Russia's Vladimir Putin has acknowledged "radical Islamists" carried out Friday's deadly attack on a Moscow concert hall.
But he has repeated his claim that they had some kind of link to Ukraine and the West.
Ukraine has rejected the Russian claim as absurd.
The Islamic State (IS) group says it was behind the atrocity, in which 139 people were killed, and it has released footage of the attack.
Twenty-two people are still in a serious condition in hospital, including two children, according to Russian officials.
The Russian leader said during a televised meeting on Monday: "We know that the crime was committed by the hands of radical Islamists, whose ideology the Islamic world itself has been fighting for centuries."
He then went on to say: "We want to know who ordered it." Many questions remained unanswered, he argued, repeating an unfounded claim that the attackers had tried to flee south to Ukraine.
"Who was waiting for them there?" he asked. "This atrocity may be just a link in a whole series of attempts by those who have been at war with our country since 2014."
The US was trying to convince the world that Kyiv had no connection to the attack, he said. And he pointed the finger at the West, saying the attack could only be linked to attempts made by those who had fought against Russia by using Kyiv.
One of Mr Putin's longest-serving allies, security council secretary Nikolai Patrushev, doubled down on the Kremlin claim on Tuesday when he was asked whether IS or Ukraine was behind the attack: "Of course, Ukraine."
Ukrainian President Volodymyr Zelensky condemned the Russian accusations during his nightly video address: "Putin was talking to himself again... Again, he blames Ukraine. A sick and cynical creature."
The US says IS is "solely" to blame for the Moscow attack, and several European countries have stepped up security, with France warning of a resurgence in jihadist threats.
Four citizens of Tajikistan have appeared in court accused of carrying out the massacre. Four other suspects have been accused of aiding terrorism, including a 31-year-old man from Kyrgyzstan suspected of renting out a flat used by the attackers.
The attack took place little over two weeks after the US embassy warned that "extremists have imminent plans to target large gatherings in Moscow, to include concerts". Mr Putin rejected the warning as provocative only last week.
Three days before the gunmen targeted Crocus City Hall on the north-west fringe of Moscow, the Russian leader accused the US of using its warning of an imminent attack to "intimidate and destabilise our society".
Meanwhile, Russia's FSB security service announced on Tuesday that it had foiled an attack by pro-Ukraine Russian fighters in the southern city of Samara. It said a member of the Russian Volunteer Corps paramilitary group had blown himself up after being apprehended.
Italian Foreign Minister Antonio Tajani said it was obvious Mr Putin was looking for pretexts to attack Kyiv, but said the videos of the attack were clear and more than one IS claim confirmed the theory that it was involved.
The Moscow attack, blamed by US intelligence on a regional branch of IS called Islamic State-Khorasan, has heightened fears of renewed jihadist plots in Western Europe, ahead of a summer of major international sporting events.
French Interior Minister Gérald Darmanin said on Monday night that France had been on maximum alert since Sunday night and Prime Minister Gabriel Attal said two attacks had been foiled since the start of the year.
"We thwart a lot of attacks in France, one every two months," Mr Darmanin said on France 2 TV. Paris is due to host the Olympic Games in fourth months' time and the interior minister said the main threat was homegrown but the external IS threat was seeing a resurgence.
Mr Attal said 4,000 extra soldiers would be deployed across France in the coming days.
Germany has said it will introduce temporary border controls for the European Championships starting in June. The government in Berlin has already imposed controls on some of its borders in a bid to tackle gangs smuggling migrants across Europe.
Interior Minister Nancy Faeser said controls would take place on all German borders during the tournament "to prevent potential violent offenders from entering the country".
In a separate development, Turkey said it had arrested 147 people suspected of links to IS in simultaneous raids across 30 cities. Ankara has confirmed that two of the four suspected attackers visited Turkey weeks before the Moscow attack and said they were able to travel freely there as there was no warrant for their arrest.
Italy says it has intensified security ahead of the Easter holidays and has urged people to be alert, although "there are no concrete risks".
