The suburban Moscow music hall where gunmen opened fire on concertgoers was a blackened, smoldering ruin Saturday as the death toll in the attack surpassed 130 and Russian authorities arrested four suspects. President Vladimir Putin claimed they were captured while fleeing to Ukraine.

Kyiv vehemently denied any involvement in Friday’s assault on the Crocus City Hall music venue in Krasnogorsk, and the Islamic State group’s Afghanistan affiliate claimed responsibility.

Putin did not mention IS in his speech to the nation, and Kyiv accused him and other Russian politicians of falsely linking Ukraine to the assault to stoke fervor for Russia’s war in Ukraine, which recently entered its third year.

U.S. intelligence officials confirmed the claim by the IS affiliate.

“ISIS bears sole responsibility for this attack. There was no Ukrainian involvement whatsoever,” National Security Council spokeswoman Adrienne Watson said in a statement.

The U.S. shared information with Russia in early March about a planned terrorist attack in Moscow and issued a public warning to Americans in Russia, Watson said.

Putin said authorities detained a total of 11 people in the attack, which also wounded more than 100. He called it “a bloody, barbaric terrorist act”. He said Russian authorities captured the four suspects as they were trying to escape to Ukraine through a “window” prepared for them on the Ukrainian side of the border.

Russian media broadcast videos that apparently showed the detention and interrogation of the suspects, including one who told the cameras he was approached by an unidentified assistant to an Islamic preacher via a messaging app and paid to take part in the raid.

Russian news reports identified the gunmen as citizens of Tajikistan, a former Soviet republic in Central Asia that is predominantly Muslim and borders Afghanistan. Up to 1.5 million Tajiks have worked in Russia and many have Russian citizenship.

Tajikistan’s foreign ministry, which denied initial Russian media reports that mentioned several other Tajiks allegedly involved in the raid, did not immediately respond to a request for comment about the arrests.

Many Russian hard-liners called for a crackdown on Tajik migrants. Still, Putin appeared to reject the idea, saying, “No force will be able to sow the poisonous seeds of discord, panic or disunity in our multi-ethnic society.”

He declared Sunday a day of mourning and said additional security measures were imposed throughout Russia.

The number of dead stood at 133, making the attack the deadliest in Russia in years. Authorities said the toll could still rise.

The raid was a major embarrassment for the Russian leader and happened just days after he cemented his grip on the country for another six years in a vote that followed the harshest crackdown on dissent since the Soviet times.

Some commentators on Russian social media questioned how authorities, who have relentlessly suppressed any opposition activities and muzzled independent media, failed to prevent the attack despite the U.S. warnings.

The assault came two weeks after the U.S. Embassy in Moscow issued a notice urging Americans to avoid crowded places in view of “imminent” plans by extremists to target large Moscow gatherings, including concerts. Several other Western embassies repeated the warning. Earlier this week, Putin denounced the warning as an attempt to intimidate Russians.

Investigators on Saturday combed through the charred wreckage of the hall for more victims. Russia’s health ministry said hundreds of people stood in line in Moscow to donate blood and plasma.

Putin’s claim that the attackers tried to flee to Ukraine followed comments by Russian lawmakers who pointed the finger at Ukraine immediately after the attack.

Ukrainian President Volodymyr Zelenskyy angrily rejected Moscow’s accusations as an attempt by Putin and his lieutenants to shift the blame to Ukraine while treating their own people as “expendables.”

“They are burning our cities — and they are trying to blame Ukraine,” he said in a statement on his messaging app channel. “They torture and rape our people — and they blame them. They drove hundreds of thousands of their terrorists here to fight us on our Ukrainian soil, and they don’t care what happens inside their own country.”

Images shared by Russian state media showed emergency vehicles still gathered outside the ruins of the concert hall, which could hold more than 6,000 people and hosted many big events, including the 2013 Miss Universe beauty pageant that featured Donald Trump.

On Friday, crowds were at the venue for a Russian rock band Picnic concert.

Videos posted online showed gunmen in the venue shooting civilians at point-blank range. Russian news reports cited authorities and witnesses as saying the attackers threw explosive devices that started the fire, which eventually consumed the building and caused its roof to collapse.

Dave Primov, who survived the attack, told the AP that the gunmen were “shooting directly into the crowd” in the front rows. He described the chaos in the hall as concertgoers raced to escape: “People began to panic, started to run and collided with each other. Some fell down and others trampled on them.”

After he and others crawled out of the hall into nearby utility rooms, he said he heard pops from small explosives and smelled burning as the attackers set the building ablaze. When they exited the massive building 25 minutes later, it was engulfed in flames.

“Had it been just a little longer, we could simply get stuck there in the fire,” Primov said.

Messages of outrage, shock and support for the victims and their families streamed in from around the world.

White House press secretary Karine Jean-Pierre said in a statement that the U.S. condemned the attack and noted that the Islamic State group is a “common terrorist enemy that must be defeated everywhere.”

IS, which lost much of its ground after Russia’s military action in Syria, has long targeted Russia. In a statement posted by the group’s Aamaq news agency, IS’s Afghanistan affiliate said it had attacked a large gathering of “Christians” in Krasnogorsk.

The group issued a new statement Saturday on Aamaq, saying the attack was carried out by four men who used automatic rifles, a pistol, knives, and firebombs. It said the assailants fired at the crowd and used knives to kill some concertgoers, casting the raid as part of IS’s ongoing war with countries that it says are fighting Islam.

In October 2015, a bomb planted by IS downed a Russian passenger plane over Sinai, killing all 224 people on board, most of them Russian vacation-goers returning from Egypt.

The group, which operates mainly in Syria and Iraq but also Afghanistan and Africa, has claimed several attacks in Russia’s volatile Caucasus and other regions in the past years. It recruited fighters from Russia and other parts of the former Soviet Union.

The group’s Afghanistan affiliate is known variously as ISIS-K or IS-K, taking its name from Khorasan Province. This region covered much of Afghanistan, Iran and Central Asia in the Middle Ages.

The affiliate has thousands of fighters who have repeatedly carried out attacks in Afghanistan since the country was seized in 2021 by the Taliban, a group with which they are at bitter odds.

ISIS-K was behind the August 2021 suicide bombing at Kabul airport that left 13 American troops and about 170 Afghans dead during the chaotic U.S. withdrawal. They also claimed responsibility for a bomb attack in Kerman, Iran, in January that killed 95 people at a memorial procession.

On March 7, just hours before the U.S. Embassy warned about imminent attacks, Russia’s top security agency said it had thwarted an attack on a synagogue in Moscow by an IS cell and killed several of its members in the Kaluga region near the Russian capital. A few days before that, Russian authorities said six alleged IS members were killed in a shootout in Ingushetia, in Russia’s Caucasus region.