TALLINN, Estonia (AP) — Russian authorities on Friday again tried to link the deadly attack on a Moscow concert hall to Ukraine, saying one of the detained suspects had photos on his phone depicting troops in camouflage uniforms with the Ukrainian flag.

Ever since the March 22 mass shooting and fire at the Crocus City Hall concert venue that killed 145 people, Russian officials have sought to blame Ukraine for the massacre, even though Kyiv has denied any involvement and an affiliate of the Islamic State claimed responsibility.

Authorities, including President Vladimir Putin, have provided no evidence for the link as they sought to shift the narrative from the failure by security services to prevent the attack.

Russia’s top law enforcement agency, the Investigative Committee, said in a statement Friday that authorities found photos in one of the suspects’ phones depicting “people in camouflage uniforms with the Ukrainian flag against the background of destroyed houses.”

The phone also bore an image of a Ukrainian postage stamp with an obscene message, the committee said. It did not release the image, but it could be referring to a popular postage stamp issued by Kyiv that commemorates a moment early in the 2022 invasion when Ukrainian soldiers reportedly issued a defiant expletive at a Russian warship.

The committee also said one of the suspects sent images of access roads and entrances to the concert hall to their handler on Feb. 24 — the second anniversary of Russia’s invasion of Ukraine.

The findings “may indicate between the terrorist attack and the carrying out of the special military operation,” the committee said, using the Kremlin’s euphemism for the war. The agency’s claims couldn’t be independently verified.

On the day after the attack, authorities said they captured four men in the Bryansk region that borders Ukraine and alleged they had carried out the shootings. Putin and other officials claim the four were headed for Ukraine.

The four, identified as Tajik nationals, appeared in a Moscow court on terrorism charges and showed signs of severe beatings. A number of others have been arrested as accomplices in several Russian regions, and detentions of people possibly linked to the attackers were reported in Tajikistan, as well.

The attack came two weeks after the U.S. Embassy in Russia issued a warning about a possible attack in Moscow on a large gathering. The U.S. State Department said it passed information about the threat to Russian officials.

Putin spokesman Dmitry Peskov this week declined comment on a report in The Washington Post that U.S. officials had specifically identified Crocus City Hall as a potential target, saying that was a matter for the security services.

The attack marked a major security failure under Putin, who came to power 24 years ago by taking a tough line against those he labeled terrorists from the Russian region of Chechnya who were waging an insurgency.

The security lapse has led many to ask how gunmen could kill so many people at a mass gathering, with critics accusing Russia’s security forces of focusing on stifling political dissent rather than dealing with real public threats.