• Russian officials and pro-Kremlin hawks continue to level blame at Kyiv for the attack at the Crocus City Hall venue on Friday evening, despite Islamic State saying it was behind it.
• The attack is highly likely to be used to ramp up its aggression against Ukraine, and to tighten security protocols at home.
• Kyiv strongly denies having any role or involvement in the attack.
• President Volodymyr Zelenskyy said Saturday that "what happened yesterday in Moscow is obviously just Putin and the other scum trying to blame it on someone else."

Russian President Vladimir Putin's next move is being watched closely after he linked Ukraine to the deadly terrorist attack that took place in a Moscow concert hall Friday, leaving at least 137 people dead.

Russian officials and pro-Kremlin hawks continue to level blame at Kyiv for the attack at the Crocus City Hall venue, where gunmen killed concert-goers, including three children, and wounded at least 140. Kyiv vehemently denies any involvement.

Four suspects, three of whom were confirmed as Tajik nationals, appeared in a Moscow court on Sunday night, looking beaten, bruised and disoriented. They were charged with carrying out an act of terrorism and remanded in custody ahead of trial.

The Islamic State said at the weekend that it was behind the attack and released graphic footage of the incident via an IS-affiliated news agency. U.S. officials and defense experts agreed that it's highly likely that IS was responsible for the attack.

That hasn't stopped top Russian officials blaming Ukraine — and the West — for the attack.

Putin claimed the attackers had links to Ukraine and said they had been caught en route to the country, alleging that "a window had been prepared for them on the Ukrainian side to cross the border." He did not present any evidence for the claim.

Russian hawks blame Kyiv

A raft of other Russian politicians and senior officials accused Ukraine of being behind the attack, and blamed the West for propping up what they describe as a "terrorist" regime in Kyiv, accusing the U.S. of looking to destabilize Russia.

On his Telegram channel, Dmitry Medvedev, former president and deputy chairman of Russia's Security Council commented on Telegram that "if it is established that these are terrorists of the Kyiv regime, it is impossible to deal with them and their ideological inspirers differently," he said.

Medvedev, a high-profile Russian hawk and ultranationalist, added that "all of them must be found and mercilessly destroyed as terrorists. Including officials of the state that committed such atrocity. Death for death."

Kyiv strongly denies having any role or involvement in the attack. President Volodymyr Zelenskyy said Saturday that "what happened yesterday in Moscow is obviously just Putin and the other scum trying to blame it on someone else."

"They always have the same methods. It has happened before. There have been bombed houses, shootings, and explosions. And they always blame others," he said on Telegram, in comments translated by NBC News.

Russia has been accused of staging false flag attacks in order to justify subsequent military campaigns or attacks. There has been some speculation over the years that the Russian security services were involved in a series of bombings in Moscow in late 1999 that allowed Putin, then in his early days as prime minister, to justify triggering a second Chechen war and large-scale bombing campaign that crushed a Chechen separatist movement.

The war greatly boosted Putin's popularity and grip on power, and led to his first election as Russian president at the end of 1999.  

What could happen next?

At least part of the Kremlin's motivation to point the finger of blame at Kyiv could lie in a desire to divert awkward questions over why Russia's intelligence services failed to spot the attack in advance.

Moscow openly rebuffed and ignored a warning from the U.S. earlier in March that "extremists" had "imminent plants" to attack large gatherings in Moscow.

The attack also raises uncomfortable questions as to the actual security risks Russia faces from Islamist militant groups at a time when Ukraine has been squarely positioned as the main threat to Russia's existence.

Just days before the attack, Putin instructed Russia's security services to focus their efforts on supporting Russia's "special military operation" in Ukraine. He also said recent Western warnings (that he described as "provocative statements") about potential terrorist attacks within Russia resembled "outright blackmail" and had the "intention to intimidate and destabilise our society."

I would also like to recall the recent provocative statements by a number of official Western structures regarding potential terrorist attacks in Russia. All these actions

"Putin is so obsessed with this conflict in Ukraine that I think he's going to focus his security response there and use this, essentially, as an excuse to try to build up that narrative," Maximilian Hess, fellow at the Foreign Policy Research Institute, told CNBC Monday.

Noting that Russia's "whole security apparatus has been focused on Russia's war in Ukraine," Hess said that Moscow had taken its eye off the threat from Islamic State, which appeared to be motivated by Russian operations in Syria and, previously, in Afghanistan.

"What's interesting though is that Putin doesn't seem to be focusing on that aspect of it. He's very much trying to blame Ukraine for this attack. There's no evidence of Ukrainian involvement, it doesn't fit in line with the types of attacks that Kyiv has carried out in the past, including ongoing," Hess said.

"That will itself leave Russians less secure, because he's focusing on a non-real security risk."

Although Putin has not yet accused Ukraine of directing the attack, defense analysts said that it's almost certain that the Crocus City Hall tragedy will be used to boost domestic support for the war against Ukraine.

"Regardless of who is behind the shooting, the Kremlin will likely frame the tragedy to in a way to advance its broader geopolitical objectives," Andrius Tursa, central and eastern Europe advisor at Teneo consultancy, said in a note Saturday.

"Although Kyiv denies any involvement, Putin's attempts to make linkages between the shooting and Ukraine might be an attempt to distract public attention from internal security failures and signify the Kremlin's efforts to rally public support for the continued war with Ukraine," he added.

The rhetoric might also "be an attempt to prepare the public for a prolonged confrontation with Ukraine and the West, which could entail intensified military recruitment, higher taxation to support the war, and growing repression at home," Tursa said.

CNBC has contacted the Kremlin for a response to the comments and is awaiting a reply.

On Monday, Kremlin spokesman Dmitry Peskov said it was inappropriate to comment on the investigation into the attack when asked by reporters to respond to a statement by the Islamic State militant group claiming responsibility for the attack.

Tatiana Stanovaya, senior fellow at the Carnegie Russia Eurasia Center and the founder of analysis firm R.Politik, said it was "politically convenient" for Russian officials to blame Ukraine, but she believed there would be a more cautious response from the authorities while an investigation is carried out.

"It may appear for an external observer that Russia is doubling down on blaming Ukraine. But there are nuances," she told CNBC Monday.

"When we look at the Russian media and Russian political space, they absolutely are doubling down on saying that it was Ukraine behind it [the attack] and that mostly targets a domestic audience. There is a strong temptation to speculate on Ukrainian involvement, and it helps to justify the war," she said.

"But at a more technical level, when it comes to the investigation, they try to be more cautious. And if they would really believe that Ukrainian secret services could be behind this attack, their statements would be much more direct and more harsh about Ukrainian engagement," Stanovaya noted.