Crocus City Hall Terrorism Trial Exposes Russian Counterterrorism Gaps
Uran Botobekov
Executive Summary:
The March 12 verdict delivered by Moscow’s Second Western District Military Court in the case of the 2024 Crocus City Hall attack reinforces that the attack was carried out by ISKP-linked Tajik militants, underscoring the expanding operational reach of the group’s Central Asian networks.
The ruling also weakens earlier politically charged claims advanced by the Kremlin and the Federal Security Service (FSB), which sought to attribute the attack to Ukraine as well as to U.S. and UK intelligence services.
Russia’s Ukraine-centered security posture—combined with coercive migration enforcement and restrictive religious policies widely perceived as hostile toward Islamic practices—risks deepening alienation within Central Asian migrant communities, inadvertently creating conditions conducive to further radicalization.
Moscow Court Verdict and Implications for ISKP Operations
On March 12, Moscow’s Second Western District Military Court issued its verdict in the 2024 Crocus City Hall terrorist attack. This was one of the deadliest jihadist operations on Russian soil in nearly two decades, which claimed 150 lives and injured more than 600 others (see EDM, March 26; 27, 2024; see Terrorism Monitor, May 6, 2024; Kommersant, March 12). The four attackers were Tajik nationals and were claimed by Islamic State in Khorasan Province (ISKP) after the attack.
Acting on prosecutorial requests, the court convicted 19 individuals linked to the operation. The four principal perpetrators—Shamsidin Fariduni, Dalerdzhon Mirzoyev, Muhammadsobir Fayzov, and Saidakrami Rachabalizoda—were among 11 others who were sentenced to life imprisonment in maximum-security penal colonies. An additional four defendants received approximately 20-year prison terms for facilitating the attack, including selling a vehicle to the gunmen and assisting with apartment rentals.
Three of the four main perpetrators pleaded guilty and expressed remorse. The fourth, Saidakrami Rachabalizoda, maintained his innocence, asserting that he had “carried out holy jihad,” which reflected his continued adherence to ISKP’s ideology (The Moscow Times, March 12). Each of the four main perpetrators was also fined 990,000 rubles (about $12,180). Among the remaining defendants, eight entered partial guilty pleas, while seven who were accused of providing logistical support denied any knowledge of the plot.
The proceedings highlighted how intra-diaspora rental and social networks facilitated ISKP operatives’ ability to move, conceal, and execute a high-casualty attack while evading Russian counterterrorism surveillance.
Elements of the Operation
Investigative Committee Chairman Alexander Bastrykin confirmed that the Crocus City Hall case encompasses over 500 volumes of documents, including 300 site inspections, approximately 2,500 forensic analyses, and testimony from more than 1,000 witnesses and 2,300 officially recognized victims (TASS, May 20, 2025). The trial was conducted behind closed doors, and the appeals process remains unclear. The verdict represented a key milestone for Russia’s legal response to terrorism and reinforced intelligence linking the attack to ISKP networks embedded within Central Asian jihadist circles.
Separately, on November 1, 2024, Russian authorities arrested four Ingush residents for supplying modified Kalashnikov rifles and ammunition to the Tajik perpetrators for a reported one million rubles (about $12,300). One suspect, however, was killed while attempting to evade capture (Kommersant, November 1, 2024). On March 28, 2024, Turkish authorities also detained five Tajik nationals who had resided with Shamsidin Fariduni in Istanbul until January 2024 and charged them with membership in ISKP (Anadolu, January 2, 2025).
Then-U.S. Attorney General Pamela Bondi further reported that Mohammad Sharifullah (aka Jafar)—an ISKP operative extradited from Pakistan for the 2021 Kabul airport attack—admitted to training two Tajik militants in weapons handling for the Crocus operation (U.S. Department of Justice, March 5, 2025). Collectively, these cases underscore ISKP’s sophisticated cross-border networks for operational planning, training, logistics, and safe haven coordination.
Politicized Attribution and IS’s Counter-Narrative
The Crocus City Hall attack was the most significant terrorist incident in a decade in Russia and occurred amid Moscow’s full-scale war in Ukraine and escalating confrontations with the West. Despite prior warnings from the U.S. Embassy and CIA about a potential plot by ISKP, Director of Russia’s Federal Security Service (FSB), Alexander Bortnikov, quickly attributed the attack to Ukrainian, U.S., and U.K. security services. He, therefore, transformed a jihadist operation into a geopolitical “witch hunt” (U.S. Embassy, March 7, 2024; TASS, March 26, 2024; New York Times, April 2, 2024).
Russian state media and pro-Kremlin “military bloggers” amplified Russian President Vladimir Putin’s claim that the four main perpetrators attempted to flee to Ukraine through a prearranged “window.” This advanced the conspiracy narrative that Ukrainian intelligence had allegedly exploited ISKP while coordinating with Western services against Russia (President of Russia; Meduza, March 23, 2024). Despite Kyiv’s denials and strong U.S. rebuttals, Russia’s political establishment largely embraced the “blame-Ukraine” narrative (Ministry of Foreign Affairs of Ukraine, March 22, 2024; The Hill, March 28, 2024). This reflected a Cold War–style geopolitical framing of terrorism, even as segments of the Russian public criticized the FSB for failing to prevent the attack (Meduza, March 26, 2024).
