On 22 March 2024, a coordinated terrorist attack against civilians occurred at the Crocus City Hall music venue in Crocus City, Krasnogorsk, Moscow Oblast, Russia. The attack began at around 20:00 MSK (UTC+3), shortly before the Russian band Picnic was scheduled to play a sold-out show at the venue. Four terrorists associated with Islamic State – Khorasan Province (IS–KP or ISIS-K) carried out a mass shooting, as well as slashing attacks on the people gathered at the venue, and used incendiary devices to set the venue on fire. Investigators said 151 people had been killed (including those who died later in the hospital), and more than 609 others had been injured by gunfire or suffering from burns.
IS claimed responsibility for the attack in a statement through the IS-affiliated Amaq News Agency shortly after the attack, with its regional branch Islamic State – Khorasan Province (IS–KP or ISIS-K), most likely being responsible. Amaq also published a video filmed by one of the attackers. It showed the attackers shooting victims and slitting the throat of a victim, while the filming attacker was reciting the takbir, praising God and speaking against infidels.
Russia's Foreign Ministry called the incident a terrorist attack. Russian president Vladimir Putin called the attack a "barbaric terrorist act" and said that the gunmen had been arrested. He also declared 24 March 2024 to be a national day of mourning, and sought to link assailants to Ukraine, in what has been described as "very doubtful and primitive" disinformation. It was the deadliest terrorist attack on Russian soil since the Beslan school siege in 2004. Investigators detained 12 people in relation to the attack, including four suspects, who were charged with terrorism later on 24 March.
Background
Russia has been subject to major terrorist attacks starting with a series of explosions that hit Moscow apartment blocks in 1999, followed by the Moscow theater hostage crisis in 2002, the Beslan school siege in 2004 and the Domodedovo International Airport bombing in 2011. There have been at least a half-dozen attacks in or near Moscow by Muslim terrorists, most of them Chechen militants, over the past 25 years.
The Islamic State has also carried out coordinated, large-scale attacks on music venues throughout Europe since the 2010s, including a similar attack in Paris during a rock concert at the Bataclan theater in November 2015, as well as claiming responsibility for the bombing at the Manchester Arena in the United Kingdom in 2017. In October 2015, Islamic State militants downed a Russian passenger jet over Egypt's Sinai Peninsula, killing all 224 people on board. It was also responsible for the bombing of the Russian embassy in Kabul in September 2022.
Russia had targeted the Islamic State during its intervention in the Syrian Civil War on behalf of the government of President Bashar al-Assad. After years of reduced activity, the Islamic State has been trying to step up its attacks. On 3 January 2024, IS–KP conducted bombings in Kerman, Iran that killed at least 103 people; the US had warned Iran of the possible attack. Colin Clarke from the independent Soufan Center think tank said that IS–KP "has been fixated on Russia for the past two years, frequently criticizing Putin in its propaganda."
On 2 March 2024, six alleged Islamic State militants were killed in a shootout with Russian security forces in Ingushetia. On 7 March, the Russian Federal Security Service (FSB) announced that it had neutralized an Islamic State terrorist cell in Moscow, which had intended to attack a synagogue in the city.
Prior warnings from other countries
On 7 March, the United States Embassy in Moscow warned that "extremists have imminent plans to target large gatherings in Moscow, to include concerts" and advised US citizens to "avoid large gatherings over the next 48 hours," to avoid crowds, to stay updated by monitoring local media, and to maintain awareness of surroundings. Canada and the United Kingdom also issued similar warnings to their citizens in Russia. That day, the US also privately warned Russian officials of the danger of an impending attack from IS–KP from intelligence gathered earlier in March, under the US intelligence community's "duty to warn" requirement, specifically mentioning the Crocus City Hall venue. US officials later stated to The New York Times that the attack was related to the prior US warning, and also said that the intelligence reports that the warning was based on had been shared with Russian officials before the attack. In contrast, the Russian ambassador to the United States, Anatoly Antonov, said that regarding the attacks "no concrete information, nothing was passed to us", while the head of the FSB, Alexander Bortnikov, said that the US warning was "of a general nature".
Three days before the Crocus City Hall attack, President Vladimir Putin told the board of the FSB that Western warnings of a potential attack inside Russia were "provocative" and "resemble outright blackmail and the intention to intimidate and destabilise our society".
Ten days after the attack, it was reported that Iran had also warned Russia that a major "terrorist operation" was being planned, based on information gathered from IS militants arrested after the Kerman bombings. Despite coming from, as described by the news agency Reuters, a "diplomatic ally" of Putin's government, the notification was allegedly dismissed. Iran's communications have been said to have not included the specific target on Russian soil.
Venue
Crocus City Hall was built in 2009 as a concert venue with a capacity of 6,200 people and is one of the largest concert venues in the Moscow area. It is a seven-story building which has an area of about 38,000 m2. It is part of a larger block of shopping centers, restaurants, and other attractions called Crocus City, which was built by Azerbaijani billionaire and property developer Aras Agalarov and was also the venue of the Miss Universe 2013 pageant and the Top Hit Music Awards in 2013 and 2019.
Attack
On 22 March 2024, the Russian band Picnic was scheduled to play a sold-out show at Crocus City Hall. At around 20:00 MSK (UTC+3), before the band began their performance, masked gunmen in combat fatigues opened fire on the crowd using AK–style assault rifles. An IS–KP report also claimed that the assailants had pistols and knives. Because the show was about to begin, some believed the initial sound of gunshots was part of the act. At the time of the attack, children and teenagers were also in the building for a ballroom dancing competition. The venue's security guards were unarmed, and some of them were reportedly killed in the attack. A part-time cloakroom assistant, 15-year-old Islam Khalilov, reportedly helped save more than a hundred concert-goers by showing them an exit through the venue's office space. He was assisted by three of his co-workers, 14-year-old Artyom Donskov, Nikita Ivanov and another.
