Crocus City Hall attack

• 1. Introduction

  ›

  The Crocus City Hall attack began at around 20:00 Moscow time on the 22nd of March 2024, at a music venue in Krasnogorsk, in Moscow Oblast, Russia. The Russian band Picnic was due on stage for a sold-out show. Because the performance was about to start, some people in the crowd first took the sound of gunfire for part of the act.

  Four men linked to Islamic State, through its branch known as IS-KP or ISIS-K, carried out the assault. By the end of the night the building was burning. It became the deadliest terrorist attack on Russian soil since the Beslan school siege in 2004.

  This documentary follows the questions the night left behind. Who were the four men, and what path brought them to a Moscow concert hall? Foreign governments had spoken of danger in the weeks before, so what did Moscow know? And when Russian leaders pointed toward Ukraine, what did the evidence actually show?

  476522939

• 2. A Night of Fire

  ›

  Crocus City Hall opened in 2009 with room for 6,200 people, which made it one of the largest concert venues in the Moscow area. The seven-story building covers about 38,000 square metres. It stands inside Crocus City, a complex of shopping centers and restaurants built by the Azerbaijani billionaire Aras Agalarov. The complex had earlier hosted the Miss Universe pageant in 2013.

  On the evening of the 22nd of March, masked gunmen in combat fatigues fired into the crowd with AK-style assault rifles. A later IS-KP report claimed the attackers also carried pistols and knives. Children and teenagers were in the building that night for a ballroom dancing competition. The venue's security guards were unarmed, and some of them are believed to have died in the attack.

  A 15-year-old part-time cloakroom assistant named Islam Khalilov reportedly led more than a hundred concertgoers to safety through the venue's office space. Three co-workers helped him, including 14-year-old Artyom Donskov and a colleague named Nikita Ivanov. The fourth helper is not named in the record.

  The attackers also set the building alight. An eyewitness said they used petrol bombs in the auditorium. Video posted online showed huge flames and smoke near an emergency stairwell, and the fire pushed people toward the gunmen waiting in the middle of the lobby. The blaze was later estimated to cover 12,900 square metres. At around 22:14 a loud sound rang out and part of the roof fell in, according to Moscow Oblast governor Andrey Vorobyov.

  Special police units called SOBR and OMON reached the scene more than an hour after the shooting began, according to the outlet Nexta. Rush-hour traffic on the Moscow Ring Road, where the venue stands, had held them up. Vorobyov came to the scene to set up a task force, and Interior Minister Vladimir Kolokoltsev arrived too. The National Guard was sent to find the attackers. A photograph circulated of a white 2007 Renault Symbol, plate T668UM 69, registered in Tver Oblast, which the gunmen had bought on the 4th of January 2024.

  Rescue work ran through the night. Seventy ambulance crews were reportedly sent, and medical helicopters carried survivors out. Some people fled to the parking area or up to the roof. Authorities brought out about 100 people sheltering in the basement. One survivor said locked doors slowed the escape until some people broke one open. Firefighters stopped the flames from spreading, and three helicopters dropped water on the burning roof.

  By 07:00 on the 23rd of March, Vorobyov said the fire was contained and mostly out. His video showed the roof and the upper rows of the concert hall collapsed. By 11:30 the last flames were gone. The Renault from the photograph would soon lead investigators to its previous owner.

  4142576950

• 3. Warnings and History

  ›

  Moscow's apartment-block explosions of 1999 opened a long run of major terrorist attacks in Russia. The Moscow theater hostage crisis came in 2002, and the Domodedovo International Airport bombing followed in 2011. Over roughly 25 years there had been at least half a dozen attacks in or near Moscow by Muslim terrorists, most of them Chechen militants.

  Islamic State had its own record against music venues and Russian targets. It attacked the Bataclan theater in Paris during a rock concert in November 2015, and it claimed the 2017 bombing at Manchester Arena in the United Kingdom. In October 2015 its militants downed a Russian passenger jet over Egypt's Sinai Peninsula, killing all 224 people aboard. In September 2022 it bombed the Russian embassy in Kabul. Russia had also fought the group during its intervention in the Syrian Civil War on behalf of President Bashar al-Assad.

