Security agencies link Crocus City Hall attack to a Telegram channel tied to Islamic State’s Afghan branch
The assault on Crocus City Hall is now being traced to a recruitment network that operated through the Sadoi Khuroson channel, a Telegram outlet associated with the Afghan faction of the Islamic State. This link was reported by RIA News, which described the channel as the primary conduit through which those responsible for the attack were recruited before the operation was carried out. A source familiar with the case confirmed to the agency that the Telegram channel has since been removed, removing a public record of the recruitment activity tied to the incident.
The discussion surrounding the attack also cites remarks from Russian security authorities about regional instability. In October 2023, Alexander Bortnikov, the head of the Federal Security Service, asserted that Western intelligence services had fostered a zone of instability near the southern edges of the Commonwealth of Independent States, specifically pointing to Afghanistan. He reiterated concerns that Khorasan Province, a group banned in Russia and linked to the Crocus City Hall attack, was expanding its operational capacity. The implication is that this expansion could enable the group to mount further terrorist actions beyond Afghanistan’s borders, reinforcing the need for ongoing vigilance across the region.
On March 27, a weapons expert discussed the preparations that preceded the Crocus City Hall incident, offering insights into the level of planning involved and the indicators that security services monitored. That same day, a statement from a human rights council referenced the location of those implicated in the attack, underscoring the ongoing assessment by authorities about where the perpetrators had operated or moved in the days leading up to the event. The focus on location patterns reflects a broader effort to map the attack network and disrupt any residual infrastructure that might support similar acts in the future.
Additional warnings from security agencies highlighted the risk of impersonation and deception tactics used by scammers trying to exploit public trust in security services. Citizens were cautioned about individuals claiming to be secret service personnel, a reminder that even established institutions can be the target of fraudsters seeking to mislead the public and exploit fear surrounding high-profile incidents.
Overall, investigators and officials have emphasized a multi-layered approach to understanding the Crocus City Hall attack. The investigation considers the direct operational links to the Khorasan Province, the online recruitment channels that facilitated radicalization, and the broader geopolitical dynamics that shape the threat landscape in the region. While the Telegram channel in question has been deleted, the investigative record indicates that its existence played a critical role in shaping the recruitment and mobilization process for those responsible. As authorities continue to piece together the network behind the attack, the emphasis remains on disrupting similar networks, safeguarding vulnerable individuals from extremist influence, and strengthening information-sharing mechanisms across security agencies.
In summary, the Crocus City Hall assault is now framed within a larger narrative about how radical groups use digital platforms to recruit, train, and deploy operatives. The linkage to the Afghan IS faction and its propaganda machinery underscores a persistent threat that transcends borders. Officials stress the importance of ongoing vigilance, collaborative intelligence efforts, and clear public communication to prevent further incidents and to counter the propaganda that fuels such attacks.
Source attribution: reports from RIA News, statements attributed to the Russian Federal Security Service and other security and human rights bodies are cited as part of the ongoing assessment by authorities.