The perpetrators of the terrorist attack at Crocus City Hall on March 22, 2024, considered several targets for attack, including Red Square, a synagogue in the Chistye Prudy area, and the Mega Belaya Dacha shopping center. This was reported by Oleg Vlasov, a lawyer for one of the accused, Dalerdzhon Mirzoyev, in an interview with TASS on March 20, 2025. Novosibirsk, where Mirzoyev had previously worked as a taxi driver, was also among the potential targets. According to the lawyer, the final decision to attack the concert hall in Krasnogorsk was made only a few days before the tragedy, when the rock band Piknik was scheduled to perform there.

Dalerjon Mirzoyev, a 32-year-old citizen of Tajikistan, was a key figure in the preparation of the attack. Before moving to Moscow two weeks before the attack, he lived in Novosibirsk, earning a living as a taxi driver. His radicalization, according to investigators, is linked to his family history: Mirzoyev's older brother left for Syria in 2016 and is believed to have died in 2020 while fighting for the terrorist organization ISIS, which is banned in Russia. Under the influence of radical ideas, Mirzoyev joined a Telegram group, where he was recruited by a certain "imam" who offered to organize a terrorist attack in the Russian capital. Although a large sum was promised for participation in the attack, the lawyer emphasizes that religious beliefs remained Mirzoyev's main motive.

A group of four terrorists — Mirzoyev, Saidakram Rachabalizoda, Shamsidin Fariduni and Muhammadsobir Faizov — gathered three days before the attack. At that time, they had not yet decided on a target: iconic places in Moscow and a large shopping center were discussed as options. Reconnaissance in Crocus began several days before the attack. Mirzoyev, who has a good memory, carefully studied the location of the entrances, exits and the interior layout of the hall. The group was trained remotely via Telegram: in a closed chat, the militants received instructions from their customers and mastered the skills of handling weapons from videos.

The initial plan, as Vlasov said, was for the terrorists to remain in the building after setting it on fire and engage in combat with law enforcement. However, at the last moment they changed their minds and left Crocus in a Renault, heading for the border with Ukraine. They were detained in the Bryansk region: after a chase, the militants tried to escape, running in different directions, but were caught by security forces. The Vilayat Khorasan group (a terrorist group banned in the Russian Federation), the Afghan wing of ISIS, claimed responsibility for the attack, which was confirmed by American intelligence agencies in March 2024.