  On the 3rd of January 2024, IS-KP bombings in Kerman, Iran, killed at least 103 people. Colin Clarke of the independent Soufan Center said the group "has been fixated on Russia for the past two years, frequently criticizing Putin in its propaganda."

  The weeks before the concert brought sharper signs. On the 2nd of March, six alleged Islamic State militants died in a shootout with Russian security forces in Ingushetia. On the 7th of March, the Federal Security Service, or FSB, announced it had neutralized an Islamic State cell in Moscow that planned to attack a synagogue.

  That same the 7th of March, the United States Embassy in Moscow warned that "extremists have imminent plans to target large gatherings in Moscow, to include concerts." Canada and the United Kingdom issued similar warnings. Washington also passed a private warning to Russian officials under its intelligence community's "duty to warn" requirement, and it named Crocus City Hall. US officials later told The New York Times that the underlying intelligence had been shared before the attack.

  Russian officials gave a different account. Ambassador Anatoly Antonov said "no concrete information, nothing was passed to us." FSB head Alexander Bortnikov called the American warning "of a general nature," and foreign intelligence chief Sergey Naryshkin later made the same point about its detail. Three days before the attack, Vladimir Putin told the FSB board that Western warnings were "provocative" and "resemble outright blackmail and the intention to intimidate and destabilise our society."

  Ten days after the attack came a further report. Iran had reportedly warned Russia that a major "terrorist operation" was planned, drawing on information from IS militants arrested after the Kerman bombings. Reuters described Iran as a "diplomatic ally" of Putin's government, yet the message was allegedly dismissed. Iran's communications reportedly did not name a specific target on Russian soil.

  2830353736

• 4. The Toll

  ›

  Investigators counted 151 people killed, including those who died later in hospital, and 609 injured by gunfire or burns. Some of the dead were killed by smoke inhalation rather than bullets. Many of the injured were in critical condition.

  According to the Russian Children's Rights Commissioner, Maria Lvova-Belova, six children died and seven more were injured. Eight children lost their parents. The oldest person killed was a woman in her 70s. Most victims lived on the northwestern edge of Moscow, in places such as Krasnogorsk and Khimki. Three of the dead were citizens of Belarus and two were from Kyrgyzstan. One each came from Moldova, Armenia and Azerbaijan.

  The search for victims ended on the 23rd of March. Moscow's health department expected to finish identifying bodies within two weeks. By the 30th of March, 134 of the dead had been identified.

  The members of Picnic posted on Instagram that they and their management were "alive and safe," and the news agency TASS reported they had been evacuated. Later, the band wrote on VK that a staff member was missing. The band's assistant director had been working at the merchandise stall, and he died in the attack.

  Anti-terrorist expert Alexei Filatov blamed the large number of casualties on the fire brigade being held up by traffic congestion. Two more victims died of their injuries long afterward, one on the 27th of September 2025 and another on the 14th of March 2026.

  On the 7th of April, the Investigative Committee of Russia announced that Crocus fire safety officials and the head of the Crocus fire brigade were under investigation for fire code violations. They were placed under house arrest on a criminal charge of negligence, and neither was named at the time.

  790898075

• 5. Capture and Court

  ›

  By the evening of the 22nd of March, the four suspected gunmen were in custody. They were caught on the M3 highway toward the Ukrainian border, near a village in Bryansk Oblast, about 340 km southwest of Moscow and 140 km from the frontier. Russia worked with Belarusian security forces to keep them from crossing the Belarus-Russia border. Officials later said the men were not Russian citizens.

  The Russian Telegram channel Baza identified the four as citizens of Tajikistan, and State Duma deputy Alexander Khinshtein said Tajik passports were found in their vehicle. Tajikistan's interior ministry said three of the named men had returned home months earlier and were working there. President Emomali Rahmon told Putin that "terrorists have no nationality, no homeland and no religion."

