Many people have made theories about the Moscow attack. And Russia itself has blamed both "ISIS" and the Ukrainian intelligence for the attack.
Let me tell you one thing, it can be both. Here's how. You see, people seem to think ISIS is an entity like the FBI or CIA where the entire organization is centrally controlled. That is not quite how ISIS works. ISIS right now is a decentralized network of people who believe in the same ideology.
Hence, it is easy for strong intel agencies to infiltrate them. It is exactly why they also maintain cut off communication via telegram. In this method, one ISIS cell of say, 5 to 20 people have no idea about other ISIS cells living in the same city.
This ensures that even if a cell is infiltrated, they don't affect the entire organization. CIA has a history of infiltrating or trying to infiltrate ISIS. Sometimes, the US feds encourage people to join ISIS.
So, ISIS claiming the attack means nothing. If a CIA or GUR cell decided that they suddenly want to be ISIS, they surely can to deflect the blame on ISIS for an attack that is meant to hit their enemy hard for losing in conventional battles in the trenches.
Here's how such an attack would be carried out:
Ukrainian GUR would send out people to Russia to recruit idiots with mental issues and give them money to do terror bombing. Then they contact the ISIS telegram and tell them they are an ISIS cell inspired by the main ISIS wing at Afghanistan. They they take a photo and do the attack. Only the recruited idiots do the attack while the real intel guys safely leave via another country to turkey and then come back home to Ukraine.
Note that the Moscow attack didn't resemble ISIS central attacks. ISIS central generally does suicide bombings in a fearless manner. But Moscow bombers seem more like idiots who needed money. Please note that this is all speculation but the incentives strongly point towards such direction.
Ukrainian army is losing the fight. Hence, it is the perfect time for them to hit RU back in unconventional means. I personally do not view such attacks as unethical even though people might not like it. Russia is hitting Ukrainian energy infrastructure which can cause far more deaths. People die when there is no power in the operation theater.
And I find it disgusting that the US is backing out after cheering Ukraine in the beginning. The US government let the Ukrainians dream and gave them somewhat help while cutting almost all help 2 or so years later.
The talks in Turkey gave Ukraine an option for peace, but they were too cocky then because of US support. They won't have such favorable terms now in negotiations.
Lastly, It is better to be the enemy of the US, than its ally.