The Crocus City Hall mass casualty attack: timeline and suspects

The timeline

The mass casualty attack in Crocus City Hall, a large concert venue outside Moscow, occurred on Friday, Mar. 22, before the concert of the band Piknik. Over 6,000 people may have been inside the building when the shooting began, as almost all of the tickets for the gig had been sold. The latest data suggests a death toll of 137 people, and almost 180 have been reported injured.

At 19:55, the attackers park their car at the pedestrian crossing leading to the entrance of the Crocus Expo exhibition center. Getting out of the vehicle, the terrorists open fire immediately. They cover a distance of approximately 300 meters without any resistance and soon reach the concert hall, where the first shots are registered at the western stairs. At 20:01, emergency services and the ambulance corps receive the first calls for help.

At 20:04, the first reports of a shooting at Crocus City Hall emerge on social media. While shooting at the audience, the terrorists spill the fuel they had brought in backpacks in several locations across the hall and set it on fire. The first videos are released featuring assault rifle bursts in the background and footage of the attackers shooting people at point-blank range.

According to eyewitnesses, the terrorists burst into the hall, and three of them began shooting at the crowd, while the fourth took to setting the venue on fire using incendiary bombs. As Mash reported, the attackers had containers with fuel in their backpacks.

The entire attack takes 18 minutes. At 20:13, the vehicle — with the four terrorists inside — leaves the parking area.

Some 20 minutes later, the fire had spread through a significant segment of the building, with flames and a black pillar of smoke visible from the street.

As The Insider learned, the firefighters first learned about smoke at Crocus City Hall from an eyewitness. There is no data about the automated fire alarm signal.

Within an hour of the start of the fire, the entire roof of Crocus and some of the upper floors are in flames. Dozens of firefighting brigades are working to put out the blaze, with assistance from helicopters deployed by Russia’s Ministry of Emergencies.

Within an hour of the start of the fire, the entire roof of Crocus and some of the upper floors are in flames. Dozens of firefighting brigades are working to put out the blaze, with assistance from helicopters deployed by Russia’s Ministry of Emergencies.

As TASS reports at 20:33, “Moscow-based Special Rapid Response Units (SOBR) and OMON crews have been alerted and are currently en route to the site.” Also according to TASS, as of 21:01 both SOBR and OMON forces are still yet to arrive — this an hour and a half after the terror attack had begun. At 22:00, journalists report that the attackers may have escaped.

Fifty ambulances have been dispatched towards the building, which is still on fire. Inside Crocus, the beams are starting to collapse. The emergency services cannot begin putting out the fire from helicopters because a rescue operation is underway on the roof.

According to a preliminary report by Baza, the bodies of 10 people are found in one of the bathrooms. They hid there from the terrorists and called 112 (the emergency number in Russia) begging for help, as smoke was already starting to seep inside, isolating them in the stalls.

During the evacuation and firefighting effort, the Russian National Guard searches the parking lots outside Crocus but does not detect any explosives or bombs.

A few hours later, the first reports emerge about the FSB’s special operation to apprehend the attackers in the vicinity of Khatsun, a village in the Bryansk Region.

The fire is not fully extinguished until Saturday afternoon, after it has burned an area of 13,000 square meters.

The suspects

The day after the mass casualty attack outside Moscow, Amaq, a media outlet with ties to ISIS, published bloodcurdling footage of the terrorists slaughtering visitors at Crocus City Hall. In the video, the attackers shoot at the crowd and shout slogans, including “Allahu Akbar!” One of the terrorists slashes the throat of a wounded man with a knife. The Insider is not embedding this video for ethical reasons, but it is available here (viewer discretion is advised). The clothes of the terrorist in the video match those of the individuals apprehended on suspicion of perpetrating the attack.

On Mar. 23, Alexander Bortnikov, the head of Russia’s Federal Security Service, reported the arrest of 11 individuals, including all four of the attackers seen killing people at Crocus City Hall. Bortnikov’s statement was preceded by a report from MP Alexander Khinshtein, who said that the Renault used by the suspects had been spotted that night in the vicinity of Khatsun, a village in the Karachev District of Russia’s Bryansk Region, which borders Ukraine. The vehicle did not stop when ordered to do so by traffic police and attempted to drive away.

The evening after the attack, the BBC’s Russian Service reported that “Two of the participants of the Crocus City Hall attack were killed” — one in the concert hall during the attack, and another in the Bryansk Region during the FSB operation to capture the suspects. According to BBC, which has an image of the passport of the subject killed in Bryansk, he was a 30-year-old national of Tajikistan.

In her Telegram channel, the head of Russia Today Margarita Simonyan published a video of a suspect’s interrogation. The man in the video says that he was promised a reward of 500,000 rubles ($5,400) for the attack. According to the suspect, approximately one month before the attack, the assistant to a “preacher” reached out to him on Telegram. After a long back-and-forth, the unseen counterpart proposed that he carry out an attack and provided a detailed plan for doing so.

