By Andrew Korybko, Substack, 3/24/24

Speculation has swirled since Friday night’s terrorist attack at the Crocus City Hall venue in Moscow over whether ISIS-K was really responsible like the group claimed or if Ukraine’s military-intelligence service GUR orchestrated everything under the cover of its agents posing as members of that group. The Mainstream Media is running with the first scenario while doing their utmost to discredit the second, but recalling the GUR’s terrorist history and ties with radical Islamists shows that it’s not above suspicion.

They were responsible for assassinating Darya Dugina in summer 2022, carrying out the Crimean Bridge truck bomb attack that fall, assassinating Vladlen Tatarsky in spring 2023, and the cross–border terrorist raids by the so-called “Russian Volunteer Corps” over the past year. They’re also tied to Crimean Tatar terrorists and ISIS-linked Chechen ones. The CIA is connected with these terrorist acts and groups too after the Washington Post reported last fall that they rebuilt the GUR from the ground-up after 2014.

The modern-day GUR is a product of the CIA, which certainly shared with its protégés everything that it learned while waging the ongoing Hybrid War on Syria, not to mention their terrorist contacts as well. It was through this meticulous cultivation that GUR chief Kirill Budanov obtained his bloodlust that was on full display last spring when he declared that “we’ve been killing Russians and we will keep killing Russians anywhere on the face of this world until the complete victory of Ukraine.”

For as lethal as the GUR has become over the past decade, it’s still a CIA knockoff, which is why it’s expected to make sloppy mistakes from time to time. This is relevant when it comes to the latest attack after ISIS-K claimed responsibility using an outdated news template, thus suggesting that someone else claimed credit in their name at first but then ISIS-K opportunistically ran with it for clout. Considering its terrorist history and ties with radical Islamists, that mysterious actor was arguably the GUR.  

What likely happened is that their agents posed as members of that terrorist group in order to retain plausible deniability in case the planned attack was foiled or the terrorists were caught afterwards. One of the Tajiks who was captured in the car that was racing towards the Ukrainian border claimed that they were recruited by the curators of a radical Telegram channel just a month ago to carry out the attack using already cached arms in exchange for a debit card payment of around $5000 each.

These nationals were probably chosen by the GUR since some of them are predisposed to religious radicalism due to the lingering legacy of Tajikistan’s Islamist-inspired civil war from the 1990s, their country abuts ISIS-K’s Afghan headquarters, and they have visa-free travel privileges to Russia. Accordingly, they were allegedly recruited via a radical Telegram channel, ISIS-K’s involvement doesn’t seem entirely implausible, and they were able to easily enter Russia with minimal scrutiny.

They weren’t radical enough to go out with guns blazing or in a suicide blast like ISIS-K is known for, however, but were still sufficiently sympathetic with that group’s ideology to carry out what they believed was its latest mission in exchange for money. This explains why they fled from the scene of the crime, which is contrary to what any affiliate of that group would ever do, after machine-gunning dozens of people and setting fire to the venue.

Had they reached Ukraine, where the FSB confirmed that they had contacts and President Putin said that “a window was prepared for them…to cross over”, then they’d likely have been killed by the GUR to cover everything up. It shouldn’t be forgotten that this group learned how to conduct terrorism from the CIA, which in turn perfected this practice in Syria over the past 13 years of the Hybrid War that it’s been waging there, but the GUR is still a knockoff and that’s why they made three sloppy mistakes.

In the order that they occurred, their first mistake was recruiting people who weren’t ready to fight to the death at the scene of their forthcoming terrorist attack. This led to the culprits being captured and spilling the beans about how they were recruited in exchange for money, which is one of the signs that ISIS-K wasn’t behind what happened since their members always expect to die as “martyrs”. Accordingly, the fact that this mistake was made suggests that the GUR was desperate to go through with their plans.

The second mistake was that they didn’t tell their proxies to flee to a safe house right after the attack to meet a contact that’ll then help them reach the border later on but who’d actually kill them once they meet in order to cover everything up. This led to them racing towards the Ukrainian border, thus showing everyone that they at the very least felt that they’d find sanctuary there, which made Russia’s claim of Ukrainian involvement much more believable for many skeptical Westerners.

And finally, the last mistake was that the GUR used an outdated news template to claim credit for the attack on behalf of ISIS-K, who they correctly predicted would opportunistically run with it for clout. By doing so, however, they signaled that the group itself didn’t play a role in organizing what happened otherwise their more modern template would have been used instead. Taken together, these three sloppy mistakes discredited the Mainstream Media’s narrative and drew attention to the GUR instead.

Coupled with its terrorist history and ties with radical Islamic groups, which respectively prove that it has the capabilities and intent to carry out the Crocus attack as well as the knowledge required to impersonate extremists online for recruiting purposes, all of this makes the GUR the prime suspect. It learned everything about terrorism from the CIA, but since it’s still a knockoff, it made a series of sloppy mistakes that resulted in incriminating Ukraine instead of lending false credence to the ISIS-K narrative.