  On the 24th of March, four suspects appeared at Basmanny District Court in Moscow: Dalerjon Mirzoyev, 32; Saidakrami Rachabalizoda, 30; Shamsidin Fariduni, 25; and Muhammadsobir Faizov, 19. They were charged with terrorism and held in pre-trial detention until at least the 22nd of May. Mirzoyev, Rachabalizoda and Fariduni pleaded guilty at the hearing.

  All four showed signs of having been tortured. They had facial injuries and bruises. Rachabalizoda wore a bandage where his right ear should have been, and Faizov arrived in a wheelchair and hospital gown, apparently missing an eye. A video on Telegram allegedly showed FSB agents torturing Rachabalizoda. Tajikistan's foreign minister, Sirojiddin Muhriddin, called the alleged torture "unacceptable" on the 12th of April. Russia's human rights commissioner, Tatyana Moskalkova, said it was "absolutely inadmissible to use torture against detainees and accused persons." Sergei Davidis of Memorial said the security services had "decided that this time there are no reasons to conceal their methods," which he called a "bad sign."

  The four men's backgrounds were modest. Mirzoyev, born in 1991, held a temporary registration in Novosibirsk that had expired. His brother Ravshanjon had joined the central branch of IS in 2016 and was presumed killed in Syria in 2020. Rachabalizoda, born in 1994, grew up in Vahdat, left school in ninth grade and worked at a furniture factory. Fariduni, born in 1998, had worked in a bakery in Hisar before taking a factory job in Podolsk. He married in 2022 and left behind a son who was eight months old. Faizov, born in 2004, had worked in a barber shop in Ivanovo. His mother said he had no religious education and had planned to study in China.

  In an interrogation video released by Russian state media, Fariduni said he joined the attack for 1 million rubles, about $11,005. He said half had already reached him by card transfer from people on Telegram whose identities he did not know. He also said a cleric's assistant had contacted him about a month earlier. He then spent a few days in Turkey, and returned to Russia with Rachabalizoda.

  A wider circle of suspects soon followed. A father, Isroil Islomov, and his sons Aminchon and Dilovar were accused of aiding terrorism. Dilovar was the previous owner of the getaway car and said he had sold it a week before the attack. Alisher Kasimov admitted renting an apartment in Moscow Oblast to the four men through the Avito website. Nazrimad Lutfulloi, 23, was charged with helping to finance the attack. On the 31st of March, the FSB announced four arrests in Makhachkala and Kaspiysk in Dagestan over weapons and funds. Three more arrests in Moscow, Yekaterinburg and Omsk followed on the 4th of April. In Tajikistan, authorities arrested nine people from Vahdat District.

  Turkish media reported that the organization behind the plot was based in an illegal mosque or madrasa called Darul Vefa Ilim ve Amel Merkezi in the Basaksehir district of Istanbul. Izvestia alleged that two of the gunmen received instructions while traveling in Turkey. In December 2025 a court was told the attackers had trained in Turkey and Afghanistan.

  The trial of 19 defendants began on the 4th of August 2025 at the 2nd Western District Military Court in Moscow. On the 12th of March 2026, the court sentenced the four gunmen and 11 accomplices to life imprisonment. Four others received up to 22.5 years for helping the attackers rent a vehicle and an apartment. One convicted man, Yakubjoni Davlatkhon Yusufzoda, was later found dead at the Matrosskaya Tishina facility in Moscow while awaiting transfer to a maximum-security prison, and officials attributed his death to an apparent suicide.

  521922097

• 6. Claim and Counterclaim

  ›

  Shortly after the attack, Islamic State claimed responsibility through the Amaq News Agency on Telegram. The statement said the attackers "retreated to their bases safely." It did not name a branch, but every indication pointed to Islamic State - Khorasan Province, the regional branch active in South-Central Asia and mainly Afghanistan. Involvement from the group's Turkish branches, and possibly the Caucasus, seemed likely. US officials said they held intelligence that IS-KP had been planning an attack on Moscow.

