Isis couldn’t find Moscow on a map of Europe even if it was labeled in BOLD COLORS, right in front of their face. If it ain’t Mecca, it ain’t jack.
ISIS as well as other Islamist terrorist organizations are evil, not stupid or incompetent. They have a proven track record of well planned, rehearsed, and effective attacks on targets across the Middle East,and Europe. They openly assert that Allah wants them to establish a global Islamic Caliphate regardless of how long it takes: years, decades, centuries. They have sympathizers across the globe, to include Russia and the U.S.
They are the most likely candidate for a mass attack directed against civilian as this is a preferred tactic they have used repeated.
Ukraine, while at war with Russia, is focused on Russia’s military capabilities and lines of communication. Killing civilians at a concert is useless to them and would unite a Russia they wish to weaken and divide.
The CIA isn’t nearly capable of pulling off something like this, it take disciplined and dedicated true believers willing to die for the cause to pull something like this off. Neither they, nor the Russians for that matte, have a deep bench of suicidal fanatics. ISIS does, and they are spread across the globe. The simple, logical explanation is Islamists. Russia supports Iran, the apostate Shia entity, whom Islamists hate, particularly when they co-opt rivals like Hamas. They have long sought to gain influence with Russia’s Muslim minorities and inflame hatred. A Russian crackdown, with Russia’s normal brutality. Would suit them just fine.