crazyfingers
Supermagnon
Putin himself could have done it as a false flag operation to incite greater public support for his revanchist war against Ukraine. After all, he has been accused of doing just that with a bomb planted in an apartment building that was used to justify renewing the war with Chechen back when Putin was just starting to gain a name for himself with the public. However, the ISIS claim is also plausible. Ukraine is interested in attacks on Russian soil, but those are primarily at military and infrastructure targets. Shooting up a public concert event in a large shopping area isn't their usual type of tactic, especially since it would be likely to rally Russian public opinion in favor of Putin's war. And Putin is flogging a alleged Ukrainian connection to try to do just that.
Ukraine would never do something like this attack in Russia. Western support would crumble.