The 22 March 2024 attack on Crocus City Hall near Moscow, perpetrated by four militants armed with automatic rifles, resulted in the tragic deaths of over 144 individuals, with an additional 551 wounded. Soon after, the Islamic State (IS) terrorist network’s central faction in Syria and Iraq claimed responsibility for this heinous act, which has become Russia’s deadliest terrorist attack since the Beslan school massacre in 2004. In its online propaganda message, IS cited the motive as retaliation against “countries fighting Islam”. Although the IS central faction did not specify a branch, subsequent investigations revealed regular virtual communication between the attack cell and Tajik-speaking IS members, suggesting possible involvement of Islamic State-Khorasan (IS-K), the terror group’s faction in Afghanistan, in the attack.
As investigations progress, crucial details concerning the perpetrators’ path to radicalisation and militancy, as well as identities and whereabouts of their handlers remain elusive and contentious. Nevertheless, amid these uncertainties, available reports unveil several discernible challenges. Firstly, instances of political mistrust and conflicts among nations significantly impede capabilities to effectively counter transnational challenges deriving from radicalisation and terrorism. Secondly, IS networks continue to adeptly exploit encrypted messaging platforms, such as Telegram, as a secure virtual bastion to radicalise and recruit vulnerable immigrants, raise funds, form sleeper cells, and plan and organise attacks. Thirdly, the presence and accessibility of illegal arms for terrorists facilitate mass casualty attacks. Lastly, crowded spaces require enhanced security and emergency planning to minimise casualty rates in case of attacks. This analysis will discuss all these challenges in detail.
Interstate Conflicts and Mistrust Hinder Responses against IS Threat
Following the attack, Russian authorities detained at least fifteen suspects in raids across Bryansk, Ekaterinburg, Moscow, Omsk, and Tver. Four of the detainees, Shamsuddin Fariduni, Muhammadsobir Fayzov, Dalerdzhon Mirzoyev, and Saidakrami Rachabalizoda, all of whom are Tajik nationals residing in Russia as immigrant workers, are suspected attackers. Although the quartet initially managed to evade immediate arrest by blending into the crowd fleeing the scene, they were later captured in the Bryansk region near the Ukraine border.[1] The detained accomplices comprised one Kyrgyz citizen, with others being predominantly either Tajik citizens or Russian citizens of Tajik origin residing in Russia.
During interrogations, the suspects admitted being guided by a Telegram user named “Sayfullo,” who apparently planned the entire attack, including designating the concert hall as the target and promising safe passage into Ukraine. With such testimonies, Russia accused Ukraine and some Western countries, including the United States and the United Kingdom, of employing radical Islamists as proxies and facilitating the attack. Ukraine denied any involvement, accusing Russian authorities of neglect, despite prior the U.S. sharing intelligence on the potential terror threat. Russian officials argued the warning was “too general” to be useful, while U.S. officials insisted it was “highly specific” that “indicated the correct location but imprecise timing”.
Amid their ongoing war, both Russia and Ukraine are engaged in active propaganda campaigns, complicating the verification of their accusations without definitive evidence. Nonetheless, official accounts and investigations from Russia confirm that the attackers were “radical Islamists” recruited through Telegram by “IS emissaries”. Thorough analysis of observable and unequivocal aspects of the attack is essential to avoid overlooking valuable insights into the current nature and scale of challenges posed by IS and other transnational terror networks. Effective responses start with a comprehensive understanding of the issue.
According to media interviews with witnesses, Shamsuddin Fariduni, the suspected ringleader of the attack cell, visited the concert hall a few times in early March. Explaining Shamsuddin’s apparent reconnaissance visits to the venue, some Russian independent blogs suggested that the terror cell might have initially planned to target Shaman’s concert that took place at Crocus on 9 March 2024. However, the increased vigilance at the venue following the U.S. public warning on 7 March 2024 likely disrupted their plans.
Staff at the Crocus concert hall mentioned receiving additional security and emergency instructions after the U.S. warnings. On 7 March 2024, Russian security authorities announced they thwarted an ISK cell’s attempt to attack a Moscow synagogue involving two citizens of Kazakhstan. While U.S. media reports attribute the success to American intelligence sharing, Russia has not officially confirmed receiving an alert regarding the synagogue attack. These developments indicate that despite publicly dismissing the U.S. warning as “blackmail,” the Kremlin seemingly took precautionary measures. However, the subsequent violent incident at Crocus suggested the heightened alertness was prematurely relaxed.
The Attack Cell’s Connections in Turkey and Tajikistan
In many ways, the Crocus City Hall attack bears similarities to an IS terror plot to target U.S. and NATO military bases in Germany, which was thwarted by German police in April 2020. Like in Germany, the attackers in Moscow were predominantly radicalised Tajik immigrants who were indoctrinated and directed by Tajik-speaking IS militants via Telegram. In both instances, the cells had external connections and acquired firearms from the black market.
