coordinated attack occurred at the Crocus City Hall music venue in Krasnogorsk, Russia, on the western edge of Moscow. The attack started shortly before the Russian band Picnic was scheduled to play a sold-out show at the venue. Four gunmen carried out a mass shooting, as well as slashing attacks on the people gathered at the venue and used incendiary devices to set the venue on fire. Investigators said the attack had killed at least 137 people, and more than 182 concertgoers were injured due to gunshot wounds and “poisoning” related to the fire.

The Islamic State – Khorasan Province (IS–KP), an Afghanistan-based regional affiliate of the Islamic State, claimed responsibility in a statement through the Amaq News Agency shortly after the attack. Amaq also published a video of the attack, filmed by one of the attackers. It showed the attackers shooting victims and slitting the throat of a victim, while the filming attacker praises Allah and speaks against infidels.

Russian president Vladimir Putin called the attack a “barbaric terrorist act” and said that the gunmen had been arrested. He also declared 24 March to be a national day of mourning. Russia’s Foreign Ministry called the incident a terrorist attack. It is the deadliest terrorist attack in Russia since the Beslan school siege in 2004.

Investigators detained 11 people in relation to the attack, including four suspects, who were charged with terrorism on 24 March.

Moscow Crocus City Hall terrorists

Suspects

– Dalerdzhon Mirzoyev, aged 32. Hailing from Tajikistan, Mirzoyev had acquired a temporary registration for three months in Novosibirsk. However, RIA Novosti reported that his registration had lapsed.

– Saidakrami Rachabalizoda, aged 30, informed the court that he possessed Russian registration documents but confessed to being unable to recall their whereabouts. He communicated through an interpreter.

– Shamsidin Fariduni, aged 25, a native of Tajikistan, was officially employed at a factory in Podolsk, and was registered in Krasnogorsk.

– Muhammadsober Faizov, aged 19, presented himself nonresponsive in a wheelchair. Formerly employed in a barber shop in Ivanovo, northeast of Moscow, Faizov, was temporarily unemployed and registered in that city.


GFATF LLL Moscow Crocus City Hall terrorists


Muhammadsobir Faizov, a suspect in the Crocus City Hall shooting on Friday sits in a glass cage in the Basmanny District Court in Moscow, Russia, March 24, 2024.




Shamsidin Fariduni, a suspect in the Crocus City Hall shooting on Friday, sits in a glass cage in the Basmanny District Court in Moscow, Russia, March 24, 2024.




Dalerdzhon Mirzoyev, a suspect in the Crocus City Hall shooting on Friday, sits in a glass cage in the Basmanny District Court in Moscow, Russia, March 24, 2024.




Saidakrami Rachabalizoda, a suspect in the Crocus City Hall shooting on Friday, sits in a glass cage in the Basmanny District Court in Moscow, Russia, March 24, 2024.


This slideshow requires JavaScript.


They are all said to have a very limited command of Russian (or feign to have one), and one individual communicates in Tajik with the help of an interpreter.

The terrorist attack was purportedly motivated by financial gain.

A contact referred to as “an assistant to the preacher” via Telegram did not specify the exact sum but initially mentioned a promise of half a million rubles, later suggesting it could be around a million.

The identity of the “preacher” remains undisclosed, but one of the terrorists acknowledged listening to his “lessons and sermons.”

Additionally, it is noted that one of the terrorists returned from Turkey two and a half weeks ago.

However, it’s unclear whether he met with the “preacher” or his associates during his time there.

The “assistant preacher” also disclosed the coordinates for the location of the terrorist attack, while the organizers supplied them with Kalashnikov assault rifles.

The terrorists resided together in a hostel in the north of Moscow, with little familiarity among them: at least two of the four individuals had only met “10-12 days ago.”

The car they used to travel to Crocus City Hall and later attempted to escape in was purchased through a familial connection, with intentions of using it for taxi services.

Weapons were discarded during their escape towards the border.


Terrorist Attack

Crocus City Hall was built in 2009 as a concert venue with a capacity of 6200 people, and is one of the largest concert venues in the area. It is part of a larger block of shopping centers, restaurants, and other attractions called Crocus City,which was built by Azerbaijani billionaire and property developer Aras Agalarov and was also the venue of the Miss Universe 2013 pageant and the Top Hit Music Awards in 2013 and 2019.

On 22 March 2024, the Russian band Picnic was scheduled to play a sold-out show at Crocus City Hall. At around 20:00 MSK (UTC+3), before the band began their performance, masked gunmen in combat fatigues opened fire on the crowd using AK-style assault rifles. An IS–KP report had also claimed that the assailants had pistols and knives. Because the show was about to begin, some believed the initial sound of gunshots was part of the act. At the time of the attack, children and teenagers were also in the building for a ballroom dancing competition. The venue’s security guards were unarmed, and it is believed that some of them were among those killed in the attack. A part-time checkroom assistant, 15-year-old Islam Khalilov, reportedly helped save more than a hundred concert-goers by showing them an exit through the venue’s office space. He was assisted by three of his co-workers, 14-year-old Artyom Donskov, Nikita Ivanov and another.

