Russia has said from the outset that it is pursuing a Ukrainian link to the attack, even though Kyiv has denied it and the militant group Islamic State has claimed responsibility.
In a statement, the state Investigative Committee said for the first time that it had uncovered evidence of a Ukrainian link. While it described the nature of the alleged evidence, it did not publish it.
"As a result of working with detained terrorists, studying the technical devices seized from them, and analysing information about financial transactions, evidence was obtained of their connection with Ukrainian nationalists," the statement said.
It said the attackers had received significant amounts of cash and cryptocurrency from Ukraine, and that another suspect involved in terrorist financing had been detained.
Eleven people were arrested in the first 24 hours after last Friday's attack and eight of these, including the four suspected gunmen, have been placed in pre-trial detention. Seven are from the Central Asian state of Tajikistan and the other from Kyrgyzstan.
The United States had publicly warned before the concert shooting that it had received intelligence of a possible attack by extremists in Russia. U.S. officials say they believe it was Islamic State Khorasan, the network's Afghan branch, that was responsible.
Russia says it is suspicious that the U.S. was able to name the alleged perpetrator of the attack so soon after it took place. The head of Russia's FSB security service said earlier this week, again without providing evidence, that he believed Ukraine, along with the U.S. and Britain, were involved.
Western security analysts say the attack raised questions about the resourcing and priorities of Russian intelligence agencies that have been heavily focused on the Ukraine war and the need to stamp out opposition to it within Russia.
(Reporting by Reuters; Editing by Angus MacSwan)
