The Islamic State Claimed the Moscow Attack. The Kremlin Is Still Blaming Others.

Even before the deadly toll of the attack on a Moscow concert hall on Friday became clear, officials in Russia linked it to the war against Ukraine and a broader conflict with the West. Ninety minutes after first reports of the attack, Dmitri A. Medvedev, the former president and the deputy chairman of the Kremlin’s security council, darkly hinted at “terrorists of the Kyiv regime.”

The claim of responsibility by the Islamic State did little to temper the Kremlin’s narrative, which has unspooled in a torrent of unsupported accusations and baseless, even fanciful conspiracy theories spread across social media.

When President Vladimir V. Putin said “radical Islamists” had carried out the attack, he called it “just an element in a series of attempts of those who have been at war with our country since 2014,” an explicit reference to Ukraine and the upheaval that year that led to the illegal annexation of Crimea.

“They need a ‘Big Lie,’” said Nina Khrushcheva, a professor of international affairs at the New School in New York, who has written extensively on Russian politics and propaganda.

The narratives served to deflect attention from the failure to prevent the deadly attack at Crocus City Hall, while rallying the country behind a war that has claimed hundreds of thousands of lives. Posts linked to the Kremlin or its supporters spread in German, Spanish, Portuguese and Italian and suggested, without evidence, that the Central Intelligence Agency, the British intelligence service MI6 or others were the actual masterminds.

“So they are steering it to where it needs to go,” Ms. Khrushcheva said, referring to the Kremlin’s propaganda effort, “all enemies foreign and domestic centered around one umbrella — Ukraine and the directing hand of the West to destabilize.”

Disinformation has been a feature of the war since Russia’s full-scale invasion in February 2022. The emergence of so many false or conspiratorial claims about the attack at the concert hall, which killed at least 139 people, has made sorting out the truth increasingly difficult.

Blaming Ukraine

In the hours after the attack, the Russian television channel NTV broadcast a video that seemed to implicate Ukraine but that was quickly debunked as an artificially generated deepfake. The video appeared to show Oleksiy Danilov, then the secretary of Ukraine’s National Security and Defense Council, telling news anchors: “Is it fun in Moscow today? I think it’s a lot of fun. I would like to believe that we will arrange such fun for them more often.”

The clip used video of Mr. Danilov from interviews conducted days before the attack, according to Shayan Sardarizadeh, who tracks disinformation for the BBC, as well as other experts in deepfakes. The Center for Countering Disinformation, a Ukrainian government group associated with the defense council, added that the video’s quality was not good and that Mr. Danilov’s facial expressions and speech did not match.

After the United States linked the Crocus attack to the Islamic State-Khorasan, or ISIS-K, a spokeswoman for the Russian Foreign Ministry, Maria V. Zakharova, wrote on Telegram that American officials had “NO RIGHT to absolve anyone,” namely the Ukrainians.

Social media users began throwing suspicion on a white van seen near Crocus City Hall with a license plate that they claimed was Ukrainian; researchers later said it appeared to be a Belarusian plate. Some online accounts also claimed that Ukrainians had called in false reports of shootings in other locations around Moscow to disrupt the rescue effort.

Ukraine’s Foreign Ministry followed Mr. Medvedev’s comment on Kyiv with a statement accusing Russia of pursuing “the goals of stirring up anti-Ukrainian hysteria in Russian society and creating conditions to boost mobilization of Russian citizens into the criminal aggression against our state.”

Bret Schafer, a senior fellow at the German Marshall Fund who studies information manipulation, said rumormongers were starting to “solidify around a more centralized, focused narrative” being voiced not from the fringe but from widely followed sources in the government and blogosphere.

“These Russian embassies are being fairly conspiratorial here, kind of en masse pushing out content that is effectively saying this wasn’t ISIS, or if it was ISIS, it was ISIS under the loose — or in some cases more explicit — direction of Washington and Ukrainian intelligence,” he said. “If it is Ukraine and Washington being somehow involved, that then is an enemy they’re already fighting, and so it is just proof positive that the fight is justified and they need to continue.”

Claims of Western involvement

Some social media accounts seized on news that the United States had collected intelligence this month that ISIS-K had been planning an attack on Moscow. They suggested that the Americans, including the C.I.A., were somehow “in on it” or that Washington had not shared its findings with the Kremlin.

In fact, American government officials issued a public warning on March 7 and said they had also privately conveyed that to their Russian counterparts through official channels.

In the days after the attack, a Russian intelligence operation known as Doppelgänger circulated fake posts online asserting Ukrainian or Western involvement “in a coordinated effort to galvanize domestic support, promote unity and escalate Russia’s war in Ukraine,” said Brian Liston, a researcher with Recorded Future, an intelligence threat company.

One article, he noted, appeared on a website liked to Doppelgänger that claimed the British government sought to “deliberately draw attention away from the tragedy because they themselves, together with Ukraine, committed the terrorist attack by the hands of radical Islamists.”

Unsubstantiated claims of American involvement or complicity came not only from the Russians.

Mike Benz, a former official in the Trump administration, said on X that “if the State Dept knew it, the CIA somehow had advance awareness.” He conspiratorially told followers to “fill in the rest yourself.” Later, he wrote that he had “no knowledge of this, direct or indirect, and am not making any claims here,” adding, “Just initial reaction of things that get my hackles up is all.”

The Russian false flag theory

Ukraine and the West, however, were not the only targets for accusations. Officials outside Russia and several social media users with sizable followings suggested that the Kremlin had staged the attack itself so it could generate support for its war in Ukraine. Even the statement from Ukraine’s Foreign Ministry pushed the idea, saying that “there are no red lines for Putin’s dictatorship” and adding, “It is ready to kill its own citizens for political purposes.”

People scrutinized videos from inside the concert hall and suggested that a uniformed man with a dog appeared too calm in the chaos and therefore must have been a government agent complicit in the attack.

Russia’s critics have also recalled a series of deadly apartment building bombings in Russia in 1999 that reignited the country’s civil war in Chechnya. To this day, some suggest the Kremlin orchestrated those bombings to lift Mr. Putin, then a newly appointed prime minister, to greater power.

Identifying the wrong terrorists

Images of five men began circulating online after the attack, with various accounts identifying them as the Crocus gunmen. The men turned out to have been killed in Ingushetia, a region in southern Russia, earlier in March, prompting one high-profile intelligence-focused account to retract its claim linking them to the Moscow attack.

Many of the false narratives about the Crocus attack originated on Telegram, which is popular in Russia, and then fanned out in translation to platforms like X. There, the “enormous push, the need to know what’s happening,” attracted opportunistic commentators, said Roman Osadchuk, a research associate for Eurasia at the Atlantic Council’s Digital Forensic Research Lab. By quickly weighing in on the tragedy — regardless of accuracy — social media users could build their audiences and take advantage of financial incentives, such as an arrangement on X to share advertising revenue from popular posts.

“In any emergency, to be among the first bearers of news helps you receive much of the traffic and followers and be competitive,” he said.