One witness described the attackers as bearded men. Amateur video footage verified by BBC Verify showed masked gunmen shooting indiscriminately in the entrance hall and auditorium. Other footage posted to Telegram showed men in military fatigues and baseball caps firing into crowds of screaming people. On 23 March, IS–KP released a video through Amaq News Agency, showing the shooting and throat-slitting of victims in the attack. In the video, the assailants appear to shoot patrons outside the entrance of the auditorium. The assailants, in Arabic subtitles, were heard shouting; “come, come quickly,” “bring the assault rifle, bring the assault rifle,” and “kill them and have no mercy.” After shooting the victims, an assailant slits the throat of a still-alive wounded victim, who was shot off-camera prior to the recording. After the killings, in Arabic subtitles, one of the assailants is reported to state: “The infidels are defeated by the grace of Allah. Allah is great.. The infidels are defeated. We went out for the sake of Allah and are supporting his religion.”

The assailants were also reported to have used incendiary devices, with an eyewitness claiming the assailants used petrol bombs to start a fire in the auditorium. Amateur video footage posted to social media sites showed huge fires and plumes of smoke coming from the building from the fires set by the assailants, including by an emergency stairwell, forcing people towards the attackers’ positions in the middle of the lobby. The fire in the complex was estimated to have covered an area of 12,900 square metres (139,000 square feet). Hours later, a large sound was reported, followed by a partial roof collapse. Moscow Oblast governor Andrey Vorobyov said the roof over the hall had collapsed.

Specialized police units from the Special Rapid Response Unit (SOBR) and Special Purposes Mobile Unit (OMON) were sent to the scene, arriving over one hour after the shootings started, according to Nexta. Vorobyov went to the scene to set up a task force to handle the situation. Other officials also arrived, including Interior Minister Vladimir Kolokoltsev. The National Guard of Russia was also dispatched to search for the assailants, with a picture posted of the suspected assailants fleeing in a white Renault Symbol 2007 car with Russian license plates T668UM 69 (Tver Oblast), which they had purchased on 4 January 2024.

Survivors were evacuated via medical helicopters, with 70 ambulance crews reportedly being dispatched. An unknown number of people fled to the parking area from the stage, while others fled to the roof. Authorities evacuated approximately 100 people hiding in the basement. A survivor said that escapees were hampered by locked doors, forcing some of them to break a door open to escape. Firefighters prevented the fire from spreading, while three helicopters were deployed to dump water on the burning rooftop.

By 07:00 on 23 March, Vorobyov reported the fire had been contained and mostly extinguished. He released a video showing extensive damage to the building with the roof and upper rows of the concert hall completely collapsed. By 11:30 that same day, the fire had been extinguished.

Casualties

The attack left at least 137 dead and 182 more injured, some critically. Aside from gunshot wounds, some of the deaths were caused by smoke inhalation. According to the Russian Minister of Health, Mikhail Murashko, five children were injured in the attack. At least three children were killed, while the oldest fatality was a woman in her 70’s. Most of the victims were from northwestern edge of Moscow, including Krasnogorsk and Khimki. An Armenian woman and her Azerbaijani husband were among those killed. The search for victims ended on 23 March. As of that day, at least 29 fatalities have been identified so far. The health department of Moscow said it expected to finish identification of bodies in two weeks.

The members of Picnic posted on Instagram that they and their management were “alive and safe,” with TASS later reporting that they had been evacuated; however, the band later said on VK that one of the band’s staff members was missing. It was later revealed on the band’s Instagram that the band’s assistant director was among the casualties. She was located behind the band’s merchandise table when the shooting began.

Investigation

As of 23 March, eleven people have been detained, including the four suspected assailants in the white car, who were captured on the 376th kilometer of the M3 highway, near the village of Khatsun’, 140 kilometers (85 miles) from the Ukrainian border in Bryansk Oblast, and about 340 kilometers (210 miles) southwest of Moscow, on the evening of 22 March. Russia coordinated with Belarusian security forces to prevent the suspects from crossing the Belarus–Russia border. The Investigative Committee of Russia launched a criminal terrorist probe into the attack. Officials later said that the attackers were not Russian citizens.

State Duma deputy Alexander Khinshtein said that Tajik passports were discovered in the vehicle of the individuals in custody, and the Russian Telegram channel Baza identified the four attackers as citizens of Tajikistan. The Ministry of Internal Affairs of Tajikistan denied the involvement of three of its citizens, stating that the individuals named in the discovered passports had returned to Tajikistan months earlier and were working there. In a phone call with Putin, Tajikistani President Emomali Rahmon said that “Terrorists have no nationality, no homeland and no religion.”

