Moscow attack: Debunking the false claims

Vladimir Putin has acknowledged "radical Islamists" carried out last week's deadly Moscow concert hall attack.

But despite the Islamic State (IS) group claiming responsibility, the Russian president continues to insist Ukraine was involved.

Through Russian officials' statements, media reports, and social media posts, BBC Verify examines how the campaign to blame Kyiv unfolded.

Accusations were made almost immediately after initial reports of the attack on the Crocus City Hall emerged on social media at 1715 GMT on Friday.

Several pro-Kremlin bloggers and some officials posting to the messaging app Telegram blamed Ukraine within just over an hour.

Pro-Russia pundit Sergey Markov, for example, said at 1825 GMT the attackers looked like "Islamist radicals", but went on to add - without evidence - that the attack was "likely organised from Kyiv".

Some 40 minutes later (1903 GMT), Moskovsky Komsomolets, a national tabloid, quoted military expert Roman Shkurlatov as saying the attack may have been organised with the support of Ukraine's Security Service and military intelligence.

And at 1927 GMT, Russia's ex-President Dmitry Medvedev vowed revenge if Ukraine was involved.

A few hours later, at 2213 GMT, NTV - one of Russia's main TV channels - aired a video clip, claiming that it showed a senior Ukrainian official confirming his country's involvement

In the video, Oleksiy Danilov appears to say: "It is fun in Moscow today, I think it's a lot of fun. I would like to believe that we will arrange such fun for them more often."

But BBC Verify has established the clip is actually an edit of two Ukrainian TV interviews broadcast in the past week.

Both can be found on YouTube. The first is an interview with Danilov from 19 March. The other one was published three days earlier and features Ukraine's military intelligence chief, Kyrylo Budanov.

The quote by Danilov which appears in the NTV video cannot be heard in the original interview.

Audio analysis, carried out for BBC Verify by the Advanced Forensic Technology Research Group at Liverpool John Moores University, suggests the audio was manipulated in the NTV video.

A gap in the audio frequency data indicates that the sound has been edited. However, the researchers cannot be certain the voice was AI generated.

BBC Verify has also found information embedded in the audio file suggesting it has been put through editing software.

An official accusation was made in Vladimir Putin's address on Saturday.

The Russian president said the assailants were caught as they were trying to flee to Ukraine, where "a window for crossing the border was prepared for them".

However, Russia has not presented evidence of a "window" to let the attackers through.

Although BBC Verify cannot independently confirm where the suspects were heading, we have verified several videos and photos of them being apprehended. And despite Putin's claim, the arrests took place a long way from the Ukrainian border.

By matching background details in their environment, we know two of the arrested suspects were filmed at about 90 miles (145km) from the Ukraine border.

While Ukraine has denied any involvement, responsibility has been claimed by the Islamic State (IS) group via its self-styled Amaq news agency.

Visual evidence, circulated by IS, includes a picture of four attackers with their faces blurred and a very graphic video filmed from one of the assailant's perspectives.

Multiple details - like features of the concert hall and guns used by the attackers - match videos that emerged online at the time of the attack.

But despite the evidence, Russia continues to accuse Ukraine.

Margarita Simonyan - editor in chief of the Russian TV network RT (previously known as Russia Today) - said on X the attackers were not from IS because they were not wearing suicide vests and "had no intention to die".

But while IS has repeatedly warned assailants against getting caught alive, the group's attackers have escaped before.

For example, in late 2022 one of the militants involved in an attack on a hotel in Kabul managed to escape and later carried out a suicide attack, according to IS media observed by BBC Monitoring.

The attackers drove in a white Renault - which matches the vehicle seen in a separate video used to flee the concert hall - before being detained.

According to Russian State Duma deputy Alexander Khinshtein, one man was arrested near the vehicle, while the other three fled into nearby woods and were detained following a search.

Weapons and Tajik passports were recovered from the Renault, Mr Khinshtein added.

On Sunday, footage was published of the men being escorted into a Moscow court. They were named by Russian authorities as: Dalerdzhon Mirzoyev, Saidakrami Murodali Rachabalizoda, Shamsidin Fariduni and Muhammadsobir Fayzov.

In the picture released by IS, three of the suspects can be seen wearing a light brown t-shirt, a light green t-shirt and a grey polo shirt.

These shirts appear to match those worn by three of the suspects at the time of their arrest.

For example, two logos on the light brown t-shirt worn by the man named Rachabalizoda are also visible in the video released by IS. He also identifies himself by the same name during a subsequent interrogation.

The suspect Mirzoyev, whose shirt is not visible in the IS picture, was detained wearing a long-sleeve green shirt, blue jeans and a black belt. These three items of clothing are worn by a gunman in the IS video.

The existence of a highly graphic video filmed by the attackers while carrying out the killings, their use of slogans common among IS attackers in the video, and its distribution via official IS media channels are consistent with the group's modus operandi.

An image of one of the attackers inside the Crocus City Hall more than two weeks before the attack has been published by Russian media - suggesting it had been pre-planned.

IS often awaits confirmation of the fate of the attackers before releasing a claim. If an attacker dies, it prevents the intelligence agencies from extracting information under interrogation or torture.

So the claim of responsibility while the perpetrators were still at large is unusual, and indicates keenness on IS's part to confirm its role.

This is not the first time that IS has targeted Russia. Two other major attacks happened in 2015 and 2018, along with other lower-level ones in recent years.

Additional reporting by Mina Al-Lami, Benedict Garman and Adam Robinson

What do you want BBC Verify to investigate?