Pro-Kremlin responses to the Moscow terrorist attack in Russia, Germany and Italy
29 March 2024
In the aftermath of the Crocus City Hall attack on Friday, 22 March 2024, which was claimed by Islamic State’s ‘Khorasan Province’ (ISKP), mis- and disinformation have fulminated on social media. This Dispatch examines the messaging about the attack from pro-Kremlin actors in Russian, German and Italian.
While Russian is the obvious language to turn to for understanding pro-Kremlin talking points, Germany has been a consistent target for pro-Kremlin propaganda since the full-scale invasion of Ukraine in February 2022. The Italian far-right has also become increasingly aligned with Russian positions since this time. Studying reactions to the attack in three languages therefore provides a valuable point of comparison for how pro-Kremlin propaganda may differ between domestic and European markets.
Key narratives, across platforms including Telegram, X (formerly Twitter) and Russian social media site VKontakte (VK), reject the ISKP’s claim of sole responsibility, instead positing that:
- Ukraine and/or the West are responsible for the attack, possibly with direct involvement from their intelligence agencies;
- The perpetrators of the attack were not true Islamists and may have been paid by ‘the real masterminds’ to send footage to Amaq, the ‘news agency’ of Islamic State (IS).
This Dispatch explores these narratives and the actors most prominently peddling them in each language.
Russian
Russian officials, including President Vladimir Putin and Foreign Ministry spokesperson Maria Zakharova, cast doubt on the claim that ISKP was solely responsible. They allege instead that Ukraine or the West were partly culpable for the attack, and/or are linked to IS. These statements were translated and spread by social media accounts belonging to Russian government officials and diplomats.
Figure 1: X posts by Kremlin-affiliated accounts repeating statements by Russian officials.
Russian state media, particularly domestically-focused entities, have explicitly blamed Ukraine and the West for the attack. Margarita Simonyan, Editor-in-Chief of state-controlled news network RT, claimed during a popular talk show on 24 March that the attack was a ‘false flag operation’. She later published the video clip on Telegram, VK and RuTube.
The anchor of the show, Vladimir Solovyov, claimed that the US is behind IS, pointing to a video of former US president Donald Trump claiming that his predecessor Barack Obama ‘founded IS’. He also showed a translated X post from former US Colonel Douglas Macgregor alleging that the CIA and MI6 were behind the attack. Russian state media also claimed that the perpetrators were paid to carry out the attack by enemies of Russia; these allegations intensified after an episode of Solovyov’s show was aired on 25 March with the title “The United States is the main sponsor of the terrorist attack in Crocus City Hall”.
Figure 2: A clip of Donald Trump claiming that Obama was the ‘founder of ISIS’ and an X post by Douglas Macgregor used by Russian state television to link the Crocus City Hall attack to the US.
During her talk show appearance on 24 March, Simonyan read out a Soviet poem from WWII titled “Kill the fascist”, implying that this is what Russians should do to “fascists” in Ukraine. She later shared a video of her reading via Telegram.
Figure 3: English- and French-language posts on X by Russian state media outlet Sputnik’s Africa-focused accounts in both English and French.
Russian TV channel NTV, owned by state-owned energy company Gazprom, showed a generated or manipulated video of Olexii Danilov, Secretary of Ukrainian Council for National Security, indirectly taking responsibility for the attack and promising more. The video was widely shared by Russian-language pro-Kremlin Telegram channels while a translated version spread widely on X, garnering over 38,000 views by the time of writing.
Figure 4: Manipulated video of Danilov showed by Russian TV channel NTV and shared on X.
German
German-language Russian state media outlet RT DE published several articles and social media posts supporting the Kremlin’s allegations. One article quoted Nikolay Patrushev, Secretary of the Russian National Security Council, blaming Ukraine for the attack; another referred to Alexander Bortnikov, the director of the Russian security service FSB, who claimed the Ukrainian secret service, SBU, played a role.
Figure 5: Articles published by RT DE. The headline on the left reads, “IS or Ukraine?” Russia knows the answer”. The headline on the right reads, “FSB head Bortnikov: Ukrainian secret service SBU should be designated as terrorist organisation”.
On Facebook, RT DE shared a translation of an article published by Russian state news agency RIA, which claimed without evidence that US and UK secret services masterminded the attack.
Figure 6: Facebook post by RT DE. Translation: “Regardless of who the direct perpetrators of the terrorist attack are, there is every indication that the real masterminds are in the West – in London and Washington. It’s time that they too were brought to justice, says RIA columnist Irina Alksnis.”
Statements by Bortnikov and Patrushev were also picked up and translated by German-language pro-Kremlin and conspiracy Telegram channels, and spread across TikTok.
Figure 7: Statements by Patrushev (left) and Bortnikov (right) shared in German on Telegram and TikTok.
German-language pro-Kremlin Telegram channels echoed the official Kremlin line. Influencer Alina Lipp published several translations from Russian-language pro-Kremlin channels on her Telegram channel, which has over 187k subscribers. One post claims that the attackers were not really Islamists and that the real organisers had them send footage to Amaq, which “would publish anything”. The post received 82.5k views.
Figure 8: Telegram post by Alina Lipp claiming that material published by Amaq confirms that the perpetrators were not real Islamists.
Another post translated by Lipp from pro-Kremlin channel Readovka claimed that perpetrators were recruited by the SBU through the Ukrainian embassy in Tajikistan to incite ethnic hatred. The post received 158.5k views.
Figure 9: Telegram post by Alina Lipp claiming that Ukrainian embassy in Tajikistan recruited the perpetrators.
