Four days after the terrorist attack in Moscow, the most important question is how the Kremlin will respond – which itself will depend on who was behind the attack. Islamic State took credit for it; U.S. intelligence believes it was the work of the IS offshoot operating in Pakistan, Afghanistan, Iran and Tajikistan; and there is a lot of evidence to support both claims. Moscow, however, says it is unconvinced.

To be fair, there are some unusual aspects to the incident. Four alleged shooters have been apprehended, and Russia’s Federal Security Service believes it got the right guys thanks to AI-powered scanning systems used to monitor traffic. Apparently, the attackers drove away in the same car in which they arrived – a rare occurrence given that attackers tend not to make it out of situations like this alive. They were arrested on the highway leading to Kyiv in the Bryansk region, near the border with Ukraine (but also not far from Belarus). This has been cited by Russian President Vladimir Putin as one reason to suggest Ukrainian involvement. Lastly, the perpetrators, who are Tajik immigrants not previously known as radicals, allegedly conducted the attack for about $5,000 – a sum unusually low for individuals not apparently committed to a cause. According to the Russian newspaper Izvestia, which is well connected to state security services, the four men came together only a few weeks ago and possibly used Turkey as a base. (Radicalism isn’t unheard of in Turkey, either; in January, a shooter later found to have connections to Tajikistan killed one person in a Catholic church in Istanbul.)

Even so, the Ukrainian connection doesn’t entirely make sense. Some in Russian media argued that if they had just returned home after the incident, the gunmen would have blended in with the millions of migrants who dwell in Russia, making it difficult to identify them. CCTV around Moscow reportedly had no trouble capturing them speeding along roadways. Driving toward the tightly guarded Ukrainian border – in the same car that took them to and from the attack – was ill-considered. It’s as if they wanted to be caught.

Yet Moscow doesn’t think the attackers are stupid. Though there is evidence to suggest that muftis in Turkey hired them, Russian officials seem to believe that Kyrylo Budanov, Ukraine’s spymaster, arranged for the gunmen’s hire in coordination with radical Islamists at the Ukrainian Embassy in Turkey. There is no evidence to support this. After all, Ukrainian planners would know that the highways out of Moscow are blanketed in CCTV and likely would not set themselves up.

Moscow will have to respond, and part of its response will be to decide whether Islamic State is solely responsible or if it had help. If Moscow accepts that IS acted alone, then it also has to accept that the U.S. warnings of just such an attack were true, thereby acknowledging that its own security had failed to act upon intelligence received from Washington. In other words, the Russian government would need to admit its incompetence in security matters – during a time of war, no less. However, there’s a remote chance that this could spur Moscow into cooperating with other countries. France and other European countries have heightened their security since the attack and warned their citizens of an increased risk of terrorism. If Russia really wants to end the Ukraine war, this is an opportunity to use a collective security threat to start talking to the West as allies. This would put additional pressure on Ukraine to come to the negotiation table.

However, this may trigger an important security risk for Russia. To blame IS would also turn attention toward Tajikistan, given the attackers’ nationalities. While it is no secret that radical Islam is on the rise in Tajikistan, the matter has repercussions for Russia proper, given that anti-migrant feelings are already high. Ethnic nationalism, particularly Russian nationalism, has been a common electoral trope across the Russian political spectrum, including prior to the presidential election that was just held. Pinning all the blame on immigrants could fuel interethnic conflict – something that Moscow must avoid at all costs.

On the other hand, if Moscow decides Kyiv was involved, it will have every reason to intensify its war effort. (Moscow could even accuse the West of involvement. After all, U.S. national security adviser Jake Sullivan traveled to Kyiv and reassured Ukraine of U.S. support just days before the incident.) It looks as though this may be the chosen route. On March 25, Putin acknowledged that radical Islamists perpetrated the attack but said Washington’s insistence on Kyiv’s innocence was suspicious. Ultimately, Moscow will likely put at least some of the blame on Kyiv.

Indeed, Moscow’s retribution seems already to have begun. On March 25, Russia launched its third round of missile attacks against the Ukrainian capital in five days. The same day, the Russian Defense Ministry released footage purporting to show “army aviation crews successfully executing a combat mission” in the eastern Ukrainian district of Kupyansk. Russia also attacked important infrastructure in Lviv on March 24 – a significant bombardment that saw one Russian cruise missile briefly enter Polish territory, triggering a complaint from Warsaw. The Russian ambassador ignored the Polish government’s protest and chose not to meet with its foreign minister over the incident, indicating a definite diplomatic escalation between Russia and the NATO country.

Fallout From the Attack in Russia