  On the 23rd of March, IS published photos of the attackers and a full report. The same day Amaq released a video of one and a half minutes, filmed by one of the attackers. It showed an attacker shooting victims with an assault rifle and another killing a wounded victim with a knife. The filming attacker recited the takbir and declared that infidels would be defeated. Arabic subtitles rendered the attackers' shouts, including "kill them and have no mercy."

  American officials said their intelligence showed IS-KP had acted alone. French president Emmanuel Macron said French intelligence had concluded that "an Islamic State entity masterminded the attack and carried it out." He offered to help Russia investigate IS-KP.

  The Kremlin told a different story. In an address on the 23rd of March, Putin said all the attackers had been apprehended and claimed they were trying to enter Ukraine with help from unknown persons on the Ukrainian side. Two days later he acknowledged that "radical Islamists" carried out the attack but pointed again toward Ukraine. He said the Ukrainian side had "opened a window" for the men to cross the border. Security Council secretary Nikolay Patrushev blamed Ukraine outright. Maria Zakharova of the foreign ministry accused the United States of using Islamic State as a "bogeyman" to cover for Ukraine.

  The Investigative Committee later added to the case against Ukraine. On the 28th of March it said it had recovered data suggesting large sums of money and cryptocurrency had reached the attackers from Ukraine. On the 5th of April it announced images of Ukrainian flags and a Ukrainian postage stamp on a suspect's phone. The Latvia-based outlet Meduza reported that Russian state media were told to highlight possible "traces" of Ukrainian involvement. A day after the attack, the pro-Kremlin station NTV broadcast an audio deepfake that purported to confirm Ukrainian involvement. On the 23rd of May, FSB chief Bortnikov acknowledged ISIS-K's guilt but insisted Ukraine was involved.

  Belarusian president Alexander Lukashenko complicated the Kremlin's account on the 26th of March. He said the attackers had first tried to flee into Belarus and turned back because border security had been tightened. Ukraine rejected the accusations as "very doubtful and primitive" disinformation. It pointed out that its border was heavily militarized, mined in many places and often shelled. Ukraine's Foreign Ministry also implied the attack could have been a false flag by the Russian government. Volodymyr Zelenskyy called Putin's claims "sick and cynical." The United States saw no sign of Ukrainian involvement, and British Chancellor Jeremy Hunt called the allegations "a smokescreen of propaganda to defend an utterly evil invasion of Ukraine." In March 2025, a Russian Investigative Committee inquiry found no Ukrainian involvement, contradicting earlier public statements by Russian authorities.

  Public opinion followed the official line. In late March 2024, an OpenMinds survey found that more than 50% of Russians believed Ukraine was responsible, while 27% blamed Islamic State and 6% blamed the "collective West." Islamic State was named most often by people aged 18-30 who opposed the war. On the 3rd of April, Russia's Defense Ministry said around 16,000 citizens had signed military contracts in the previous 10 days, most saying they wanted to "avenge those killed" at Crocus City Hall.

  1799329

• 7. Backlash Against Migrants

  ›

  Millions of Central Asian workers, including many from Tajikistan, do menial and insecure jobs in Russia because wages there beat those at home. Since the invasion of Ukraine in 2022, raids on hostels, deportations of undocumented migrants and fears of conscription had already made their position precarious. After the attack, it grew worse. Kyrgyzstan warned its citizens against unnecessary travel to Russia.

  The NGO North Caspian Institute reported that the attack and its coverage by Russian media increased xenophobic and anti-immigrant attitudes. Tajik taxi drivers in major cities said passengers refused to ride with them. A Tajik barista in Moscow was verbally harassed twice. Police raided cheap hostels housing Central Asian labor migrants in Volgograd and several other cities. Moscow city employees advised immigrant street cleaners to stay indoors on the 24th of March because of "mass police raids against Tajiks and Uzbeks on the day of mourning." A newspaper stall run by Central Asian workers was attacked in Blagoveshchensk. Employees of the Ivanovo barbershop where Faizov once worked received death threats.

