Russian President Vladimir Putin says all four people directly involved in the shooting rampage on a concert hall near Moscow have been detained.
He said 11 people have been arrested in the attack that killed at least 133 people. The Russian president declared March 24 a day of national mourning.
In a televised address, Putin strongly condemned what he called a "bloody, barbaric terrorist act." He claimed the four suspects tried to escape to Ukraine, and that preparations were made for them to cross the border.
Authorities say several people dressed in camouflage fatigues stormed the venue before the start of the concert.
The RIA Novosti news agency says at least three people opened fire, and that explosives were detonated.
A Russian lawmaker earlier said two of the attackers had been detained in the western Bryansk region. He said a gun, ammunition and Tajik passports were found in their vehicle.
The Islamic State militant group has reportedly claimed responsibility for the attack, while Ukraine denies any involvement.
Footage released in Russia shows investigators examining guns and ammunition found at the crime scene. It's believed the gunmen opened fire with automatic weapons before spreading flammable liquid and setting fire to the hall.
US National Security Council spokesperson Adrienne Watson posted a comment on social media site X that said Washington had intelligence about a planned attack in Moscow. She said this prompted the State Department to issue an advisory to Americans in Russia.
She also said the US government shared the information with Russia, in line with its longstanding "duty to warn" policy.