Karolina Hird, Grace Mappes, Nicole Wolkov, Christina Harward, Angelica Evans, and Frederick W. Kagan

March 25, 2024, 6:15pm ET 

Click here to see ISW’s interactive map of the Russian invasion of Ukraine. This map is updated daily alongside the static maps present in this report.

Click here to see ISW’s 3D control of terrain topographic map of Ukraine. Use of a computer (not a mobile device) is strongly recommended for using this data-heavy tool.

Click here to access ISW’s archive of interactive time-lapse maps of the Russian invasion of Ukraine. These maps complement the static control-of-terrain map that ISW produces daily by showing a dynamic frontline. ISW will update this time-lapse map archive monthly.

Note: The data cut-off for this product was 12:45pm ET on March 25. ISW will cover subsequent reports in the March 26 Russian Offensive Campaign Assessment.

The March 22 Islamic State Khorasan (IS-K) attack on Moscow’s Crocus City Hall is a notable Russian intelligence and law enforcement failure, and explaining currently available open-source evidence does not require any wider and more complicated conspiracy theory either within or against the Russian state. Russian President Vladimir Putin claimed during an address on March 25 that “radical Islamists” committed the attack, but immediately and basely accused the United States of trying to cover the “Ukrainian trace” of the attack, directly accusing Ukraine of being the “customer” of the attack.[1] ISW continues to assess that the attack itself, as well as the claim pattern following the attack, is highly consistent with the way IS conducts and claims such incidents and has observed no evidence that Ukraine was involved in the attack.[2] Available open-source evidence indicates that the Crocus City Hall attack was the result of a significant Russian intelligence failure, not a conspiracy initiated by, or targeting, the Russian intelligence apparatus. Russian investigative opposition outlet Dossier Center reported on March 24 that Russian intelligence services were closely monitoring IS-K activities before the March 22 attack and alleged that the Russian Security Council received a warning that IS-K might use Tajik citizens for an attack in Russia a few days before IS-K carried out the attack on Crocus City Hall.[3] Dossier Center and other Russian insider and opposition outlets also noted that Russian law enforcement was very slow in responding to the incident and reported that security officers first arrived at Crocus City Hall an hour after the attack began, despite the fact that the Moscow Special Purpose Mobile Unit (OMON) headquarters is less than three kilometers away from the hall.[4]

Sources familiar with the US intelligence community previously noted that the United States warned Russia about “fairly specific” indicators that IS-K wanted to carry out attacks in Russia, and the US Embassy in Russia issued a warning on March 7 that it was monitoring reports of extremist plans to target large gatherings in Moscow, including concerts, over the proceeding 24 hour period.[5] Putin dismissed the warnings as “provocative statements” on March 19, three days before the attack.[6] The Kremlin’s acknowledgement of the US intelligence warnings prior to the attack shows that the Russian government was aware of US warnings, but likely discounted them. The United States also notably warned Iran about an IS-K attack against Iran ahead of the IS-K attack against Kerman on January 4, 2024, a warning that Iran also apparently disregarded.[7]

The responses by both the Russian intelligence apparatus and law enforcement agencies must be situated in the wider domestic Russian context. Russian intelligence could well have decided to ignore the US intelligence warning because of the extreme distrust of the United States Putin has driven deep into the Russian information and security spaces. Russian authorities may have also been concerned about the second-order effects of acting on the intelligence by seeming to target Muslim communities within Russia, which would likely cause even more discontent and alienation in a community that Russia already discriminates against yet relies on for the forcible generation of manpower for its war in Ukraine.[8] The Kremlin may have balanced the cost of acting on intelligence from an adversary it does not trust with the risk of impacting a critical source of mobilizable manpower and found the risk of action too great. Russian law enforcement, for its part, has likely been conditioned to respond to mass-casualty events such as the 2002 Moscow theater hostage crisis and 2004 Beslan School Siege, so the delay in Russian law enforcement’s deployment to Crocus City Hall may have resulted from conditioning about the need to proceed cautiously in what could have become a mass-hostage situation.[9] Those incidents evolved over the course of several days. Even during the 2015 attack on the Bataclan Theater in Paris the first armed responders did not enter the building until roughly 25 minutes after the attacker had begun shooting on the street but had to withdraw and wait about an hour and a quarter before sufficient backup arrived to start clearing the scene.[10]

