Russia on Saturday said it had arrested 11 people - including four gunmen - over the attack on a Moscow concert hall claimed by the Islamic State, as the death toll rose to 115.
Russian President Vladimir Putin was yet to comment publicly on the attack, and Moscow has not addressed the Islamic State's claim of responsibility, even as some lawmakers pointed to a possible Ukraine connection.
Camouflaged gunmen opened fire at the packed Crocus City Hall in Moscow's northern suburb of Krasnogorsk on Friday evening ahead of a concert by Soviet-era rock band Piknik. It was the deadliest attack in Russia in at least a decade.
Russia's FSB security service said some of the perpetrators had fled toward the Russia-Ukraine border, adding that the assailants had "appropriate contacts" in the country.
It did not provide further details.
Some Russian lawmakers also pointed to Kyiv, without providing evidence.
"The main interested party could most likely be Ukraine and its patrons ... we can't rule it out," said senior Russian MP Andrey Kartapolov.
Ukraine, which has been facing a Russian military offensive for the past two years, had "nothing to do" with the attack, according to a statement by presidential aide Mykhailo Podolyak on Telegram.
The Kremlin said the head of the FSB security service had informed Putin about the arrests, while authorities warned the number of fatalities was set to keep rising, with more than 100 people still hospitalized and a search of the burnt-out venue ongoing.
"FSB Director Alexander Bortnikov reported to the president on the detention of 11 people, including four terrorists involved in the terrorist attack at Crocus City Hall," it said.
Putin has not made public remarks or been seen in public in the more than 12 hours since the attack.
The Kremlin said he was being kept constantly informed, and a government official said he had wished a speedy recovery to the victims.
At least 115 killed
Russia's Investigative Committee, which probes major crimes, said rescue workers were still working on site, pulling bodies from the building.
"The emergency services have found more bodies while removing the rubble. The death toll now stands at 115 people," it said in a statement on Telegram.
Stay informed. Subscribe to our newsletter
The number of fatalities was likely to rise further, as the governor of the Moscow region said rescuers would continue to scour the site for "several days."
Investigators said people died from gunshot wounds and smoke inhalation after a fire engulfed the 6,000-seat venue.
"The terrorists used a flammable liquid to set fire to the concert hall's premises, where spectators were located, including wounded," the Investigative Committee said.
Flames had quickly spread through the venue on Friday after reports of the mass shooting, with screaming concert-goers rushing to emergency exits.
Some filmed the gunmen from the upper floors as they appeared to methodically walk through the stalls shooting people, footage shared on social media showed.
The Islamic State group claimed responsibility on Friday, saying its fighters attacked "a large gathering" on Moscow's outskirts and "retreated to their bases safely."
Global condemnation
Russian authorities have called it a "terrorist attack" but have not commented on the Islamic State's claim.