Eleven people have been detained after gunmen stormed a concert hall in Moscow and opened fire on the crowd, the head of Russia's Federal Security Service told President Vladimir Putin on Saturday.
At least 137 people were killed in the attack, including three children, Russian authorities said, warning that the death toll was likely to continue rising.
ISIS claimed responsibility on its official Telegram channel for the assault, saying its fighters “attacked a large gathering” on the outskirts of the Russian capital.
Russia's Investigative Committee said four people among those detained were directly involved in the attack.
They were stopped in the Bryansk region of western Russia, “not far from the border with Ukraine”, it said.
In a televised address, Mr Putin said 11 people had been detained, including the four gunmen.
"They tried to hide and moved towards Ukraine, where, according to preliminary data, a window was prepared for them on the Ukrainian side to cross the state border," he said.
Ukrainian military intelligence spokesman Andriy Yusov denied that Ukraine was involved in the terror attack.
"Ukraine is defending its sovereignty from Russian invaders, liberating its own territory and is fighting with the occupiers’ army and military targets, not civilians," Mr Yusov said.
Alexander Khinshtein, a Russian politician, said the attackers had fled in a Renault vehicle that was spotted by police in Bryansk on Friday night and that disobeyed instructions to stop.
Mr Khinshtein said a pistol, a magazine for an assault rifle, and passports from Tajikistan were found in the car. Tajikistan is a mainly Muslim Central Asian state that used to be part of the Soviet Union.
A Tajik spokesperson told Tass on Saturday that Dushanbe and Moscow are in contact about the alleged involvement of Tajik citizens.
Russian Security Council Secretary Nikolai Patrushev, a leading ally of President Vladimir Putin, said that those responsible for the concert attack would be punished, Tass reported.
Mr Patrushev said the attack showed the threat the terrorism presents to Russia.
At least two explosions were heard at the venue, Crocus City Hall, on the western edge of Moscow, where hundreds of fans had gathered for a concert by Russian rock band Picnic.
Videos posted on Russian messaging apps showing huge plumes of black smoke rising over the building.
'Huge tragedy'
Moscow Mayor Sergei Sobyanin described the attack as a “huge tragedy”.
About 100 people were evacuated by rescue services from the basement of the venue as riot police were deployed to the area.
Intense gunfire could be heard in several videos shown by Russian media and posted to Telegram channels.
One video showed two men with rifles moving through the venue, while another showed a person inside the auditorium saying the assailants had set it on fire, as gunshots rang out in the background.
Guards at the concert hall did not have guns and some might have been killed at the start of the attack, Russian media reported.
Some Russian news outlets suggested that the assailants fled before special forces and riot police arrived.
Dozens of ambulances took the injured to the Sklifosovsky emergency care institute in Moscow.
A helicopter helped tackle the fire at the concert venue, Tass reported.
All large-scale sporting, cultural and other public events will be cancelled in Moscow this weekend, Mr Sobyanin said.
Security measures at Moscow airports and railway stations are being increased.
Senior Russian security official and ex-president Dmitry Medvedev said on Friday that the gunmen behind the attack should be hunted down and killed.
“All of them must be found and ruthlessly destroyed as terrorists,” Mr Medvedev, deputy chairman of Russia's Security Council, said on his official Telegram account.
A statement by Ukraine's Ministry of Foreign Affairs strongly rejected involvement in the attack, and said such accusations were “a planned provocation by the Kremlin”.
The statement also claimed that Russia has a “long history of bloody provocations by its special services”.
“There are no red lines for Putin's dictatorship,” it added.
The UAE's Ministry of Foreign Affairs stated its “strong condemnation of these criminal acts and its permanent rejection of all forms of violence and terrorism”.
The French Foreign Ministry said its thoughts were with the victims and the Russian people in a post on X on Friday evening.
It called the images out of Moscow “terrible” and said that “light must be shed on these odious acts”.
French President Emmanuel Macron, in a statement, said he “firmly condemns this terrorist attack” and said France stood in solidarity with the victims.
“The images are just horrible,” US National Security Council spokesman John Kirby said.
“Our thoughts obviously are going to be with the victims of this terrible, terrible shooting attack. This is going to be a tough day, so our thoughts are with them.”
The attack followed a statement issued earlier this month by the US embassy in Moscow that urged Americans to avoid crowded places in the Russian capital, including concerts, in view of “imminent” plans by extremists to attack large gatherings.
The warning was repeated by several other western embassies.
President Putin, who secured another six years in office in the March 15-17 elections, this week denounced the western warnings as an attempt to intimidate Russians.
Mr Putin was informed in the first minutes of the attack and was regularly being updated, the Kremlin said.
“The president constantly receives information about what is happening and about the measures being taken through all relevant services. The head of state gave all the necessary instructions,” Kremlin spokesman Dmitry Peskov said.
