Isis has previously claimed responsibility “for a handful of terrorist attacks by individuals who were clearly inspired by it specifically, but for whom there is not always clear evidence of a command-and-control relationship”, Kohlmann said.

Despite being defeated in Iraq and Syria by a US-led global coalition in 2019 and losing all the territory that comprised the so-called caliphate it established there in 2013, Isis remains a serious threat to global security.

Isis “rarely claims attacks it doesn’t carry out”, said Michael Kugelman, director of the South Asia Institute of the Wilson Centre, a Washington think tank.

“It’s one of the only global terror groups with the capacity to pull off a sophisticated attack like this. And the group has had Russia in its crosshairs for a long time,” Kugelman said.

In addition to the longstanding Russian military campaign in Syria targeting Isis with “everything from cruise missiles to ground troops”, there have also been recent battles between Russian Wagner Group mercenaries and locally-based Isis militants in the Sahel region of Africa, Kohlmann observed.

The Sahel includes Burkina Faso, Cameroon, Chad, The Gambia, Guinea, Mauritania, Mali, Niger, Nigeria and Senegal.

Moscow concert hall attack: 11 suspects detained after gunmen kill 115

Isis also has a track record of sending small squads of gunmen to massacre people gathering in large numbers in venues like concert halls, starting with the Paris terrorist attacks in November 2015.

Kugelman said the tactic of targeting crowded soft-target public spaces - in contrast to suicide bombings - was “patented” by Pakistani Lashkar-i-Taiba terrorists trained by al-Qaeda to carry out the Mumbai terrorist attacks in November 2008.

“One of the most haunting images” of the Mumbai attacks was the grainy footage of a heavily armed militant “walking slowly around and opening fire on cowering crowds of people”, Kugelman said.

“We’ve seen the model applied many times since then” such as in Paris in 2015 and Brussels in 2016, he said.

But it is unclear for now which branch or branches of the Isis global network carried out the attack in Moscow because the terrorist group failed to identify the perpetrators in the claim issued through its Amaq News Agency.

Circumstantial evidence, however, points to Isis affiliates based in southern Russia and Afghanistan, respectively called Isis-Caucasia (Isis-C), and Isis-Khurasan (Isis-K), the analysts said.

Encrypted networks associated with Isis-C were activated when the attack began in Moscow on Friday, according to Iftikhar Firdous, editor of The Khurasan Dairy, an Islamabad-based security news and analysis platform.

The visuals shared by the attackers on Isis-C networks showed “three attackers directly shooting people in a hall”, he said.

Kohlmann noted that Isis “drew a significant number of recruits” from Russia’s South Caucasus region and Central Asian regions as well as various former Soviet republics in Central Asia, during the heyday of its erstwhile caliphate.

“Some were veterans of past conflicts” with the Russian government in the Muslim-majority republics of Chechnya and Dagestan, he said.

Russia’s FSB security agency said it had killed at least six Isis-affiliated militants during clashes in Russia’s adjacent southern Ingushetia region on March 2.

India urged to step in after jobseekers ‘deceived’ into fighting for Russia

In a separate operation, the FSB said it eliminated a cell of Afghanistan-based Isis-k operatives on March 7 that was planning to shoot worshippers at a Moscow synagogue.

The tactics employed by the Moscow attackers, the March 7 bust, and an American warning earlier this month that Isis was planning an imminent terrorist attack potentially targeting a large public gathering in Moscow were three pointers which “strengthen the impression that this was an Isis attack”, said Abdul Basit a senior research associate of the S. Rajaratnam School of International Studies at Singapore’s Nanyang Technological University.

“Speculatively, the experts are saying” Isis-C is the “main perpetrator” but that it received “some help” from Isis-K, Basit said. From the interception of an Isis-K cell near Moscow on March 7, the affiliate appeared to have established a presence in the city, he added.

This may have prompted the group’s operatives to wait for two weeks until the situation had calmed down, allowing them to “activate plan B”, Basit said.

Isis-K’s plots indicate that it is the “biggest global threat today” among Isis affiliates, the Washington Institute for Near East Policy said in a report published on Thursday.

03:03

Russia-China relations to grow stronger, Putin says, after clinching landslide election win

Russia-China relations to grow stronger, Putin says, after clinching landslide election win

Over the last 12 months, the Afghan affiliate spearheaded external operations, plotting 21 attacks in nine countries - far more than in each of the previous years stretching back to 2018, the institute noted.

Afghanistan-based operatives from Tajikistan have become “key nodes in Isis-K’s terrorist nexus”, having been involved in six of the attacks, it said.

But Isis poses nowhere the level of threat that it did when it had 20,000 fighters, controlled territory in Iraq and Syria roughly equivalent to the size of the UK and generated revenues of several hundred million dollars a year.

Isis has “suffered cascading leadership losses” in Iraq and Syria but its regional affiliates will “continue to expand” nonetheless, according to the annual US intelligence assessment published on March 11.

This threat was “mostly likely to manifest in small cells or individuals” inspired by violent extremist ideologies to conduct attacks,” the US Office of the Director of National Intelligence warned.

Additional reporting by Reuters