Reuters news agency is reporting that Islamic State have claimed responsibility for the attack on its Telegram channel.
The report has not been independently verified.
The group, also known as ISIS, has carried out attacks in a number of countries, however BBC security correspondent Gordon Corera notes that the group has at times in the past claimed responsibility for attacks that it had nothing to do with.
On 7 March, Russia's Federal Security Service (FSB) said it prevented an attack on a synagogue in Moscow that was being planned by an Islamic State cell.
The FSB said attackers opened fire during the attempted arrest and were "neutralized by return fire", but few other details were given about the alleged plot.
The statement from so-called Islamic State (IS) saying they were behind the attack came out on one of the group's official accounts.
That is not absolute confirmation - sometimes IS has issued false claims - however, a US official has told CBS, the BBC's US partner, that it has intelligence confirming the IS claim that it carried out the attack.
The nature of the assault – marauding gunmen killing as many civilians as possible – is typical of the way they operate. There are similarities, for instance, to the Bataclan attacks at a concert in Paris back in 2015 linked to the group.
The question of who was behind today's attack is highly charged because of the international context. Ukrainian officials - and their allies - are clearly worried Kyiv might be blamed by Moscow.
There is also the question of the US warning on 7 March about "extremists" attacking concerts. That public warning - based almost certainly on intelligence - appears to have been dismissed by Russian officials.
And so while there are always questions about who was behind an attack and if it could have been prevented, this time the pressure on Moscow may be more intense to see what they say and how they respond.
The latest information is that the attackers got away, possibly in a white car.
The search is on to find them, and to find out who they are.
Ukraine says it had nothing to do with this attack, and meanwhile Islamic State has claimed responsibility.
Russian authorities are yet to comment on that development. And Vladimir Putin has so far made no public comment, but we’re told he’s been kept up to date on events as they unfold.
Meanwhile security has been stepped up here in Moscow at key installations including airports and train stations.
Questions are being raised. Among them: How is it possible that armed men were able to get into a prominent concert venue, with thousands of people attending a concert, and carry out such a bloody attack – particularly since US authorities had recently warned about a similar scenario?