A short video on Telegram allegedly showed Saidakrami Murodali Rachabalizoda, reported to be a 30-year-old man, being tortured by FSB agents, who cut off his ear and forced him to eat it. In another interrogation video released by Russian state media, Shamsidin Faridun, a 25-year-old suspect, said that he participated in the attack in exchange for 1 million rubles ($10,800), half of which he claimed to have already received by card transfer from individuals who contacted him on Telegram and whose identities he did not know.

On 24 March, four suspects, Dalerdzhon Mirzoyev, 32; Saidakrami Rachabalizoda, 30; Shamsidin Fariduni, 25; and Mukhammadsobir Faizov, 19, appeared at Basmanny District Court in Moscow and were charged with terrorism. Mirzoyev, Rachabalizoda, and Fariduni pled guilty during the hearing. All four suspects appeared with facial injuries and bruises, Rachabalizoda appeared with a bandage covering his missing right ear. Faizov was brought into court in a wheelchair wearing a hospital gown, and appeared to have an eye missing. They were ordered to remain in pre-trial custody until at least 22 May. If convicted, the four could receive a sentence of life imprisonment.

The four suspects were officially identified as citizens of Tajikistan.

Of the suspects, one is a 32-year old from Tajikistan with an expired permit to be in Novosibirsk, who was presented as the ringleader of the attacks. Another posted a drawing of an IS flag on his VKontakte page in 2016, when he was twelve.

Responsibility for the attack

IS–KP claimed responsibility for the attack shortly after in a statement released by Amaq News Agency via Telegram, stating that the attackers “retreated to their bases safely.” The group is a regional branch of the Islamic State, an international terrorist group active in South-Central Asia, primarily Afghanistan. US officials said they had intelligence indicating that IS–KP had been planning an attack on the city.

On 23 March, IS–KP released photos of the attackers and a full report on the attack. Later on the same day, Amaq News Agency released a one and a half minute-long video of the attack, filmed by one of the attackers. It showed a second attacker using an assault rifle to shoot at victims, a third attacker using a knife to slit a victim’s throat, and a fourth attacker with a backpack; the filming attacker praises Allah and declares that infidels will be defeated.

American officials said that their intelligence revealed IS–KP had acted alone in the attack.

AftermathDespite a police cordon, passersby laid tributes outside Crocus City Hall following the attack, while advertising billboards in Moscow displayed memorial posters showing a candle and the message Skorbim (“We mourn”). Heavy equipment began clearing debris and structures at the scene on 24 March.

In an address to the nation on 23 March, President Putin announced that 24 March would be a day of national mourning for the victims of the attack and vowed to punish those responsible. Putin also said that all the attackers, whom he compared to the Nazis, had been apprehended, and claimed without evidence that the attackers were trying to enter the Ukrainian border, where a “window” was prepared on the Ukrainian side.

Latvia-based Russian news outlet Meduza reported that pro-government and state-funded media in Russia were instructed by the Russian government to highlight possible “traces” of Ukrainian involvement. Shortly after the attack, the pro-Kremlin Russian television station NTV broadcast an edited video using audio deepfaking that suggested Ukrainian involvement in the terrorist attack.

Moscow Mayor Sergey Sobyanin cancelled all weekend events in the city, and security was tightened across airports and train stations serving the city, as well as in the Moscow Metro. The Russian Ministry of Culture later cancelled events nationwide. In Saint Petersburg, shopping centers were closed, and Leningrad Oblast was put on high alert. At least 5,000 people donated blood for the victims at the Gavrilov Blood Center in Moscow, the country’s largest blood transfusion facility, and other medical facilities. Sberbank, Sovcombank, and Home Bank pledged to settle loans and relieve the debts of the families of clients who were killed or injured in the attack.

A friendly football match between Russia and Paraguay scheduled on 25 March at the VTB Arena in Moscow was postponed indefinitely due to the attack. For his efforts in saving hundreds of concert-goers, Islam Khalilov was awarded the Medal of Russian Muslims “For Merit” by the Russian Council of Muftis. His family were Muslim immigrants from Kyrgyzstan.

Responses

Putin wished those injured in the attack a speedy recovery and praised the doctors involved in treating the victims. A spokesperson for Patriarch Kirill of the Russian Orthodox Church said that he was “praying for peace for the souls of the dead.”

Ministry of Foreign Affairs spokesperson Maria Zakharova called for the international community to condemn the attack, which she called “a monstrous crime.”

Chechen leader Ramzan Kadyrov released a statement condemning the attack, as did Yulia Navalnaya, the widow of opposition figure Alexei Navalny, who died five weeks before the attack. Navalny associate Ivan Zhdanov criticised Russian security services for their “catastrophic incompetence” and the FSB for being “busy with everything except its direct responsibilities – killing their political opponents, spying on citizens and prosecuting people who are against the war.” Another associate, Leonid Volkov, said that the FSB “can’t do the only job it really should be doing: preventing a real, nightmarish terrorist attack.” Exiled oligarch and Putin critic Mikhail Khodorkovsky said the attack showed the “impotence” of the Kremlin’s security apparatus.

Senior members of United Russia called for the return of the death penalty in Russia.