Camouflaged gunmen opened fire at the packed Crocus City Hall in Moscow's northern suburb of Krasnogorsk on Friday evening ahead of a concert by Soviet-era rock band Piknik in the deadliest attack in Russia for at least a decade.
Russia's FSB security service said some of the perpetrators had fled towards the Russia-Ukraine border, adding that the assailants had "appropriate contacts" in the country.
It did not provide further details.
Some Russian lawmakers also pointed to Kyiv, without providing evidence.
"The main interested party could most likely be Ukraine and its patrons ... we can't rule it out," said senior Russian MP Andrey Kartapolov.
Ukraine, which has been facing a Russian military offensive for the past two years, had "nothing to do" with the attack, according to a statement by presidential aide Mykhailo Podolyak on Telegram.
The Kremlin said the head of the FSB security service had informed President Vladimir Putin about the arrests, while authorities warned the number of fatalities was set to keep rising, with more than 100 still hospitalised and a search of the burnt-out venue ongoing.
"FSB Director Alexander Bortnikov reported to the president on the detention of 11 people, including four terrorists involved in the terrorist attack at Crocus City Hall," it said.
Putin himself has not made any public remarks or been seen in public in the more than 12 hours since the attack.
The Kremlin said he was being kept constantly informed and a government official said he had wished a speedy recovery to the victims.
- At least 115 killed -
Russia's Investigative Committee, which probes major crimes, said rescue workers were still working on site, pulling bodies from the building.
"The emergency services have found more bodies while removing the rubble. The death toll now stands at 115 people," it said in a statement on Telegram.
The number of fatalities was likely to rise further, as the governor of the Moscow region said rescuers would continue to scour the site for "several days."
Investigators said people died both from gunshot wounds and from smoke inhalation after a fire engulfed the 6,000-seater venue.
"The terrorists used a flammable liquid to set fire to the concert hall's premises, where spectators were located, including wounded," the Investigative Committee said.
Flames had quickly spread through the venue on Friday after reports of the mass shooting, with screaming concert-goers rushing to emergency exits.
Some filmed the gunmen from the upper floors as they appeared to methodically walk through the stalls shooting people, footage shared on social media showed.
The Islamic State group claimed responsibility on Friday, saying its fighters attacked "a large gathering" on Moscow's outskirts and "retreated to their bases safely".
- Global condemnation -
Russian authorities have called it a "terrorist attack", but have not commented on the Islamic State's claim.
Some 107 people were still in hospital on Saturday morning, according to Russia's Emergency Situations Ministry.
Russian Telegram channels, including Baza which is close to the security services, and a lawmaker said some of the suspects were from the central Asian nation of Tajikistan.
In a statement, Tajikistan's foreign affairs ministry said it had not received any information from Moscow about the involvement of its citizens.
In Moscow, residents formed long queues in the Saturday morning rain to donate blood, according to videos posted by state media outlets.
Memorial posters featuring a single candle replaced advertising billboards at some Moscow bus stops, the RIA Novosti state agency reported.
Major events were cancelled across the country, including a friendly football match between Russia and Paraguay set to take place in Moscow on Monday.
Statements of condemnation from world leaders continued to roll in.
On Saturday, a spokesperson for Afghanistan's foreign ministry said the Taliban "condemns in the strongest terms the recent terrorist attack in Moscow, Russia ... and considers it a blatant violation of all human standards."
- US warning dismissed -
Attention is also being focused on Russia's powerful intelligence services in the wake of the attack.
Just three days before, Putin had publicly dismissed Western warnings of an imminent attack in Moscow as propaganda designed to scare Russian citizens.
On 7 March, the US embassy in Russia had issued a security alert saying it was "monitoring reports that extremists have imminent plans to target large gatherings in Moscow, to include concerts."
Washington said it had directly warned Russian authorities about a "planned terrorist attack" possibly targeting "large gatherings" in Moscow.
The United States had "shared this information with Russian authorities," National Security Council spokeswoman Adrienne Watson said.
But speaking to FSB chiefs last Tuesday, Putin said: "Recent provocative statements by a number of official Westerns structures about the possibility of terrorist attacks in Russia ... resembles outright blackmail and an intention to intimidate and destabilise our society."
Earlier in March, the FSB said it had killed Islamic State militants who were planning an attack on a Moscow synagogue.
Over recent weeks the agency has announced on an almost daily basis the arrest of several pro-Ukrainian saboteurs it said were plotting attacks on Russian military infrastructure.