This narrative blaming Ukraine and the West for the attack was pushed on X by the pro-Kremlin covert operation known as Doppelganger, attributed by French authorities in 2023 to Russian companies Struktura and Social Design Agency. The operation impersonates mainstream media websites in order to gain credibility for its content. These claims appeared on a website impersonating German magazine Der Spiegel and other websites associated with Doppelganger.
Figure 10: Website impersonating Der Spiegel claims that Ukraine is linked to the terrorist attack in Moscow. The headline and subheader read, “Legalised Terrorism. The terrorist attack in Russia raises a question about cooperation between Ukraine and Islamist terrorist groups”.
Figure 11: The website “Grenzezank” claims that the attack is linked to the UK. The headline reads, “Terrorist attack in Moscow can have its roots in London”.
Figure 12: An X account sharing a link that redirects to one of the Doppelganger assets. The post reads “MI6 and Ukraine work together to spread fear and horror in Russia”.
Figure 13: Doppelganger X accounts sharing videos. The post on the left, showing Volodymyr Zelensky in Nazi uniform reads, “We have to stay strong against support of terrorism”. The post on the right showing Zelensky with Rishi Sunak reads, “This is tragical and heart-breaking. I cannot understand who could have been interested in this”.
Figure 14: Six different cartoons blame the UK and Ukraine for the attack in Moscow. They were all shared on X with identical German-language text which reads: “These criminal acts show once again that Western secret services are ready to support terrorists to achieve their political goals”.
Italian
In recent years, members of the Italian far-right have become increasingly aligned with Russia, particularly in support of Putin’s invasion of Ukraine. This alliance is evident on VK, where Italian far-right and anti-establishment groups actively propagate pro-Kremlin narratives regarding the conflict. These narratives portray Ukraine as filled with chaos, corruption and Nazism, making Putin’s military actions a necessity to protect Russian interests and Russian-speaking populations.
These communities seized on the Crocus City Hall attack, making adept use of VK and translated key messages to and from Russian. This has facilitated wider reach and engagement with Russian-speaking audiences while simultaneously operating beneath the mainstream radar.
The post below, translated into Italian, shows “a tearful and intelligent” Ukrainian who fears that if “God forbid, Ukraine is responsible for the Crocus City attacks” the war will be “unstoppable.” He urges Ukrainians to “wake up” and realise that their government has abandoned them to “self-destruct.”
Figure 15: A video message from a ‘Ukrainian’ translated into Italian on VK with 180 views.
Claims circulated on VK by the Italian far-right echo those made by Russian officials accusing Ukraine of orchestrating these attacks, with the perpetrators seen as hired guns. Some also suggest Western complicity, with particular focus on US involvement.
Figure 16: A meme on VK of President Zelensky presented as ‘Bin Ladensky’ implying a comparative kinship with Osama bin Laden and Islamist terrorism.
Another post on VK shares an interview with Putin ally and former Austrian Foreign Minister Karin Kneissl on a Russian TV show. In the clip, she claims that “ISIS have nothing to do with” the attack, stating instead that it resembles a contract killing by a state-sponsored organised crime group. The implication is that Ukraine, possibly with Western involvement, orchestrated the attack. Kneissl’s former role as a politician may serve to legitimise these claims with domestic audiences despite the ISKP’s statement claiming responsibility.
Figure 17: Karin Kneissl appears on Russian TV and declares that ISIS were not involved in the Crocus City attacks.
These assertions could also offer evidence of Russian supposed military success, suggesting that Ukraine and its Western allies are resorting to terrorism out of desperation or revenge. This strategy justifies the Kremlin’s aggressive stance, portraying Russia as a victim of provocations rather than the invader.
X has also served as a venue for Italian pro-Kremlin support. Alfio Krancic, illustrator, founder of right-wing Italian outlet Vox News and owner of the Facebook profile ‘NoIslamItalia’ (30k followers) continues to assert that the West was behind the terror attacks.
Figure 18: (Left) A satirical illustration posted on X stating ‘We, ISIS, claim responsibility for the Moscow attacks’ whilst dressed in the US, UK, Ukrainian and Israeli flags. (Right) Krancic claims on X that Ukraine has arranged safe passage for the perpetrators of the Crocus City attacks.
This position is shared by Moscow-based Amadeo Avondet, publisher of the pro-Kremlin news site Il Corrispondente. Avondet receives airtime on national television and reports in mainstream outlets such as La Repubblica, lending legitimacy to his claims that “only Ukraine could carry such a heinous attack” and that “all roads lead to Kiev”.
Figure 19: Three X posts which demonstrate the reach of Avondet’s audience through mainstream media shows, ‘L’aria che tira’, on TV channels such as Canale 5 and LA7, and his statement that Ukraine is behind the attacks covered by La Repubblica.
This dissemination of disinformation on VK and other social media platforms by Italian far-right and anti-establishment actors highlights a broader strategy to support pro-Kremlin positions and strengthen divisive narratives. It fits into a persistent pattern of disinformation and ideological mobilisation via social media, with VK previously used to spread COVID misinformation, organise anti-Green Pass (COVID-19 pass) protests and foment anti-NATO sentiment.
Conclusion
A variety of state and non-state actors predictably instrumentalised the attack on Crocus City Hall rapidly to reinforce existing beliefs and advance geopolitical objectives. Social media platforms are chaotic information ecosystems in the aftermath of an attack, providing fertile ground for conspiracy theories and disinformation to flourish.
Pro-Kremlin actors have found an opportunity to blame Ukraine and the West for a horrific loss of human life, painting their opponents as monstrous manipulators who will stop at nothing to undermine Russia. This in turn embellishes Moscow’s credentials as a protector of human rights and undergirds the necessity of its ongoing invasion of Ukraine.
