Associated Press – The auditorium at Crocus City Hall was about three-quarters full, with the crowd waiting to see Picnic, a band popular since the Soviet days of the early 1980s. But the concert was sold out in the 6,200-seat hall, so some of the audience was still likely getting food or were shedding their heavy coats in the cloakroom.

It was 7-10 minutes before the start of the show, scheduled for 8 p.m., said concertgoer Dave Primov.

Then came the popping sounds.

“Initially I thought: fireworks or something like that…” Mr. Primov told The Associated Press. “I looked at my colleague, and he also said: ‘Fireworks, probably.’“

But it wasn’t pyrotechnics. At least four khaki-clad men with automatic weapons were in the building, firing incessantly. Then they set the concert hall on fire.

It was the start of the deadliest attack on Russian soil in years that left 137 people dead and more than 180 injured in what President Vladimir Putin called “a bloody, barbaric terrorist act.” Although he sought to tie Ukraine to it, an affiliate of the Islamic State group claimed responsibility—which U.S. intelligence officials confirmed. Kyiv denied any involvement.

Four suspects were arrested in Russia’s Bryansk region. Identified in Russian media as Tajik nationals, they were charged with carrying out a terrorist act and face a life sentence. They appeared before a Moscow court on Sunday night showing signs of severe beatings.

Friday Night

Crocus City Hall is a large entertainment and shopping complex in Krasnogorsk, a suburb on the northwestern edge of Moscow.

On Friday night, its vast hallways became a scene of slaughter as the gunmen entered and made their way to the auditorium, firing at anyone nearby, sometimes at point-blank range.

Videos taken by those in the hallways and in the auditorium showed people screaming and trying to flee as the gunmen continued firing shots. Some hid behind the dark red seats and tried to crawl toward the exits, according to footage and accounts of survivors reported in the media.

In one video, a young man says into the camera, with gunshots ringing out, “They set the auditorium on fire. The auditorium is on fire.” For a moment, flames could be seen in a corner of the theater.

Mr. Primov and others were able to leave the auditorium before the gunmen got to it, he told AP. It took him about 25 minutes to leave the building altogether.

He described the scene as complete chaos: The panic-stricken people tried to find exits, with gunmen still roaming through it and firing; people fell and collided with each other as they ran; men broke down locked doors, hoping they led to safety.

“We don’t know what’s ahead. We don’t know what is behind this door. We don’t know what is going on outside, maybe we’re encircled [by the attackers], maybe someone is waiting there,” Mr. Primov said.

Another survivor who identified herself only as Maria, echoed Mr. Primov: “This uncertainty, where to go, what to do, it scared [us] the most as every person there had no idea what was happening.”

The musicians of Picnic never made it onstage and left the building shortly after the attack began, its representative Yury Chernyshevsky told AP by phone shortly after news of the shooting broke. Asked if the band was safe, he responded: “How much safety can there be at this point? We hope we’re safe.”

By 8:30 p.m., a massive fire raged inside the building, with thick black smoke billowing from the roof that later collapsed. Russian media reported explosions inside, and it was unclear whether they were triggered by the gunmen or were caused by the blaze.

Outside, the building was bathed in neon blue from the blinking lights of dozens of ambulances, police and firetrucks. Helicopters dumped water into the blaze.

A special force of the Russian National Guard arrived and searched for the gunmen. Authorities announced the attack resulted in deaths and injuries, without giving numbers, and said they were investigating it as a terrorist act.

Various officials—from Moscow regional Governor Andrei Vorobyov to Interior Minister Vladimir Kolokoltsev—arrived on the scene.

Elsewhere in Russia, authorities tightened security and canceled big events scheduled for the weekend. In the second-largest city of St. Petersburg, two malls were evacuated, according to media reports.

Mr. Putin made no statements Friday night.

About 11 p.m., the Kremlin issued a terse statement saying Mr. Putin was informed “within minutes” of the shooting, was “constantly receiving” updates from government agencies, and issued the necessary orders, according to spokesman Dmitry Peskov, who did not elaborate.

Saturday

The death toll rose overnight and throughout Saturday as more bodies were discovered at Crocus City Hall, including some found in stairwells and a restroom.

Mr. Putin, who on March 17 secured a fifth term in office in an election with no real competition, did not address the nation until Saturday afternoon—more than 19 hours after news of the attack broke.

Throughout the night, in Russia and abroad, discussions swirled about who was responsible for the brazen attack. Authorities in Ukraine, invaded by Russia more than two years ago, swiftly and vehemently denied any involvement. The denials were quickly backed by U.S. officials, drawing a sharp reaction from Russian officials.

“On what grounds officials in Washington in the middle of a tragedy are making conclusions about someone’s noncomplicity?” Russian Foreign Ministry spokeswoman Maria Zakharova said in an online statement. “If the U.S. has or had reliable information about it, they should immediately pass it on to the Russian side. If they don’t, then the White House has no right to hand out absolution.”

Several hours after the attack began, an affiliate of the Islamic State group claimed responsibility, but some Russian state media personalities denounced it as fake.

“So far, it looks like an attempt to create a false trail,” state TV journalist Andrei Medvedev wrote on Telegram.

On Saturday, Russian authorities sought to tie Ukraine to the attack. The Federal Security Service, or FSB, reported arresting four gunmen in the border region of Bryansk, saying they were headed for Ukraine and had unspecified “contacts on the Ukrainian side.” It did not reveal any details of the manhunt but praised various law enforcement and security agencies for “acting in concert,” and saying that 11 people in total were arrested.

In his afternoon address, Mr. Putin called the attack “a bloody, barbaric terrorist act.”

He also reiterated the narrative, saying without evidence that “a window” was prepared for the assailants to cross into Ukraine. He stopped short, however, of blaming Kyiv for orchestrating the attack. He did not mention the claim of responsibility by the Islamic State affiliate.

He also stopped short of announcing any drastic measures in the wake of the attack, such as lifting a moratorium on capital punishment, starting another wave of mobilization into the army or even escalating hostilities in Ukraine—something Kremlin critics have suggested might be in store.

Moscow’s Department of Health said identifying the bodies of the dead will take at least two weeks.

Sunday

Sunday was declared a day of national mourning. Events were canceled and flags were lowered to half-staff.

At the burned-out and smoldering Crocus City Hall, a steady stream of people came to lay flowers at a makeshift memorial.

Throughout the day, a heavy police presence was seen at Basmanny District Court in Moscow for the anticipated arrival of the four suspects. Russia’s Investigative Committee released photos of them at its headquarters in Moscow.

Shortly before 11 p.m.—about 51 hours after the shooting began—the suspects, one by one, appeared in court for their pretrial hearings.

Bruises were visible on their faces; one had a bandaged ear; another was in a wheelchair and hospital gown. According to independent news outlet Mediazona, whose reporters attended the hearings, he was brought in from intensive care.

How he was hurt was not immediately clear. Unconfirmed Russian media reports suggested he was wounded during the manhunt.

The court said two of the suspects admitted guilt, though the men’s conditions raised questions about whether they did so freely.

The suspects, identified in Russian media as Tajik nationals, were charged with carrying out a terrorist act and face a life sentence.