The Moscow attack cell allegedly had some connections in Turkey and Tajikistan. Investigations revealed that two cell members, Shamsuddin and Saidakrami, had traveled to Turkey for a brief period before returning to Russia on 2 March 2024. They claimed their trip was for Russian visa renewal, a process requiring them to physically exit and re-enter the country upon visa expiration. During their stay in Turkey, both suspects lodged in hotels within Istanbul’s historic Fatih neighborhood.
While Turkish officials asserted that radicalisation did not occur during the suspects’ short stay, Russian and Turkish authorities are probing the possibility of the duo’s connections to clandestine IS cells in Turkey. In pursuit of this inquiry, Turkish authorities have been investigating 211 alleged IS-linked individuals after arresting them in raids conducted across several cities. A report from the SCO’s Regional Anti-Terrorist Structure (RATS) on 23 February 2024 detailed Turkey’s growing status as a sanctuary for alarmingly large number of ISK members, particularly Tajiks. ISK networks allegedly exploit Turkey as a hub for recruitment, shelter, fighter transit, and arms acquisition, with even previously planning to establish a training venue. These findings prompted allegations in Russia that Shamsuddin and Saidakrami might have met some IS handlers during their visit to Turkey, potentially receiving instructions and even firearms training.
On 29 March 2024, security authorities in Tajikistan detained nine residents of Vakhdat city suspected of having ties to the perpetrators of the attack in Moscow. This detention, along with the involvement of a Tajik national in the August 2023 Shiraz attack in Iran, underscores ISK’s ability to spread its extremist influence among segments of Tajikistan’s local population. However, it is important to note that ISK and other regional terrorist groups do not currently have a visible operational foothold in Tajikistan. Operational challenges from ISK to the country have so far been limited to a couple of small-scale, low-casualty attacks or failed attempts by radicalised local supporters.
IS Continues Exploiting Telegram as a Virtual Terrorist Fortress
As of November 2023, approximately 1.2 million Tajik nationals were residing in Russia as immigrants, primarily employed as construction workers and taxi drivers, and to a lesser extent, as students. The arrests of Tajik immigrants and Russian citizens of Tajik origin across various Russian regions for their alleged roles in the attack demonstrate IS’ ability to establish a web of clandestine cells by recruiting from susceptible segments of Tajik immigrants and other minority Muslim communities in Russia.
In an interrogation video, Shamsuddin admitted to following “lessons by a preacher” on Telegram. Around a month before the attack, he was contacted by an anonymous individual claiming to be an “assistant” of that preacher, offering one million roubles (approximately USD 11,000) in exchange for killing “anyone” in the location the “assistant” would assign. According to Shamsuddin, he had received half of the promised payment transferred to his card before the attack, with the remainder “promised” upon their successful “arrival in Kiev” after the attack. Shamsuddin, who is 25 years old and has a wife with a new-born baby, came to Russia from Tajikistan about six months ago and was working at a parquet factory in Podolsk.
Shamsuddin’s testimony indicates that he and possibly other members of the cell were radicalised online by a Tajik-speaking radical preacher, whose identity remains undisclosed. Further investigation unveiled that the cell was recruited through a Telegram channel named “Voice of Khorasan,” which was linked to ISK. Subsequently, the cell members confirmed being in contact with and guided by a militant, only known by the alias “Sayfullo.” With the launch of its multilingual propaganda arm, “al-Azaim,” in 2022, ISK has significantly intensified its propaganda aimed at Central Asia’s local population and its immigrant communities abroad. Ever since, Al-Azaim has notably increased the production of extremist content in Tajik and other languages and widely disseminated across various online platforms, particularly Telegram.
It was also discovered by Russian investigators that the administrator of the “Voice of Khorasan” Telegram channel, identified only by the alias “Mavlavi_56,” collected approximately USD2,525 worth of cryptocurrencies via the Tronscan blockchain system from 13 to 20 March 2024. “Mavlavi_56” initiated this crowdfunding campaign on his channel, intending to allocate the funds to the perpetrators of the Crocus attack. In the past, Tajik militants often used Bitcoin, Lightcoin, and Tether for cryptocurrency collections. The recent use of Tronscan in the Crocus case may indicate attempts to diversify fundraising methods.
Limited information is available about the other members of the cell. Saidakrami has been residing in Russia for several years, during which he was fined for an immigration violation in 2018. Muhammadsobir, aged 19, is the youngest of the detainees. He worked as a barber in a town northeast of Moscow before quitting in January 2024. Dalerdzhon, who has a wife and four children in his home country, had periodically come to Russia between 2011 and 2021 and worked as a taxi driver, returning again in November 2023. At the time of the attack, he was staying in Russia illegally as his temporary three-month registration had expired. Like in the case of other attackers, Dalerdzhon’s family members noted that Mirzoyev was religiously not fully practicing and previously did not exhibit any extremist tendencies.