Kremlin officials’ and Russian ultranationalists’ continued insistence on blaming Ukraine for an attack that IS-K very likely committed may come at the expense of Russian internal security and civilian lives. A Kremlin-awarded Russian ultranationalist milblogger doubled down on the narrative baselessly blaming Ukraine on March 24 and 25, widely amplifying other ultranationalist claims that IS and IS-K are incapable of conducting a terrorist attack as significant as the Crocus concert venue attack and that the IS claim is a ruse to hide Ukrainian and Western involvement.[11] Other Russian milbloggers further amplified this narrative, claiming that IS and IS-K are weakened and defeated and are now largely “media outlets.”[12] That assertion is demonstrably untrue, as CTP has repeatedly documented.[13] Russian Ministry of Foreign Affairs (MFA) Spokesperson Maria Zakharova accused the United States of making “excuses” for Ukraine in reporting that IS likely conducted the attack.[14] The IS claim of conducting the Crocus concert venue attack is notably consistent with prior IS-claimed attacks and IS risks discrediting itself in the global Salafi-Jihadi community by falsely claiming credit for high-profile attacks.[15] The Russian claims insisting on Ukrainian involvement, on the other hand, forward the Kremlin’s longstanding effort to justify its ongoing full-scale invasion of Ukraine in the long-term by falsely portraying the existence of an independent and sovereign Ukraine as an existential threat to Russia. The Kremlin and its ultranationalist mouthpieces are evidently ignoring the clear threat that IS and IS-K operations inside Russian territory poses to Russia’s internal security and its civilians to prioritize instead the informational impacts of falsely accusing Ukraine of involvement while also maintaining a level of access to the ethnic minority communities that may be vulnerable to recruitment by IS-K and similar groups in order to retain a mobilizable resource for the war in Ukraine. The Kremlin has likely decided that the informational value of blaming Ukraine for the Crocus attack is worth whatever internal security risks and civilian casualties Russia may suffer for failing to adequately address a radical Salafi-Jihadi threat within its borders.

The Russian Ministry of Defense (MoD) confirmed that Lieutenant General Esedulla Abachev became the Leningrad Military District (LMD) Deputy Commander as the Russian military continues the formal disbandment of the Western Military District (WMD) and recreation of the LMD and Moscow Military District (MMD). The Russian MoD posted footage on March 25 showing Abachev awarding personnel of the Russian state border covering group who arrested the Crocus City Hall attackers in Bryansk Oblast and named Abachev as the LMD Deputy Commander, confirming speculation by insider sources about Abachev’s new appointment in early March.[16] Russian sources credited LMD personnel, Russian Federal Security Service (FSB) border guards, and Chechen “Akhmat” personnel for arresting the Crocus City Hall attackers on March 23.[17] It is unclear why LMD personnel were operating in Bryansk Oblast in the first place, as Bryansk Oblast is part of the new MMD, but some individual units that are now part of the LMD may have been left over in Bryansk Oblast as military reforms and transitions are ongoing.[18] The Russian Western Grouping of Forces Spokesperson recently began wearing a MMD patch, suggesting that the process of disbanding and transferring the WMD is underway.[19] The process of transferring WMD formations into the MMD and LMD may cause some temporary confusion and inconsistencies, as evidenced by the presence of LMD personnel within the MMD during the Crocus City Hall arrests.

Ukrainian officials stated that the Ukrainian strike on occupied Sevastopol, Crimea on the night of March 23 targeted more Black Sea Fleet (BSF) ships and caused more damage than initially reported. Ukraine’s Main Military Intelligence Directorate (GUR) stated on March 25 that Ukrainian forces struck the BSF ship repair plant in Sevastopol where the Yamal Ropucha-class landing ship was moored on March 23, making a hole in the Yamal’s upper deck and forcing BSF personnel to continuously pump water out of the ship.[20] Ukrainian Navy Spokesperson Captain Third Rank Dmytro Pletenchuk stated that the March 23 Ukrainian strike on the BSF communications center caused substantial damage, which Pletenchuk assessed may significantly hinder the functioning of the BSF because the communications center supported the general activities of the fleet and may have also been responsible for the fleet’s provisions, ongoing repairs, and other important functions.[21] Pletenchuk reported that Ukrainian forces also struck the Ivan Khurs Yury Ivanov–class reconnaissance ship on March 23 and that Ukrainian officials are verifying the damage to the ship.[22] GUR Deputy Chief Major General Vadym Skibitskyi stated that Ukrainian forces used Ukrainian Maritime Autonomous Guard Unmanned Robotic Apparatus (Magura) V5 naval drones to strike the Ivan Khurs and Yamal ships and that these Ukrainian naval drones are becoming more powerful and accurate.[23] Skibitskyi stated that Ukrainian forces also used the Magura V5 drones to strike the BSF’s Akula-class and Serna-class ships in November 2023, the Ivanovets Tarantul-class corvette and the Ceasar Kunikov Ropucha-class landing ship in February 2024, and the Sergei Kotov large patrol ship in March 2024.[24] Pletenchuk and Ukrainian Southern Operational Command Spokesperson Colonel Nataliya Humenyuk stated that Russian forces have rarely used Kalibr missiles in recent months because the BSF naval base in Sevastopol is the only BSF base that has the infrastructure needed to reload these missiles onto Kalibr-capable ships.[25] ISW continues to assess that Ukrainian strikes against BSF ships and infrastructure will likely continue to deter Russian forces from redeploying ships to Sevastopol and the western Black Sea and complicate the BSF’s ability to maximize its combat capabilities.[26]

