Sitrep for March 22-25, 2024 (as of 9:30 a.m. UTC+3)
Frontline Situation Update
On the Donetsk axis, Russian forces have advanced slightly along the railway west of the town of Bakhmut, in the area of Ivanivske and Chasiv Yar. The latest video shows a Russian BMP IFV bringing infantry to an area near forest lines, geolocated approximately half a kilometer [0.3 mi] from the outskirts of Chasiv Yar, an important logistics center of the Armed Forces of Ukraine.
Ukrainian and Russian Strikes
Over the past few days, the Russian Armed Forces have continued their strikes on the territory of Ukraine. On the morning of March 24, another massive combined missile and loitering munition attack was launched. The attack mainly targeted critical infrastructure facilities, especially in the western part of Ukraine, with a strike reported in the Lviv region. Oleksiy Chernyshov, the Head of the Board of Naftogaz [the largest national oil and gas company of Ukraine], stated that a number of his company’s facilities were damaged.
The reason for such attacks remains unclear, given that the heating season is actually over. However, there is a possibility that these attacks are a retaliation for the Ukrainian attacks on Russian oil refineries or the Belgorod region.
In turn, Ukraine continues its drone attacks targeting Russian oil refineries. On the night of March 23, the Kuibyshev oil refinery in the Samara region was hit, and on the morning of the same day drones attacked an oil refinery in Saratov. It is impossible to reliably assess the extent of the damage, but in both cases, the UAV strikes caused fires at the sites of impact.
Additionally, on the night of March 25, the Novocherkassk State District Power Plant in the Rostov region was hit by kamikaze drones, as a result of which two power units were taken out of operation.
On the night of March 24, Ukraine launched a massive attack on occupied Crimea. Due to the use of a large number of missiles and drones, the air defense system was overwhelmed. One of the targets in Sevastopol was reportedly a large communication hub of the Russian Black Sea Fleet, with satellite images showing damage to a building.
Hits were also recorded at an oil depot in the village of Hvardiiske, Simferopol district, with videos and photos showing smoke from a large fire.
Additionally, two landing ships, Yamal and Azov, and possibly the reconnaissance ship Ivan Khurs, were hit in Sevastopol Bay. Satellite images suggest that the landing ships did not sustain significant damage, while there is no visual data yet available for the reconnaissance ship.
The UK has announced a new military aid package for Ukraine, including over 60 million pounds [$75 million] for modern unmanned systems, whether aerial or maritime is not specified, and 20 million pounds [$25 million] for the supply of air defense systems. It is worth noting that recent Russian advances on the frontline have been attributed, in part, to Ukraine's lack of air defense systems and missiles.
Two members of the Tsapok gang, who were sentenced to 20 years in 2010 for mass murder in the village of Kushchyovskaya, Krasnodar region, were granted a presidential pardon for participating in the war as Wagner group mercenaries. Another member of the gang was probably killed in the war. Further details are covered in our mobilization summary.
Crocus City Hall Terrorist Attack
The main topic dominating headlines in recent days is the terrorist attack that occurred on the evening of March 22 at the Crocus City Hall music venue near Moscow.
Our team has closely monitored the Russian military operation in Syria, which began in 2015. While initially mostly targeting forces opposed to Bashar al-Assad’s regime, including the Free Syrian Army, over time, Russian strikes have increasingly targeted the Islamic State in Syria. Consequently, we have been studying ISIS’s patterns of behavior and the terrorist attacks they have carried out throughout the world for a number of years. During this period, we established numerous contacts with Western terrorism experts, such as Elizaveta Tsurkova, who was abducted in Iraq in 2023 and unfortunately remains captive to this day. To help our analysis, we maintain a list of Twitter accounts of experts who have long been studying the issue of Islamist groups.
In our view, the recent Moscow terrorist attack more closely resembles the 2015 Paris Bataclan concert hall attack, rather than the 2002 Moscow theater hostage crisis. In both 2015 and 2024, IS terrorists started shooting people indiscriminately, without making any specific demands, while in 2004, hostages were taken and a demand to end the war in Chechnya was formulated by the terrorists.
The Insider, an independent Russian investigative media outlet, has concluded, after analyzing available photos and videos of the terrorists, that the Federal Security Service (FSB) detained the same individuals who were captured on video at the Crocus City Hall and in the photo published by the Islamic State—Khorasan Province (IS-KP).
Contrary to various reports and versions, we did not find any evidence supporting the claim that there were more than four terrorists. Dashcam footage, capturing the moment when the terrorists exited the car and headed towards the building entrance, shows the car's blinkers flashing, which we interpret as the car’s alarm being activated, indicating that no one was left in the car. Additionally, we counted four people getting back into the car in the video showing the terrorists returning to their vehicle.
Based on footage from law enforcement officers and information from various media outlets reconstructing the timeline of the terrorist attack, one of the terrorists was apprehended during the nighttime while attempting to hide in a tree, and another one was captured in the morning. The remaining two, apparently, were captured in between. According to Izvestia [The News, a Russian pro-Kremlin daily broadsheet newspaper and a news channel], the first arrest occurred at 11:30 p.m. on March 22, and the second, according to Alexander Khinshtein, a member of the State Duma [lower house of Russia's Federal Assembly], at 3:50 a.m.
The terrorists were moving along the M3 highway and were stopped in the Bryansk region. Initially, the location of the arrest was announced as the village of Tyoply on the border with Belarus, but later it was geolocated to the area of the village of Khatsun, near the village of Tyoploe (this location is closer to the border with Ukraine than to the border with Belarus and is on the road to the former but not the latter). According to Google Maps, the drive from Crocus City Hall to this village takes just over four hours on a typical Friday evening, assuming compliance with speed limits. For the confrontation with law enforcement officers to occur at 11:30 p.m. on the 376th kilometer [234 mi from Moscow] of the M3 highway (and the car, as claimed, was spotted speeding at the 291st kilometer [180 mi from Moscow]), the terrorists indeed must have been driving at high speed.