An intriguing aspect of Dalerdzhon’s case involves his brother, Ravshanjon Mirzoev, who was found fighting alongside IS in Syria in 2016. Ravshanjon moved to Syria from Russia after becoming radicalised allegedly in Moscow while working as a labour migrant. Dalerdzhon’s father insists that Ravshanjon, who presumably died four years after relocating to Syria, ceased communication with their family in Tajikistan and did not maintain contact with Dalerdzhon during his time in Syria. The family, considered vulnerable, has been closely monitored and supported by Tajik authorities.
Black Market Arsenal Facilitates Mass-Casualty Attacks
On 31 March 2024, security services in Russia’s Dagestan Republic apprehended three Tajik immigrants and one individual, possibly a local citizen, suspected of funding and supplying weapons to the Crocus attackers. One confessed to transporting the weapons from Makhachkala and storing them in a cache in Mytishchi, about 30 km from the attack site. The assailants retrieved the weapons from this cache before the attack. The Dagestan cell was also planning an attack in the city of Kaspiysk.
While the exact origin of these weapons used in the attack has yet to be established, they were allegedly acquired from existing black market across Russia. Russian security authorities revealed the arrest of 134 illegal gun dealers and disruption of 28 clandestine weapons manufacturing facilities across 48 regions in the country since the start of 2024, leading to the confiscation of over 550 firearms.
In 2021, reports indicated that between 5 to 20 million weapons circulated in Russia’s black market. With the onset of the war in Ukraine, this number is believed to have surged significantly as arms began to flow into the country from the frontlines. Additionally, various volunteer entities and private military companies (PMCs) obtain weapons from Ministry of Defence warehouses for training before their mobilisation to war, but some of these firearms allegedly end up in the criminal market. Illegal arms trade often occurs through intermediaries or on the darknet, with customers usually paying in bitcoins. AK rifles, for instance, can be purchased for USD100 to 450.
Crowded Spaces Need Better Security and Emergency Planning
Potential assailants often conduct multiple visits to their intended target for surveillance purposes. In early March, as part of his purported surveillance of the concert hall, Shamsuddin made a few visits to the Crocus shopping mall. On one occasion, he purchased a ticket but left the concert performance without attending. Instead, he roamed the premises and frequently approached a teenage administrative staff member to inquire about the building’s layout. Despite somewhat unusual nature of Shamsuddin’s questions, the staff did not notice any specific suspicious behaviour in the attacker at that time.
Some survivors of the attack reported that during the assault, the concert hall’s automated fire extinguishing, smoke control systems, and emergency lighting failed to function. Additionally, malfunctioning emergency exit doors and blocked staircases might have led several victims to seek refuge in restrooms, where they tragically succumbed to smoke inhalation. The possibility of interior walls adorned with combustible materials is also being investigated. Shockingly, at least 45 fatalities were attributed to the fire smoke rather than the gunfire. Authorities are probing the management for potential criminal negligence regarding fire safety measures.
Similarly, malfunctional emergency exit door in the main prayer hall at the Christchurch mosques in New Zealand contributed high number of casualties when Australian lone-actor terrorist, Brenton Harrison, stormed into the mosque during Friday prayers and began shooting indiscriminately with high-powered firearms on 15 March 2019. The attack killed 51 worshippers.
Conclusion
The attack in Moscow serves as a loud wake-up call for countries to set aside political differences when it comes to fighting against transnational terrorism that knows no borders. Only sustained cooperation and solidarity can help to effectively address this complex and evolving threat.
Post-attack, there has been a surge in xenophobia and stereotypes against Tajiks in Russia, even leading to refusal of cab rides based on ethnicity. To tackle these challenges, authorities will need to thoroughly explore radicalisation factors and implement measures to mitigate them. Engaging Tajik immigrant community to dispel their sense of collective guilt and educating host society that terrorism has no religion and nationality is crucial. Failure may risk a vicious cycle of hate and aggression from both sides.
As terrorists continue to exploit encrypted messaging platforms, particularly Telegram, governments can initiate discussions with these platforms to explore the feasibility of implementing more stringent content moderation policies and removing extremist content, even within private channels, while ensuring privacy rights and free speech. Presently, Telegram’s policy prohibits the promotion and support of violence exclusively in public channels, groups, and chats.
Disrupting the black market of weapons is a critical component in the fight against terrorism as it significantly hampers terrorists’ access to means to carry out high-impact attacks. In countries where firearm acquisition is legal, rigorous licensing and management systems is crucial. It may also be prudent to consider halting licensing of automatic and semi-automatic firearms altogether. The faulty issuance of these weapons to unqualified individuals will exacerbate casualty rates, as exemplified by the incident in Christchurch.
The Crocus City Hall attack and recent IS propaganda threats against upcoming rounds of the 2024 UEFA Champions League emphasise the need for heightened security in crowded areas. With upcoming mass sporting events like the Euro 2024 football championship in Germany and the Summer Olympic Games in France, governments need to devise refined security strategies that balance effective protection, logistical hurdles, and public convenience.
Source: Modern Diplomacy