The man in the video is lying on the ground face down when he says his name: presumably Shamsidin Fariduni. He says he flew to Russia on Mar. 4 from Turkey, where he was “sorting out papers.”

The VChK-OGPU Telegram channel released another fragment of Fariduni Shamsiddin’s informal interrogation. He says that “he’s been on the inside and knows everything.” He also admits having bought the vehicle used by the attackers.

According to the Telegram channel 112, one of the terrorists attended an event at Crocus on the day before to study the layout and the location of security posts and plan their retreat after the attack.

Simonyan released a video showing a second suspect. The man on the screen, whom she calls “the ringleader” (and who was subsequently identified as Dalerdjon Mirzoev), says through an interpreter that he was staying in a hostel near a highway in Moscow’s Dmitrovsky District. He adds that a man called Muhammad lived with him.

According to the suspect, some 10 or 12 days before the attack he had met someone named Abdullo on Telegram and, together with Muhammad, bought a car from Abdullo’s relatives. Someone off-screen presumably shows an image to the suspects and asks whether it is Abdullo in the photo. The suspect confirms that it is.

Later, images surfaced online of the third suspect: Saidakrami Murodali Rachabalizoda, who had a piece of his ear cut off by security agents during his capture. The footage of his torture appeared on the Russian pro-war Telegram channel Kanal Spetsialnogo Naznacheniya.

In the video, Rachabalizoda is positioned face down on the ground while a man in camouflage pins him with his knee while shoving the piece of Rachabalizoda's severed ear into Rachabalizoda's mouth. Footage is also available of the bloodied man being led to a car by armed men. The video was uploaded to the Telegram channel of Vladimir Rogov, the head of the “We Are with Russia” movement in occupied Zaporizhzhya.

The video was filmed in the vicinity of the Kommuna village in Navlya District, Bryansk Region, according to a member of the online community GeoConfimed. The village is not far from Khatsun, the place mentioned by MP Khinshtein when he detailed the arrests.

Later, Evgeny “Topaz” Rasskazov, a fighter of the Russian far-right paramilitary Sabotage Assault Reconnaissance Group «Rusich” and head of the anti-slavery organization Alternativa, shared a photograph of the knife he claims was used to cut off Rachabalizoda's ear. Rasskazov suggested auctioning it off. Speaking of the detainees, he predicted that they would meet a horrible death in prison.

The Telegram channel ANNA News also shared a video of Rachabalizoda's interrogation. The man in the video already has a bandage around his head, and his clothes are soaked with blood.

The third suspect detained is Muhammadsobir Fayzov, 19. His photo, which was published multiple times on Telegram, suggests he sustained an eye injury during his arrest. Fayzov was taken to a hospital for surgery.

The Moya Moskva Telegram channel released footage of him being interrogated in a hospital setting. The 47 seconds of video suggest that the man has trouble understanding what is happening around him. Fayzov says he received papers permitting his stay in Russia right at the airport, but most of the interrogation appears to consist of Fayzov struggling to understand questions, then struggling to answer them. The first line in the video shows him saying in Tajik: “What did I do?” The Insider has translated the publicly available portions of the interrogation into Russian.

All points bulletin on the suspects

There are discrepancies between the men Russian police were instructed to find and the men who appear to have carried out the attack. The Telegram channel Baza shared the APBs on the four suspects, which had been distributed across all police departments of Russia’s Central Federal District. All of the listed suspects were male Tajik nationals registered in Russia’s Yaroslavl, Ivanovo, and Samara regions: Mahmadrasul Nasriddinov, 37, Rivozhidin Ismonov, 51, Shokhindjonn Safolzoda, 21, and Rustam Nazarov, 29.

Tajikistan’s Interior Ministry stated that two of the men listed in the APBs are currently at their place of residence in Tajikistan and had returned from Russia as early as Nov. 26, 2023. The ministry also released the photographs of the two men whose names matched those of the suspects in the APBs.

Out of the four suspects whose arrest in the Bryansk Region has been documented in videos and photos that appeared in multiple Telegram channels, none match the images on the APBs released by Baza.

As Tajikistan’s Interior Ministry added later, another suspect mentioned in several online sources, a 29-year-old resident of Bokhtar, Khatlon Region, currently works as a taxi driver in Samara. “At the time of the attack, he was in Samara and had nothing to do with the crime,” the ministry officials stated.

On Mar. 23, the ISIS-affiliated media outlet Amaq released what it claimed was a photograph of the fighters who perpetrated the attack on Crocus City Hall. However, in the photograph, the men’s faces are blurred, and no accompanying video recording has been made publicly available.

