By Eva Maitland, McKenzie Sadeghi, and Macrina Wang | Published on March 27, 2024

Editor’s Note: This report first appeared in NewsGuard’s State-Sponsored Disinformation Risk Briefing.

Within hours of the March 22, 2024, terror attack at Moscow’s Crocus City Hall concert venue that left 139 people dead, Russian, Chinese, and Iranian state media outlets began advancing false claims to blame the attack on their Western adversaries, even after the militant jihadist Islamic State (IS) claimed responsibility.

Using a social media analytics tool, NewsGuard identified 150 articles from March 22 to March 26, 2024, in Russian, Chinese, and Iranian state media — many of which have publishing partnerships with each other — mentioning the “West” and the Moscow attack, demonstrating an apparent unified front in coverage.

While blaming the West was a common thread, the disinformation narratives appeared aimed primarily at domestic audiences, targeting specific adversaries — with Russia blaming Ukraine, Iran pinning the attack on the U.S. and Israel, and China hinting at U.S. responsibility.

For example, articles in Kremlin-controlled media primarily pointed the finger at Ukrainian President Volodymyr Zelensky, saying that the IS (also known as ISIS) statement claiming responsibility for the attack was fabricated by the West to cover for Ukraine as the real culprit — a claim that has been refuted by U.S. and Ukrainian authorities. Meduza (NewsGuard Trust Score: 95/100), a reliable Latvia-based news site that covers Russian politics, cited interviews with Russian state media employees to report that Russian publications were instructed by the government to emphasize “traces” of “Ukrainian involvement” in their coverage.

Iranian state media immediately pinned the attack on its longstanding enemy Israel, along with the U.S. An article from the state-run Iranian Students News Agency carried a cartoon of Israeli Prime Minister Benjamin Netanyahu carrying the IS flag, stating, “Western propaganda immediately points the responsibility to ISIS…Obviously, the role of the Zionist regime cannot be neglected in the recent crime.”

In China, official state media outlets were typically more reserved in directly blaming the U.S., although they did cast doubt on the U.S.’s assessment that IS was responsible for the attack and hinted that the U.S. has historically used terrorist organizations to further its aims. An article in Chinese state-run Global Times (Trust Score: 39.5/100) said, “Don’t forget the US has a history of using terrorist organizations to fight strategic enemies.”

There is no evidence that Ukraine, Israel, or the U.S. played a role in the attack. White House spokesperson John Kirby said during a briefing, “This was an attack carried out by ISIS-K operatives, period, end of sentence, end of story, no connection to Ukraine. And this is just more Kremlin propaganda.”

What follows is a country-by-country breakdown showing how Russia, Iran, and China exploited the Moscow attack to advance false or egregiously misleading narratives tailored to their own domestic and foreign policy interests.

RUSSIA: State Media Use Fake Video, Deepfake to Blame Moscow Attack on Ukraine

By Eva Maitland

Pro-Kremlin sources quickly sought to pin the blame for the deadly Moscow concert hall attack on Ukraine, even after the Islamic State (IS) took responsibility for the incident. The Kremlin propagandists shared altered videos, including a deepfake purporting to show senior Ukrainian officials admitting blame for the attack and poking holes in the authenticity of the IS statement.

“FAKE: Rumours ISIS Claim Responsibility For Terrorist Attack Are Unfounded,” RT India stated in a March 22, 2024, X post that generated 1,400 likes and interactions. The post claimed that the IS statement was “fake” as it “uses a news template that IS apparently abandoned many years ago.” Pro-Kremlin Telegram channels, RT editor Margarita Simonyan, Russian news site Gazeta.ru, and posts across Reddit and 4chan also dismissed the IS statement as fabricated.

In fact, the statement was confirmed by multiple credible media outlets, including CNN and The New York Times, and U.S. officials said they had intelligence confirming IS’s culpability. Amaq News Agency, which is affiliated with IS, also published a graphic video of the attack apparently filmed by one of the attackers, the Financial Times and other outlets reported.

On March 23, 2024, NTV, Russia’s second most popular TV channel, ran a video of Oleksiy Danilov, secretary of the National Security and Defense Council of Ukraine, in which Danilov appeared to say, “It’s fun in Moscow today, I think it’s very fun. I would like to believe that we will arrange such fun for them more often.” The clip was shared widely on social media, including on Telegram by Russian state TV host Olga Skabaeva, with some posts claiming that it showed that Danilov “basically confirmed Ukraine’s involvement in the terrorist attack.”

In fact, Ukraine’s Center for Combating Disinformation (CPD) said in a Telegram post that the footage was a deepfake. The CPD said that the deepfake was low quality and that Danilov’s “facial expressions and speech do not match at all.” (See NewsGuard’s Misinformation Fingerprint on this claim here.) The video was created using old footage of Danilov manipulated using AI to put words in his mouth, Italian fact-checker Open.Online found.

Social media users created a false impression by sharing footage of an authentic interview with Kyrylo Budanov, chief of the Main Directorate of Intelligence of Ukraine, in which an ABC News interviewer asked Budanov about his reaction to the events. “I’m very glad to see this,” Budanov responded, stating that similar events were likely to continue “deeper and deeper” inside Russia. In fact, the interview was from January 2023, and Budanov was actually talking about a strike on a Russian air force base, not about the Moscow attack. (See NewsGuard’s Misinformation Fingerprint here.)

