It should have been no surprise that the terrorist group known as ISIS was behind Friday night’s massive attack on a concert hall in Moscow, killing 137 people and injuring at least 100.

The surprise is that this sort of thing doesn’t happen more often.

ISIS, also called the Islamic State, was believed dead and gone in 2017, after U.S., Iraqi, and Kurdish forces defeated its final holdout of armed men in a ferocious battle around the Iraqi town of Mosul. The terrorist group—which, for the previous few years, had ruled as many as 12 million people in a self-declared “caliphate” spanning much of northwestern Iraq and eastern Syria—was obliterated as a political and military power, but a few thousand of its fanatics survived.

Many Western articles and analyses painted ISIS as an especially violent offshoot of al-Qaida bent on wiping out or overthrowing territories held by “apostates” of all sorts—Christians, Jews, and rival Shiite Muslims. But the group also singled out Russia as a particularly virulent enemy.

Since the fall of 2015, Russian President Vladimir Putin has been helping Syrian President Bashar al-Assad fight off all opposition factions in a gruesome civil war, sending him not just bombs and ammo but fighter planes flown by Russian air force pilots. ISIS fighters have been among the targets of these bombing raids—and they have sought revenge.

Bruce Hoffman, a counterterrorism expert at the Council on Foreign Relations, told me Monday that since the caliphate’s collapse in Mosul, many ISIS survivors have been animated most of all by the crusade against Russia.

Not long after Putin began his deployment, ISIS militants in Egypt claimed responsibility for planting a bomb on a charter flight to St. Petersburg, killing 224 passengers, all of them Russian tourists returning home. In 2017 an ISIS suicide bomber blew up a subway car in the St. Petersburg metro system, killing 16.

The metro bomber was from Kyrgyzstan, one of the former Soviet Union’s Central Asian republics. The four men arrested after this past Friday’s concert-hall killings were from Tajikistan, another former republic in the same region. The fact is no coincidence. The majority of this region’s citizens are Muslim. Many of them resent Russia for its tyrannical grip from Soviet times (animated, in the case of its hold over Muslim areas, by white-nationalist racism). Some residents of these countries have been further radicalized by Islamist terrorist groups, which flourished with the rise of al-Qaida and ISIS. And according to Hoffman, many of those who were radicalized and who had been recruited to fight for the caliphate fled back home just before or after the fall of Mosul.

The concert-hall killing in Moscow was planned and carried out by a branch of the terrorist movement called ISIS-K. (The K stands for the Khorasan region, which overlaps parts of Afghanistan, Pakistan, Iran, and Turkmenistan.) ISIS-K has been fighting the Taliban in Afghanistan; it regards the Taliban leaders, who took over Afghanistan in 2017 after U.S. forces withdrew and the Kabul government collapsed, as insufficiently militant.

Still, the group has stepped up terrorist activities outside its home area.

In January, two ISIS-K suicide bombers killed 84 Iranian Shiites who were attending a memorial service for Qassem Soleimani, the leader of Iran’s terrorist operations throughout the Middle East, on the fourth anniversary of his assassination. The success of that attack might have encouraged the Moscow attack a little over two months later.

In the first decade of this century, after the Soviet collapse and its own withdrawal from an earlier war in Afghanistan, the Kremlin was very concerned about the rise of radical Islam in the Central Asian republics. For that reason, even Putin, for a while anyway, was keen to help the United States after the Sept. 11 terrorist attacks—sharing intelligence about al-Qaida and urging Central Asian leaders to let the U.S. military use their airfields to service and resupply our own invasion of Afghanistan.

However, after Putin’s annexation of Crimea in 2014 and especially since Russia’s outright invasion of Ukraine in 2022, contacts between Washington and Moscow have broken off.

Twice this month, in accordance with a long-standing policy known as “duty to warn,” U.S. intelligence officials notified their Russian counterparts of a report that ISIS-K was planning a terrorist attack in Russia. Putin waved away the warning as “an attempt to frighten and destabilize our society.”

By coincidence, shortly after the Americans’ first warning, Russia’s Federal Security Service stopped an impending attack on a Moscow synagogue. It is possible that Putin or his aides thought that this was the attack in the U.S. duty-to-warn notice (which, in any case, did not contain any details about when or where a terrorist strike might take place).

Russian intelligence and security forces were probably also shorthanded, as the vast majority of them have been diverted to—or distracted by—the war in Ukraine. Large concert halls are particularly ripe targets—and the Crocus City Hall in Krasnogorsk, the northwestern district of Moscow where this attack took place, is a vast mall that includes a hotel, restaurants, and a few music venues. It would be very difficult for even the most fully staffed and scrupulous security team to check every person and every bag entering its main doors.

Nonetheless, it was clear Putin was caught off guard. He remained silent for several hours after the attack. When he finally emerged, he spoke on a televised broadcast for a mere five minutes, made no mention of ISIS, and came close to blaming the incident on Ukraine. First, he likened the perpetrators to “Nazis,” a term he often uses to describe the officials in Kyiv. Second, he said that, whoever they were, they were fleeing toward Ukraine, where they would be received with open arms. (Ukraine denies any involvement in the attack. ISIS-K has openly claimed responsibility.)

It is not known whether the four men arrested were the only ones who took part in the attack—or even whether all four of these men actually did. After confessing to the crime, they appeared in Russian court in a clearly beaten state, some with bruises and swollen faces, one sitting unconscious in a wheelchair.

Will the attack damage Putin politically? Some think so. It is the deadliest terrorist attack in Russia in 20 years. Many Russians have ceded to Putin’s domestic oppression, even to his war, reasoning that at least he has kept the country safe and strong. The concert-hall attack delivers a sucker punch to that notion—especially when viewed alongside a spate of attacks on Russian oil refineries, railway depots, and other high-profile targets, launched either by Ukrainians who surreptitiously crossed the border or by Russian saboteurs.

Then again, Putin has survived a plethora of plots, threats, and horrid situations that would have knocked many other dictators out of power or worse. He may survive this one as well, and may even exploit it—as he has done in the wake of terrorist attacks in the past—to intensify his campaigns against enemies domestic and foreign, imagined and real.

Putin’s grip on power is at once tenacious and vulnerable, just as Russia itself acts at times like a rapacious empire and, at others, like a ramshackle cogwheel spinning out of control and about to implode. The combination—when it comes to both the man and his fiefdom—can be dangerous.