One witness described the attackers as bearded men. Amateur video footage verified by BBC Verify showed masked gunmen shooting indiscriminately in the entrance hall and auditorium. Other footage posted to Telegram showed men in military fatigues and baseball caps firing into crowds of screaming people. On 23 March, IS released a video through Amaq News Agency, showing the shooting and throat-slitting of victims in the attack. In the video, the assailants appear to shoot patrons outside the entrance of the auditorium. In Arabic subtitles, the assailants were heard shouting; "come, come quickly", "bring the assault rifle, bring the assault rifle", and "kill them and have no mercy". After shooting the victims, an assailant slits the throat of a still-alive wounded victim, who was shot off-camera prior to the recording. After the killings, in Arabic subtitles, one of the assailants is reported to have stated: "The infidels are defeated by the grace of Allah. Allah is great.. [sic] The infidels are defeated. We went out for the sake of Allah and are supporting his religion."
The assailants were also reported to have used incendiary devices, with an eyewitness claiming the assailants used petrol bombs to start a fire in the auditorium. Amateur video footage posted to social media sites showed huge fires and plumes of smoke coming from the building from the fires set by the assailants, including by an emergency stairwell, forcing people towards the attackers' positions in the middle of the lobby. The fire in the complex was estimated to have covered an area of 12,900 square metres (139,000 square feet). Hours later, around 22:14, a loud sound was reported, followed by a partial roof collapse. Moscow Oblast governor Andrey Vorobyov said the roof over the hall had collapsed.
Specialized police units from the Special Rapid Response Unit (SOBR) and Special Purposes Mobile Unit (OMON) were sent to the scene, arriving over one hour after the shootings started, according to Nexta. Their arrival was delayed by traffic jams caused by the rush-hour, with the venue having been located on the Moscow Ring Road. Vorobyov went to the scene to set up a task force to handle the situation. Other officials also arrived, including Interior Minister Vladimir Kolokoltsev. The National Guard of Russia was also dispatched to search for the assailants, with a picture posted of the suspected assailants fleeing in a white 2007 Renault Symbol car with the registration plate T668UM 69 (Tver Oblast), which they had purchased on 4 January 2024.
Survivors were evacuated via medical helicopters, with 70 ambulance crews reportedly being dispatched. An unknown number of people fled to the parking area from the stage, while others fled to the roof. Authorities evacuated approximately 100 people hiding in the basement. A survivor said that escapees were hampered by locked doors, forcing some of them to break a door open to escape. Firefighters prevented the fire from spreading, while three helicopters were deployed to dump water on the burning rooftop.
By 07:00 on 23 March, Vorobyov reported the fire had been contained and mostly extinguished. He released a video showing extensive damage to the building with the roof and upper rows of the concert hall completely collapsed. By 11:30 that same day, the fire had been extinguished.
Casualties
The attack left 151 dead, with more reportedly dying of their wounds after the assault, and 609 injured, some of them critically. Aside from gunshot wounds, some of the deaths were caused by smoke inhalation. According to the Russian Children's Rights Commissioner, Maria Lvova-Belova, six children were killed and seven more injured in the attack. Eight children also lost their parents. The oldest fatality was a woman in her 70s. Most of the victims were from the northwestern edge of Moscow, including Krasnogorsk and Khimki. Three citizens of Belarus, two from Kyrgyzstan, and one each from Moldova, Armenia and Azerbaijan were among those killed.
The search for the victims ended on 23 March. The health department of Moscow said it expected to finish identification of bodies in two weeks. As of 30 March 134 fatalities had been identified.
The members of Picnic posted on Instagram that they and their management were "alive and safe", with TASS later reporting that they had been evacuated. However, the band later said on VK that one of the band's staff members was missing; the band's assistant director was on the merchandise stall and died in the attack.
Alexei Filatov, an anti-terrorist operations expert, attributed the large amount of casualties to the fire brigade being delayed by traffic congestion.
Another victim died on 27 September 2025. A further victim died on 14 March 2026.
Investigation
As of 27 April 2024, 12 people have been detained, including the four suspected assailants in a white car, who were captured on the M3 highway leading to the Ukrainian border (140 kilometres [87 mi] away), near the village of Khatsun in Bryansk Oblast, and about 340 kilometres (211 mi) southwest of Moscow, on the evening of 22 March. Russia coordinated with Belarusian security forces to prevent the suspects from crossing the Belarus–Russia border. The Investigative Committee of Russia launched a criminal terrorist probe into the attack. Officials later said that the attackers were not Russian citizens.
State Duma deputy Alexander Khinshtein said that Tajik passports were discovered in the vehicle of the individuals in custody, and the Russian Telegram channel Baza identified the four attackers as citizens of Tajikistan. The Ministry of Internal Affairs of Tajikistan denied the involvement of three of its citizens, stating that the individuals named in the discovered passports had returned to Tajikistan months earlier and were working there. In a phone call with Putin, Tajikistani President Emomali Rahmon said that "terrorists have no nationality, no homeland and no religion". On 12 April however, Tajikistani foreign minister Sirojiddin Muhriddin issued a statement condemning the alleged torture of the suspected attackers in Russian custody, calling it "unacceptable". As Tajikistan signed a dual citizenship agreement with Russia in the 1990s, it is possible that the perpetrators held dual Tajik and Russian citizenships.