  A lawyer for migrants told Mediazona she had received 2,500 reports of "acts of aggression" in the two days after the attack. She also recorded 30 cases of torture following police raids on hostels and dormitories. On the 12th of April, Kyrgyzstan's foreign ministry protested after police checking a Moscow apartment on the 8th of April assaulted and harassed the family of one of its diplomats, despite diplomatic immunity.

  Some pro-government outlets, including Readovka, pushed the message that "not all Tajiks are terrorists." They said stirring up ethnic hatred served Russia's "real enemies, Ukraine and the West." Many Russian nationalists then accused Readovka of becoming a "Tajik media outlet."

  Politicians pushed the other way. On the 24th of March, Duma member Mikhail Sheremet called for a total ban on immigration until Russia's "special military operation" ended. Sergei Mironov of A Just Russia - For Truth proposed a visa regime. On the 26th of March, Novgorod Oblast banned migrants from working as taxi drivers or selling drinks and tobacco. Novosibirsk Oblast followed with its own ban on the 15th of April.

  242511615

• 8. Mourning and Memory

  ›

  On the 30th of March, diplomats from around 130 countries gathered to lay flowers at the site. They included ambassadors from the United States and European Union countries that Russia calls "unfriendly states." Condemnations had already come from United Nations Secretary-General Antonio Guterres, the European Union, NATO, the African Union Commission chairperson Moussa Faki and Pope Francis. Hezbollah and Hamas also condemned the attack. The Taliban government in Afghanistan, which IS-KP had attacked a day earlier, called it "a blatant violation of all human standards." People laid flowers outside Russian embassies in countries including Armenia, Azerbaijan and Kazakhstan.

  France raised its security alert to its highest level on the 24th of March, and Prime Minister Gabriel Attal cited the Moscow attack among his reasons. On the 3rd of April, Russian defence minister Sergei Shoigu told his French counterpart Sebastien Lecornu that France might have colluded with Ukraine. Macron dismissed the idea as "ridiculous" and "indeed baroque and threatening."

  Turkey widened its crackdown on Islamic State, detaining more than 180 suspects after the attack. A total of 147 of them were taken in raids across 30 provinces on the 26th of March. On the 8th of April, Turkey cancelled a 2018 visa-exemption agreement with Tajikistan, citing security concerns, and the rule took effect on the 20th of April. Tajikistan answered on the 16th of April with visa requirements for Turkish visitors, citing reciprocity.

  At home, passers-by left tributes outside Crocus City Hall despite the police cordon. Advertising billboards across Moscow showed a candle and the word Skorbim, which means "We mourn." Putin declared the 24th of March a national day of mourning, and heavy equipment began clearing debris that day. Moscow mayor Sergey Sobyanin cancelled weekend events, and the Ministry of Culture later cancelled events nationwide. A friendly football match between Russia and Paraguay, set for the 25th of March at the VTB Arena, was postponed indefinitely. Three shopping malls owned by Agalarov's Crocus International company closed indefinitely the same day.

  At least 5,000 people gave blood at Moscow's Gavrilov Blood Center and other medical facilities. Sberbank, Sovcombank and Home Bank pledged to settle the loans of clients who were killed or injured, and of their families. The Russian Council of Muftis awarded Islam Khalilov the Medal of Russian Muslims "For Merit," and the rapper Morgenshtern gave him 1 million rubles. Khalilov's family were Muslim immigrants from Kyrgyzstan.

  On the 29th of June, Andrey Vorobyov announced that Crocus City Hall would hold no more concerts once it was restored. A memorial designed by Araz Agalarov, owner of Crocus Group, was unveiled near the building on the 22nd of March 2025, the first anniversary of the attack.

  1583874486