Russia has arrested 11 people including four suspected gunmen in connection with a shooting rampage that killed at least 143 people in a concert hall near Moscow, the Kremlin says.
Militant Islamist group Islamic State claimed responsibility for Friday's attack, the deadliest in Russia for 20 years.
But there were indications that Russia was pursuing a Ukrainian link, despite a statement from Ukrainian presidential adviser Mykhailo Podolyak that Kyiv had nothing to do with it.
The FSB security service said "all four terrorists" had been arrested while heading to the Ukrainian border, and that they had contacts in Ukraine.
It said they were being transferred to Moscow.
"Now we know in which country these bloody bastards planned to hide from pursuit - Ukraine," Foreign Ministry spokeswoman Maria Zakharova said on Telegram.
A senior Russian MP, Andrei Kartapolov, said that if Ukraine was involved, then Russia must deliver a "worthy, clear and concrete" reply on the battlefield.
State TV editor Margarita Simonyan published a video of one of the suspects, a young bearded man, being interrogated by the side of a road.
She said the death toll had climbed to 143 but did not give the source of her information.
Russia's Investigative Committee earlier said at least 115 had died in the attack, in which camouflage-clad gunmen opened fire with automatic weapons at concertgoers in the Crocus City Hall near the capital.
It said some died from gunshot wounds and others in a huge fire that broke out in the complex.
Reports said the gunmen had lit the blaze using petrol from canisters they carried in backpacks.
People fled in panic.
Baza, a news outlet with good contacts in Russian security and law enforcement, said 28 bodies were found in a toilet and 14 on a staircase.
"Many mothers were found embracing their children," it said.
The Kremlin said FSB chief Alexander Bortnikov had reported to President Vladimir Putin that those detained included "four terrorists" and that the service was working to identify their accomplices.
Russian MP Alexander Khinshtein said the attackers had fled in a Renault vehicle that was spotted by police in Bryansk region, about 340km southwest of Moscow on Friday night and disobeyed instructions to stop.
He said two were arrested after a car chase and two others fled into a forest.
From the Kremlin account, it appeared they too were later detained.
Khinshtein said a pistol, a magazine for an assault rifle, and passports from Tajikistan were found in the car.
Tajikistan is a mainly Muslim Central Asian state that used to be part of the Soviet Union.
Verified video showed people taking their seats in the hall, then rushing for the exits as repeated gunfire echoed above screams.
Other video showed men shooting at groups of people as some victims lay motionless in pools of blood.
Long lines formed in Moscow on Saturday for people to donate blood.
Health officials said more than 120 people were wounded.
"The death toll is expected to rise," the Investigative Committee, which handles major crimes in Russia, said on Telegram.
The Moscow city and regional governments said they would provide financial support for families of the victims and those injured and pay for funerals.
Islamic State, the militant group that once sought control over swathes of Iraq and Syria, claimed responsibility for the attack, the group's Amaq agency said on Telegram.
Islamic State said its fighters attacked on the outskirts of Moscow, "killing and wounding hundreds and causing great destruction to the place before they withdrew to their bases safely".
The statement gave no further detail.
The US has intelligence confirming Islamic State's claim of responsibility for the shooting, a US official said on Friday.
The attack on Crocus City Hall, about 2km from the Kremlin, happened two weeks after the US embassy in Russia warned that "extremists" had imminent plans for an attack in Moscow.
Hours before the embassy warning, the FSB said it had foiled an attack on a Moscow synagogue by Islamic State's affiliate in Afghanistan, known as ISIS-Khorasan or ISIS-K, which seeks a caliphate across Afghanistan, Pakistan, Turkmenistan, Tajikistan, Uzbekistan and Iran.
Russian Foreign Ministry spokeswoman Maria Zakharova said it was a "bloody terrorist attack" that the world should condemn.
The US, European and Arab powers and many former Soviet republics expressed shock and sent their condolences.
The United Nations Security Council condemned what it called a "heinous and cowardly terrorist attack".
Russia tightened security at airports, transport hubs and across the capital and cancelled all large-scale public events across the country.
