The Russian authorities said on Saturday that they had arrested the four people who carried out mass killing and arson at a suburban Moscow concert venue, leaving at least 133 people dead in one of the worst terrorist attacks to jolt Russia in decades.

The Islamic State claimed responsibility for the brutal attack late on Friday, raising fears of a global resurgence by the extremist group. US officials said they believed the atrocity was the work of a branch of the terrorist group known as the Islamic State in Khorasan, or the ISIS-K, which has been active in Pakistan, Afghanistan and Iran. The ISIS-K previously attacked Russia’s embassy in Kabul and has produced floods of anti-Kremlin propaganda.

But President Vladimir V. Putin of Russia, who made his first public remarks on the tragedy more than 19 hours after the attack, made no mention of the ISIS. He instead accused individuals in Ukraine of preparing a border crossing for the four attackers, who the authorities said were all foreign citizens and had been apprehended in Russia’s Bryansk region, which borders Ukraine.

Kyiv has denied any involvement in the attack, saying that suggestions to the contrary were an attempt to rally support for the Kremlin’s war in Ukraine.

In a video address, Putin also declared that Sunday would be a national day of mourning and vowed to hold all those behind the attack accountable.

“All perpetrators, organisers and commissioners of this crime will receive a just and inevitable punishment,” Putin said.

“No matter who they are, no matter who directed them, I repeat, we will identify and punish everyone who stood behind the terrorists.”

As the death toll climbed, Russians placed flowers at spontaneous memorials and lined up in the capital to donate blood. The authorities posted pictures of charred seating and debris inside the concert hall, warning that the death toll was likely to rise as emergency services continued to comb the scene.

The attack began on Friday evening before a performance by Piknik, a Russian rock band formed in the late 1970s. Survivors described “panic” and terror as shots rang out when armed men stormed the concert hall. The attackers then used a flammable liquid to set fire to the premises of the large concert hall, according to Russia’s investigative committee.

Details on some of the victims have begun to emerge from officials and local news media.

Most of those identified so far appeared to be in their 40s, and many had travelled from other parts of the country to attend the concert. Three of the dead were children, the state news agency Tass reported.

The Russian authorities said that at least 145 people had been injured in the attack, and that 107 were still hospitalised as of Saturday. Despite Russia’s international isolation over the war in Ukraine, adversaries of the Kremlin joined its allies in condemning the attack and calling for accountability.

US officials said they had privately alerted Russia earlier this month about intelligence on potential Islamic State activity.

The same intelligence prompted a March 7 security alert by the US embassy in Moscow warning American citizens of “reports that extremists have imminent plans to target large gatherings in Moscow, to include concerts”.

The venue where the attack took place is part of a sprawling shopping and entertainment complex called Crocus City Hall, in suburban Krasnogorsk, northwest of Moscow.

The complex was developed by the Azerbaijan-born billionaire Aras Agalarov, whose son, Emin, is a pop star. Former President Donald J. Trump held the Miss Universe pageant at the same complex in 2013.

New York Times News Service