In its message, ISIS claimed that the four men were armed with machine guns, a handgun, knives, and incendiary bombs and that they had been closely monitoring Crocus City Hall prior to the attack.

As The Insider observed, the color, cut, and patterns of the terrorists’ clothes in the group photo match those of the attackers in the videos filmed at Crocus City Hall during the attack and those of the suspects (1,2,3,4) arrested in connection with the attack.

The defendants in the terror attack case in court

Mar. 24 saw the first court hearing in the terror attack case, which dealt with pre-trial restrictions. All four of the defendants had been brought to the hearing with signs of severe beating and torture, covered in bruises and hemorrhages. Muhammadsobir Fayzov, who had undergone an eye surgery, appeared to be unconscious. The court ruled to keep the defendants in pre-trial custody until May 22, 2024.

The first defendant to enter the courtroom of Moscow’s Basmanny District Court was Dalerjon Mirzoev, 32, a Tajik national and the father of four minor children. He pleaded guilty on all charges.

He was followed by Saidakrami Murodali Rachabalizoda, the suspect who had his ear cut off during the preliminary interrogation by FSB agents. Rachabalizoda also pleaded guilty on all charges. He said he was married and had a child. He also has a residential address in Russia but does not remember it.

The third defendant in the terror attack case is Shamsidin Fariduni, 25. He is married and has an eight-month-old child. He was employed as an unskilled worker at a factory in Podolsk and had a residential address in Krasnogorsk. He replied to almost all of the questions addressed to him in Russian without the aid of an interpreter, the lone exception being the question about having minor children, which was interpreted for him.

The fourth defendant, Muhammadsobir Fayzov, was carried into the courtroom on a stair stretcher. He had previously been interrogated in an intensive care unit. During the hearing, he appeared unconscious and did not respond in any way to the proceedings. Fayzov is single and has no children. He completed his secondary education and was registered in Ivanovo, where he also worked in a barbershop.

All four were charged with committing a terror attack under Art. 205 Part 3 Clause B of Russia’s Criminal Code. At the request of the investigators, all four hearings were conducted behind closed doors.

Authorities’ response in Russia and the West

On Mar. 7, the U.S. Embassy in Moscow issued warnings to Russia about a terrorist plot. It also supplied the Russian government with information about a possible attack, according to a report by CBS News citing a U.S. official with knowledge of the matter. Washington has also indicated that it has intelligence confirming that ISIS was behind the terrorist attack at Crocus City Hall.

Following these reports, the Interfax news agency confirmed that the U.S. had indeed provided Russia with information about an imminent terrorist attack. However, according to a source in the Russian security services, the information was not specific.

On the night of Mar. 22-23, Russian state television channels prepared three times to broadcast an address from Vladimir Putin to the nation, but the stations never received the material, sources told The Insider. Instead of the address, the Kremlin said Putin had received reports on the progress of the investigation into the terrorist attack. He also wished the victims of the terrorist attack at Crocus City Hall a speedy recovery — although he did so through Deputy Prime Minister Tatyana Golikova.

Nineteen hours after the attack, the Russian president made an official statement and declared a nationwide day of mourning. Putin also said that the perpetrators had been trying to escape by “making their way towards Ukraine.” According to Putin, a “window” had been prepared for the terrorists to cross the Russian-Ukrainian border.

Andriy Yusov, spokesman for Ukraine’s military intelligence agency HUR, called Putin’s claims about Kyiv’s involvement in the attack “nonsense.”

In a comment published on his official Telegram channel, Ukrainian President Volodymyr Zelensky said that Putin and his officials were trying to shift responsibility away from themselves:

“This absolutely miserable Putin, instead of attending to his own citizens of Russia, addressing them, remained silent for a day – thinking about how to link this with Ukraine. Everything is absolutely predictable. [...] What happened yesterday in Moscow is obvious, both Putin and other scoundrels simply try to blame everything on someone else. They always resort to the same methods. It's been done before. There have been blown-up houses, shootings, and explosions. And they always blame others.

“Those hundreds of thousands of Russians who are now killing on Ukrainian land would surely be enough to stop any terrorists. And if the Russians are ready to silently die in ‘Crocus Halls’ and not ask any questions to their security and intelligence agencies, then Putin will try to turn such a situation to his personal advantage again,” said Zelensky.

On Mar. 23, U.S. Secretary of State Anthony Blinken issued a statement on Twitter strongly condemning the deadly terrorist attack in Moscow. “We stand in solidarity with the people of Russia in grieving the loss of life after this horrific event,” Blinken wrote.

Politicians and officials from multiple countries — including French President Emmanuel Macron, UK Foreign Secretary David Cameron, Italian Prime Minister Giorgia Meloni, Turkish President Recep Tayyip Erdogan, Israeli Foreign Minister Yisrael Katz, and Indian Prime Minister Narendra Modi — expressed their condolences to the families of the victims.