Gunmen sprayed civilians with bullets just before Soviet-era rock group Picnic was to perform to a full house at the 6200-seat the Crocus City Hall just west of Moscow.
Verified video showed people taking their seats in the hall, then rushing for the exits as repeated gunfire echoed above screams. Other video showed men shooting at groups of people. Some victims lay motionless in pools of blood.
Suddenly there were bangs behind us - shots. A burst of firing - I do not know what," one witness, who asked not to be identified by name, told Reuters.
"A stampede began. Everyone ran to the escalator," the witness said. "Everyone was screaming; everyone was running."
Moscow mayor Sergei Sobyanin says a "terrible tragedy" has occurred at the Crocus City Hall. (EPA PHOTO)
Russian investigators said the death toll was more than 60. Health officials said about 145 people were wounded, of which about 60 were in critical condition.
In the 2004 Beslan school siege, Islamist militants took more than 1000 people, including hundreds of children, hostage.
Russian President Vladimir Putin was being updated by security chiefs about the situation, including from Alexander Bortnikov, the head of the Federal Security Service (FSB), the Kremlin said.
Islamic State, the militant group that once sought control over swathes of Iraq and Syria, claimed responsibility for the attack, the group's Amaq agency said on Telegram.
A grainy picture was published by some Russian media of two of the alleged attackers in a white car.
The fate of the attackers was unclear as firefighters battled a massive blaze and emergency services evacuated hundreds of people while parts of the venue's roof collapsed.
The United States has intelligence confirming Islamic State's claim of responsibility for the shooting, a US official said. The official said Washington had warned Moscow in recent weeks of the possibility of an attack.
"We did warn the Russians appropriately," said the official, speaking on condition of anonymity, without providing any additional details.
Russia has yet to say who it thinks is responsible.
Russian authorities have tightened security at airports and stations and across the capital Moscow. (AP PHOTO)
Hours before the embassy warning, the FSB said it had foiled an attack on a Moscow synagogue by Islamic State's affiliate in Afghanistan, known as ISIS-Khorasan or ISIS-K, and seeks a caliphate across Afghanistan, Pakistan, Turkmenistan, Tajikistan, Uzbekistan and Iran.
Putin changed the course of the Syrian civil war by intervening in 2015, supporting President Bashar al-Assad against the opposition and Islamic State.
"ISIS-K has been fixated on Russia for the past two years, frequently criticising Putin in its propaganda," said Colin Clarke of the Soufan Centre.
The broader Islamic State group has claimed deadly attacks across the Middle East, Afghanistan, Pakistan, Iran, Europe, the Philippines and Sri Lanka.
Russian Foreign Ministry spokeswoman Maria Zakharova said it was a "bloody terrorist attack" that the entire world should condemn.
The United States, European and Arab powers and many former Soviet republics expressed shock and sent their condolences. Ukrainian presidential adviser Mykhailo Podolyak denied any Ukrainian involvement.
The United Nations Security Council condemned what it called a "heinous and cowardly terrorist attack."
Russia tightened security at airports, transport hubs and across the capital - a vast urban area of over 21 million people. All large-scale public events were cancelled across the country.
At Crocus City Hall, flames leapt into the sky, and plumes of black smoke rose above the venue as hundreds of blue lights from emergency vehicles flashed in the night.
Helicopters sought to douse flames that engulfed the large building. The roof of the venue was collapsing, state news agency RIA said.
"A terrible tragedy occurred in the shopping centre Crocus City today," Moscow Mayor Sergei Sobyanin said. "I am sorry for the loved ones of the victims."
