Russia has long worried about terrorism. The Moscow attack showed it may not be prepared.

The horrific slaughter at Crocus City Hall, in which gunmen with automatic weapons and explosives killed over 130 people last Friday, has jolted Muscovites out of a sense of complacency that they have enjoyed, despite two years of war in next-door Ukraine.

In an address to Russians the day after the attack, President Vladimir Putin hinted that Ukraine might have been involved in the atrocity.

But he failed to mention a more plausible suspect: the group known as Islamic State Khorasan (ISIS-K), a sworn enemy of Russia generally associated with the kind of ruthless, face-to-face massacres that occurred in the Moscow concert hall.

The four prime suspects, who fled the scene in a car, were apprehended in Russia’s southwestern Bryansk region, near the borders with Ukraine and Belarus. On Sunday night, the suspects, who are from the former Soviet central Asian state of Tajikistan, were hauled before a Moscow court – all of them very badly beaten – and charged with terrorism, with a trial date set for late May.

While many Russians seem eager to embrace a Ukrainian connection to the attack, it looks like exactly the sort of threat emanating from Afghanistan that Russian security experts have been warning about for years.

The ISIS-K group is dedicated to creating a caliphate in the former Khorasan region of central Asia, which stretches from Iran to Tajikstan and includes parts of Uzbekistan and Turkmenistan, as well as all of Afghanistan. With Afghanistan once again under Taliban rule, the group has been moving into neighboring former Soviet states and infiltrating Russia through the stream of migrant workers, many of them Tajiks, who keep Russia’s construction and service industries running. Statistics are unreliable, but it’s estimated that over 1 million migrant workers are currently in Russia, many of them in Moscow, and are relatively free to move around.

In early March the United States warned Russia that ISIS was preparing an attack, and specifically mentioned a concert venue. Mr. Putin rejected the warning as a “provocation,” saying “these actions resemble outright blackmail and the intention to intimidate and destabilize our society.”

But, in fact, the Russians were already aware of the threat from ISIS. In early March, the Federal Security Service claimed to have raided and killed members of an “ISIS cell” near Moscow that was planning to bomb a Russian synagogue.

Now, experts say, the attack will almost certainly lead to tough security measures and stepped-up surveillance that the city hasn’t seen since a wave of terrorist attacks more than 20 years ago.

“There are so many questions and very few answers” about the Crocus City Hall attack, says Alexei Kondaurov, a former Duma deputy and former KGB major general specializing in anti-terrorist operations. “Any terrorist attack that isn’t caught at the stage of preparation represents a failure of special services. You can speak of solving 99% of crimes, but if one is not prevented, there is no justification. Particularly when the number of casualties is so high.”

A threat from Afghanistan

In the 1990s, Afghanistan under the Taliban was a haven and incubator of various extreme Islamist groups – such as Al Qaeda – who exported Islamist insurgencies to Tajikistan, Uzbekistan, and beyond.

After NATO occupied Afghanistan and Russia put down its own Islamist rebellion in Chechnya, things stabilized. The mass-scale terrorist attacks that had hit Moscow and other parts of Russia during the Chechen wars receded. But experts say the danger never completely went away.

Russia’s military intervention in Syria in 2015 again pitted Moscow against Islamist groups, and a planeload of Russian tourists was destroyed, reportedly by an ISIS bomb, over Egypt’s Sinai Desert that year, killing 224 people.

“What happened in that Moscow concert hall was a terrible tragedy,” says Grigory Shvedov, editor of Caucasian Knot, an independent online journal that reports on Russia’s mainly Muslim Caucasus region. “But, cynically speaking, it will be seen by some as an effective example and could revive this kind of extremism” within Russia, which has a very large Indigenous Muslim population.

The threat from ISIS-K, which is based in Afghanistan and Pakistan, is particularly acute for Moscow, due to the Russian economy’s reliance on migrant labor from central Asia. Afghan ethnic groups include Uzbeks and Tajiks, who may move easily into the neighboring states and then join the stream of migrant workers into Russia, as the four alleged Crocus City Hall attackers appear to have done.

Once in Russia, migrant workers may be subject to police harassment and extortion, but actual security measures that might prevent terrorist attacks are sorely lacking. Mr. Shvedov gives the example of dozens of illegal hostels, whose existence is an open secret in Moscow. Migrants live there without observing the requirement to register with authorities.

“The rules exist, but realities are very different,” he says, alluding to pervasive corruption in the system.

Consequences from Crocus City Hall

Depending on whom Russia officially decides to blame for the calamity, the terrorist attack may further sour relations with the U.S. Alternatively, it may improve them if the two adversaries acknowledge that they have a dangerous common enemy in ISIS.

At home, Russians will likely face the security crackdown that, ironically, they have largely avoided over two years of war in Ukraine. That would mean a further tightening of the screws on speech and make it much harder to use public transportation or gather in large groups. Communities of migrant workers will likely face a real crackdown.

“I expect more repression, inside the country and outside, and a new level of brutality,” says Andrei Soldatov, a Russian security services expert who is presently a senior fellow with the Center for European Policy Analysis in Washington. “We’ve seen it before – the tactics once adopted to deal with terrorists became quickly accepted as a new norm to treat political dissent.

“Thus the torture the Russian security services used against four suspects might be used against all sort of people in the country. This is the most direct consequence of the attack.”