The Kremlin continues to lean on long debunked narratives as part of its wider information operations aimed at discrediting and undermining Western support for Ukraine. Russian Ambassador to the Hague Vladimir Tarabin reiterated the Kremlin’s debunked claim that Ukraine is developing biological weapons in US- and NATO-funded biolabs in Ukraine during an interview published on March 25.[27] Tarabin also claimed that Ukrainian forces are “systematically” using a “wide range of toxic chemicals” against Russian military personnel in unspecified areas of the frontline, including chemical substances banned by the Chemical Weapons Convention (CWC).[28] Tarabin’s reliance on the already discredited biolabs narrative calls into question his other allegations. An unnamed Russian company command also claimed that Ukrainian forces are using phosphorus ammunition shells in unspecified areas of the Zaporizhia direction, which are not banned in conventional warfare by the CWC but are prohibited from use against civilians.[29] Russian forces have used white phosphorus against urban areas in Ukraine, risking civilian harm on several occasions.[30] Kremlin officials, including Russian President Vladimir Putin, have been accusing the West of continuing to fund biolabs in Ukraine since before the Russian full-scale invasion of Ukraine.[31] Western publications, officials, and international organizations have long debunked this Russian narrative.[32] These Russian claims are not comparable to the Ukrainian and Russian reporting of Russian forces using chlorobenzylidenemalononitrile (CS) gas or chloropicrin (PS), both of which the CWC — which Russia ratified in 1997 — bans in warfare.[33] Several Russian and Ukrainian sources have provided evidence of the use of such banned chemical agents against Ukrainian positions on the battlefield.[34]

Key Takeaways:

• The March 22 Islamic State Khorasan (IS-K) attack on Moscow’s Crocus City Hall is a notable Russian intelligence and law enforcement failure, and explaining currently available open-source evidence does not require any wider and more complicated conspiracy theory either within or against the Russian state.
• Kremlin officials’ and Russian ultranationalists’ continued insistence on blaming Ukraine for an attack that IS-K very likely committed may come at the expense of Russian internal security and civilian lives.
• The Russian Ministry of Defense (MoD) confirmed that Lieutenant General Esedulla Abachev became the Leningrad Military District (LMD) Deputy Commander as the Russian military continues the formal disbandment of the Western Military District (WMD) and recreation of the LMD and Moscow Military District (MMD).
• Ukrainian officials stated that the Ukrainian strike on occupied Sevastopol, Crimea on the night of March 23 targeted more Black Sea Fleet (BSF) ships and caused more damage than initially reported.
• The Kremlin continues to lean on long debunked narratives as part of its wider information operations aimed at discrediting and undermining Western support for Ukraine.
• Russian forces recently made confirmed advances near Avdiivka on March 25.

https://www.understandingwar.org/backgrounder/russian-offensive-campaign-assessment-march-25-2024

Nice to see the Crimea naval attack also got the Ivan Khurs Yury Ivanov–class reconnaissance ship (https://en.wikipedia.org/wiki/Yury_Ivanov-class_intelligence_ship). Only launched in 2017, lets hope it puts a further hole in Russia's surveillance and command/control capabilities.  The ongoing significant activity in the Black Sea makes one wonder whether they have something planned for the area, maybe an end-run around the Dnipro river defences in Kherson, but more likely its just very effective application of scarce available resources, in pursuit of the long term goal of isolating Crimea from the sea once the land battle hopefully cuts off it's land access.  Whatever the goal, another great operation from the Ukrainian navy.