The Kremlin-driven narrative was interpreted by Islamic State (IS) as a challenge to its operational credibility, prompting the group to launch a coordinated propaganda response. The group rapidly claimed responsibility through its Amaq News Agency and praised “four Caliphate inghimasis” (suicide attackers in combat) who struck “the heart of the Christian world” in the Crocus City Hall operation (Amaq, March 22, 2024). The following day, Amaq also released photographs and video footage of the attackers displaying the IS flag, reinforcing its claim of operational ownership (Amaq, March 23, 2024). A week later, al-Naba yet again framed the attack as coinciding with the tenth anniversary of the Caliphate and mocked Moscow’s Western-blame narrative as an attempt “to conceal…its major defeat at the hands of the Mujahideen” (Al-Naba, March 28, 2024).
In an audio statement released by al‑Furqan Media Foundation on March 28, IS spokesman Abu Hudhayfa al‑Ansari praised the attack, declaring that ISKP had “struck the Russian kafirun (infidels) and shed their blood” (Al-Furqan, March 28, 2024). ISKP’s media arm, the Al‑Azaim Foundation, dedicated Voice of Khorasan Issue 34 to the attack, portraying it as a blow to “the pride of the kuffar” and a revival of global jihadist morale (Voice of Khurasan, April 8, 2024).
Subsequent regional propaganda reinforced this narrative. ISKP’s Tajik-language Sadoi Khuroson magazine denounced Tajik President Emomali Rahmon as a “murtad” (apostate) and “Putin’s slave” and condemned Tajikistan’s alignment with Moscow (Sadoi Khuroson, March 29, 2024).
ISKP’s Uzbek-language Xuroson Ovozi Telegram channel, meanwhile, rejected Russia’s war against Ukraine as un-Islamic and urged Central Asians to join “true jihad.” This echoed IS’s longstanding depiction of the conflict as a “Crusader-on-Crusader” war beyond Islamic obligation (Al-Naba, March 6, 2022). Collectively, these publications illustrate a coordinated propaganda surge aimed at asserting operational ownership while expanding ISKP’s messaging among Central Asian audiences.
Court Verdict Confirms Russia’s War Priorities
Witness testimony presented during the trial revealed the operational infrastructure behind the attack. One confidential source embedded within migrant communities mapped the internal networks connecting all nineteen defendants (Vesti.ru, February 10). Another witness confirmed recruitment through ISKP’s Tajik-language Telegram channel “Sadoi Khuroson” (Vedomosti, March 28, 2024). A third source testified that Shamsidin Fariduni—who had received militant training in Türkiye and Afghanistan—led the operation (TASS, December 19, 2025).
Bortnikov finally acknowledged that Afghan-based ISKP operatives had organized the attack and recruited Tajik migrants via Telegram, after evidence mounted and IS repeatedly claimed responsibility (Kommersant, October 4, 2024). The verdict issued by the Moscow Military Court later formally confirmed investigators’ conclusion that the four main perpetrators were ISKP operatives (Asia-Plus, March 12). Despite this evidence, the verdict nonetheless incorporated a politically motivated “Ukrainian trail,” asserting that the perpetrators acted “in the interests of Ukraine’s top leadership” and that Ukrainian intelligence had coordinated the ISKP cell (Lenta.ru, March 12, 2025).
The FSB intensified repression against Central Asian migrants following the Crocus City Hall attack. Amid rising xenophobia and increasingly securitized migration policies, Russian security services expanded lethal operations against alleged Salafi networks, with suspects frequently killed during arrest raids. Approximately 75 individuals accused of Salafism or links to Ukrainian intelligence were killed after the attack (Important Stories, August 12, 2025). These heavy-handed measures appear to be producing unintended security consequences. Closed online discussions surrounding the court verdict have alarmed Russian authorities, with pro–Salafi-jihadi sympathizers among Muslim migrants praising the attackers as “brothers in faith” and disputing their guilt (Regions.ru, March 13).
Conclusion
Court testimony, investigative findings, and repeated IS claims confirm that the Crocus City Hall attack was executed by pro-ISKP Tajik Islamists, despite persistent attempts by Russian authorities to attribute responsibility to Ukraine. Moscow’s externalization of blame risks obscuring a more immediate vulnerability: the radicalization potential within marginalized Central Asian migrant communities inside Russia. A Ukraine-centered security posture—combined with coercive migration enforcement and religious policies widely perceived by migrant communities as hostile to Islamic practice—may inadvertently expand ISKP’s recruitment space in Russia. Without strategic recalibration, Russia’s counterterrorism architecture risks being undermined less by external adversaries than by the domestic consequences of its own securitized overreach.
This article was originally published in Terrorism Monitor.
Dr. Uran Botobekov is an analyst for SpecialEurasia (Italy) and an expert on Sunni jihadi movements and regional security in Central Asia. He is a regular contributor to Homeland Security Today, The Diplomat, and Modern Diplomacy. He received his PhD in Political Science from the National Academy of Sciences of the Kyrgyz Republic.