Putin expected to use deadly Moscow attack to Russia's advantage, whoever's to blame

Russian President Vladimir Putin's next move is being watched closely after he linked Ukraine to the deadly terrorist attack that took place in a Moscow concert hall Friday, leaving at least 137 people dead.

Russian officials and pro-Kremlin hawks continue to level blame at Kyiv for the attack at the Crocus City Hall venue, where gunmen killed concert-goers, including three children, and wounded at least 140. Kyiv vehemently denies any involvement.

Four suspects, three of whom were confirmed as Tajik nationals, appeared in a Moscow court looking beaten and disoriented Sunday night. They were charged with carrying out an act of terrorism and remanded in custody ahead of trial.

The Islamic State said at the weekend that it was behind the attack and released graphic footage of the incident via an IS-affiliated news agency. U.S. officials and defense experts agreed that it's highly likely that IS was responsible for the attack.

That hasn't stopped top Russian officials blaming Ukraine — and the West — for the attack.

Putin claimed the attackers had links to Ukraine and said they had been caught en route to the country, alleging that "a window had been prepared for them on the Ukrainian side to cross the border." He did not present any evidence for the claim.

A raft of other Russian politicians and senior officials accused Ukraine of being behind the attack, and blamed the West for propping up what they describe as a "terrorist" regime in Kyiv, accusing the U.S. of looking to destabilize Russia.

On his Telegram channel, Dmitry Medvedev, former president and deputy chairman of Russia's Security Council commented on Telegram that "if it is established that these are terrorists of the Kyiv regime, it is impossible to deal with them and their ideological inspirers differently," he said.

Medvedev, a high-profile Russian hawk and ultranationalist, added that "all of them must be found and mercilessly destroyed as terrorists. Including officials of the state that committed such atrocity. Death for death."

Kyiv strongly denies having any role or involvement in the attack. President Volodymyr Zelenskyy said Saturday that "what happened yesterday in Moscow is obviously just Putin and the other scum trying to blame it on someone else."

"They always have the same methods. It has happened before. There have been bombed houses, shootings, and explosions. And they always blame others," he said on Telegram, in comments translated by NBC News.

Russia has been accused of staging false flag attacks in order to justify subsequent military campaigns or attacks. There has been some speculation over the years that the Kremlin was behind a series of bombings in Moscow in late 1999 that allowed Putin, then in his early days as prime minister, to justify triggering a second Chechen war and large-scale bombing campaign that crushed a Chechen separatist movement.

The war greatly boosted Putin's popularity and grip on power, and led to his first election as Russian president at the end of 1999.  

At least part of the Kremlin's motivation to point the finger of blame at Kyiv could lie in a desire to divert awkward questions over why Russia's intelligence services failed to spot the attack in advance.

Moscow openly rebuffed and ignored a warning from the U.S. earlier in March that "extremists" had "imminent plants" to attack large gatherings in Moscow.

The attack also raises uncomfortable questions as to the actual security risks Russia faces from Islamist militant groups at a time when Ukraine has been squarely positioned as the main threat to Russia's existence.

Just days before the attack, Putin instructed Russia's security services to focus their efforts on supporting Russia's "special military operation" in Ukraine. He also said Western warnings about possible attacks within Russia were an attempt to intimidate and destabilize the country.

"Putin is so obsessed with this conflict in Ukraine that I think he's going to focus his security response there and use this, essentially, as an excuse to try to build up that narrative," Maximilian Hess, fellow at the Foreign Policy Research Institute, told CNBC Monday.

Noting that Russia's "whole security apparatus has been focused on Russia's war in Ukraine," Hess said that Moscow had taken its eye off the threat from Islamic State, which has previously carried out attacks in Moscow and in St. Petersburg, and may be motivated by Russian operations in Syria.

"What's interesting though is that Putin doesn't seem to be focusing on that aspect of it. He's very much trying to blame Ukraine for this attack. There's no evidence of Ukrainian involvement, it doesn't fit in line with the types of attacks that Kyiv has carried out in the past, including ongoing," Hess said.

"That will itself leave Russians less secure, because he's focusing on a non-real security risk."

Although Putin has not yet accused Ukraine of directing the attack, defense analysts said that it's almost certain that the Crocus City Hall tragedy will be used to boost domestic support for the war against Ukraine.

"Regardless of who is behind the shooting, the Kremlin will likely frame the tragedy to in a way to advance its broader geopolitical objectives," Andrius Tursa, central and eastern Europe advisor at Teneo consultancy, said in a note Saturday.

"Although Kyiv denies any involvement, Putin's attempts to make linkages between the shooting and Ukraine might be an attempt to distract public attention from internal security failures and signify the Kremlin's efforts to rally public support for the continued war with Ukraine," he added.

The rhetoric might also "be an attempt to prepare the public for a prolonged confrontation with Ukraine and the West, which could entail intensified military recruitment, higher taxation to support the war, and growing repression at home," Tursa said.

CNBC has contacted the Kremlin for a response to the comments and is awaiting a reply.

On Monday, Kremlin spokesman Dmitry Peskov said it was inappropriate to comment on the investigation into the attack when asked by reporters to respond to a statement by the Islamic State militant group claiming responsibility for the attack.