“CIA asset and Ukrainian spy chief Budanov threatens more terror attacks deep inside of Russia,” said a March 25, 2024, X post by pro-Kremlin disinformer @KimDotcom, which was reshared nearly 3,000 times before it was deleted by the account just hours after it was posted. “This is who Western leaders are supporting and where your tax money is going.”

“Budanov” trended on X on March 25, 2024, as users shared the false claim. On March 25, 2024, there were 750 social media posts mentioning “Budanov” and “glad to see,” according to a social media analytics tool.

Pro-Kremlin sources also falsely claimed that a white van at the scene of Crocus City Hall attack carried a Ukrainian license plate. In fact, as first noted by open-source intelligence analyst Oliver Alexander on X, the plate is Belarusian. (See NewsGuard’s Misinformation Fingerprint here.) Nevertheless, the false license plate narrative generated millions of views across platforms, including X, Telegram, Facebook, and Instagram, and was shared by Russian state TV host Vladimir Solovyov.

IRAN: U.S. Warning of Moscow Attack Spurs Iranian Claims of Western Involvement

By McKenzie Sadeghi

Iran’s state media took aim at the U.S. and Israel following the Moscow concert hall attack, claiming the advanced warning from the U.S. embassy in Moscow about imminent extremist threats to large gatherings of people in Russia is evidence that the West orchestrated the terrorist incidents.

An article in Iranian state-run Tasnim News Agency (Trust Score: 7.5/100) — which is linked to Iran’s Islamic Revolutionary Guard Corps and has a partnership agreement with Russian state media — said that the U.S. embassy warning about potential extremist attacks “strengthens the speculations for the involvement of Western countries in the Moscow incident.”

An article from Iran’s flagship Islamic Republic News Agency (Trust Score: 7.5/100) said that “anti-security projects by actors such as the United States and Israel” provide IS with “the intelligence and operational support for these actors to commit bloody terrorist attacks in various countries from Iran to Russia.” The article added that the U.S advance warning “greatly strengthens the hypothesis” that the attack took “place in the framework of supporting Israel and punishing Russia for its position in supporting the Palestinian cause.”

There is no evidence that the U.S. or Israel played a role in the Moscow terror attacks, and Iran did not provide any evidence to support its claim. Moreover, it is common for the U.S. to warn other countries, even adversaries such as Russia, of potential attacks under its “Duty to Warn” policy, which is “a requirement to warn U.S. and non-U.S. persons of impending threats of intentional killing, serious bodily injury, or kidnapping.”

Indeed, ahead of the January 2024 IS suicide bombings in the southeastern town of Kerman, which Iran falsely blamed on the U.S. and Israel (see NewsGuard’s Misinformation Fingerprint here), the U.S. issued a confidential alert to Iran warning that IS was planning to carry out a terrorist attack, according to The Wall Street Journal (Trust Score: 100/100).

In a March 22, 2024, X post, National Security Council spokeswoman Adrienne Watson said, “The U.S. Government … shared this information with Russian authorities in accordance with its longstanding ‘duty to warn’ policy.”

CHINA: After Russia Concert Hall Attack, Chinese Official Claims U.S. Created the Islamic State

By Macrina Wang

Days after an Islamic State (IS) affiliate group claimed responsibility for the Moscow attack, a Chinese government official shared a video to claim that the U.S. created the militant jihadist organization, implying that the U.S. played a role in the Moscow slaughter.

The video showed a 2017 interview by Russian state outlet RT (Trust Score: 20/100), in which an American journalist and author named Paul L. Williams said that IS (also known as ISIS) is a “CIA creation” and that “we still direct them.” Xue Jian, the Chinese Consul General for Osaka, shared the video on March 25, 2024, and stated on X in Japanese, “A CIA agent who proudly confesses on a TV program that ‘ISIS was created by us’ has no sense of guilt at all! These guys are comfortable committing crimes no matter how bloody they are…”

However, contrary to Xue’s claims, Williams has never claimed to be a CIA agent. His government experience is limited to his time as a self-described former consultant for the FBI, advising the agency on organized crime and terrorism, according to his Facebook page. Williams has a history of making baseless claims about terrorist activity, including that al-Qaeda members stole radioactive material from McMaster University in Ontario. The Canadian Nuclear Safety Commission dismissed the claim as “false,” the Nashville Post (Trust Score: 92.5/100) reported.

The baseless narrative that the U.S. created IS has been spread online for years. In fact, there is no evidence that the United States created IS or that it controls the group. The organization grew out of other groups that can be traced to a radicalized Jordanian national, according to experts. (See NewsGuard’s Misinformation Fingerprint on the claim here.)

The claims emerged again on Chinese social media in the wake of the Moscow attack. For example, some commentators claimed that former President Donald Trump’s 2016 reference to former President Barack Obama as the “founder of ISIS” were actually made after the recent terrorist attack. A March 2024 article on Chinese platform 163.com said in Chinese, “In response to the terrorist attack at the Moscow concert hall in Russia, former U.S. president and presidential candidate Donald Trump made a public statement. Trump said Obama was the founder of the Islamic State.”

Trump had indeed inaccurately alleged that Obama and former Secretary of State Hillary Clinton founded the Islamic State, but he did so eight years prior to the concert hall shooting. After news outlets debunked his remarks at the time, Trump backpedaled, saying his comment was “sarcastic,” but also “not that sarcastic.”