A photographer working at Crocus City Hall on March 7 took a photo of one of the suspects during another event. He was identified by his clothing, which was compared to photos on social media. Presumably, he was surveying the building in preparation of the attack.
Additionally, on March 7, the US Embassy issued a warning about the threat of terrorist attacks during large gatherings in Moscow, including concerts. The US intelligence community operates under the principle of “duty to warn,” according to which they must report on impending attacks and acts of terror even in cases when such acts are planned against a state hostile to the US. For instance, following this principle, the US warned Iran about an impending attack in Kerman. On Jan. 3, 2024, during a ceremony commemorating the anniversary of the assassination of General Soleimani at a city cemetery, two bombs were detonated, resulting in at least 94 casualties. These warnings were ignored by Iranian authorities.
On March 23, a faction of IS-KP based in eastern Afghanistan claimed responsibility for this terrorist act. On March 24, the IS propaganda media Amaq News Agency released a video made by one of the terrorists during the attack. This faction was founded by two defectors from the Taliban movement, Hafiz Saeed Khan and Abdul Rauf Aliza, who believed that the Taliban were not radical enough and misunderstood certain norms of Islamic law. It is worth noting that Russia does not consider the Taliban a terrorist organization and maintains friendly relations with the group.
When American troops were present in Afghanistan, they, along with government forces, fought against the group, which at the time was estimated to have 1,500 to 2,000 members. During the withdrawal of US troops, as the Taliban took control, they quickly seized territories and released militants from prisons, leading to a sharp increase in the number of IS-KP members. During the final stages of the US withdrawal from Afghanistan in 2021, a suicide bomber from IS-KP carried out an attack near Kabul airport, resulting in the deaths of 170 civilians and 13 American servicemen.
Fighters from various terrorist groups keep switching from one group to another. In particular, some Taliban militants who are dissatisfied with their leaders and their interpretation of Sharia norms tend to join the more radical IS-KP. Currently, IS-KP is one of the Taliban’s main opponents.
Many analysts point out that in the past two years, IS-KP propaganda has focused extensively on Russia and Putin. They emphasize the Kremlin's culpability for Muslim deaths resulting from the Soviet war in Afghanistan, the wars in Chechnya and Russia’s involvement in the Syrian civil war.
This is not the group’s first attempt to attack Russia. On Sept. 5, 2021, after the US withdrew from Afghanistan, a suicide bomber blew himself up at the entrance to the Russian Embassy in Kabul, killing at least ten people, including two Embassy staff. The attack was justified not only by Russia's perceived responsibility for the death of numerous Muslims, but also by its dealings with the Taliban.
On Feb. 17, 2023, the FSB reported having prevented a terrorist act in the Kaluga region, where two IS members from Central Asia who had been planning to blow up fuel tanks at a chemical plant were killed during the operation to arrest them.
On March 7, 2024, the same day when the US intelligence services warned of a possible terrorist attack and when one of the terrorists visited Crocus City Hall, the FSB reported having prevented another act of terror, as two IS-KP fighters were killed in a confrontation with law enforcement. The fighters had intended to attack a synagogue in Moscow.
Following the arrest of the Crocus City Hall terror attack suspects, evidence of torture began to emerge: one suspect had his ear cut off, while another was tortured with electric wires. Torture is unacceptable not only because it is inhumane, but also because it is unprofessional. Counter-terrorist agents must exhibit restraint and refrain from resorting to torture as a means of retribution, as obtaining information about potential accomplices and organizers is crucial for preventing future terrorist attacks. When people allow emotions, stereotypes and prejudices to guide their actions, they lose sight of many important details and are unable to form a complete picture of events. We believe that in the future, members of these units should take a proficiency test similar to the US military's ASVAB (ex. National Guard Test), which comprehensively assesses a candidate's knowledge and abilities across various domains and determines their suitability for different military specializations.
It is also worth noting that the lack of public outcry in response to the display of torture normalizes its use not only against actual terrorists but also against any other detainee.
In addition, relevant agencies, such as the General Directorate for Countering Extremism of the Ministry of Internal Affairs of the Russian Federation, known as "Center E," should focus on preventing real extremism and terrorism, instead of chasing down political protesters. Moreover, perpetrators of terrorist attacks are often recruited from the poorest and most socially vulnerable groups. Therefore, to effectively combat terrorism, efforts must be made to improve the economic wellbeing of migrants and protect their civil rights. It is worth noting that the act of terror at Crocus City Hall occurred against the backdrop of a record increase in the number of criminal cases related to terrorism. These cases are mainly brought up against people who set fire to railroad relay cabinets or draft offices. In many of these cases, perpetrators are tricked into committing crimes by phone scammers.
The war-induced easy availability of weapons on the black market in Russia also increases the likelihood of similar acts of terror.
It is not expected that the Russian authorities would use this act of terror as a pretext for a second wave of mobilization, as such justification was not required for the first one.
Regarding the actions of intelligence services during the act of terror, it is worth noting that the police special forces entered the building only after one hour and fifteen minutes—an hour and a half after the attack began. Moreover, emergency response groups were not immediately allowed inside. As a result, it is likely that most people died not from the terrorists' direct actions, but suffocated in the smoke. At the same time, during the terrorists' entry into the concert hall, an employee of the canine service of the Ministry of Internal Affairs was present. Therefore, this officer could have at least kept law enforcement informed about the number of attackers, the cessation of shooting, etc. All of these factors indicate inadequate coordination and professionalism within Russian security forces.