A week ago, President Vladimir Putin swaggered triumphantly onstage at a post-election event surrounded by young people in “Putin — Russia — Victory” T-shirts, and he confidently shrugged off Western criticism of the vote as neither free nor fair.

This weekend, a very different Putin addressed a nation shocked by a massacre at a rock concert on Moscow’s outskirts. His image as a tough leader was badly dented by gunmen who mowed down dozens of people, unchecked by police or security.

Appearing Saturday on TV, hours after the attack that killed 137 people and wounded more than 100, he sought to make it serve his political goals by alleging a link between the gunmen and Ukraine, saying the assailants planned to flee there. He made no mention of the Islamic State group that claimed responsibility or of Kyiv’s denial of involvement.

It’s not the first time in his nearly a quarter-century in power that Putin has tried to use a failure by his security services to achieve his aims.

The 71-year-old former KGB officer came to power on the final day of 1999 while spearheading a war to crush separatists in the mostly Muslim republic of Chechnya who had mounted an incursion into a neighboring province.

He also blamed Chechens for a series of apartment building bombings in Russia, burnishing his macho persona with a famous pledge to hunt down terrorists: “If we catch them in the outhouse, we will flush them down the toilet.”

Some Kremlin critics alleged that the apartment bombings in 1999 could have been staged by Russian security agencies in a false-flag operation to help Putin’s rise and rally broad support for the war in Chechnya. The claims were never independently proven and were strongly rejected by Putin and Kremlin officials.

Ukrainian President Volodymyr Zelenskyy alluded to them as he dismissed Moscow’s allegations of a Ukrainian connection in Friday’s attack, accusing Putin of using his own citizens as “expendables.”

Long after the battles in Chechnya died down, Russia suffered a series of deadly attacks, including the 2002 siege at a Moscow theater and the 2004 hostage crisis at a school in Beslan in southern Russia. Other attacks targeted public transportation, as well as plane and airport bombings linked to Chechen separatists and later to al-Qaida and Islamic State.

But these have been rare in more recent years as Moscow-backed regional strongman Ramzan Kadyrov used his feared security forces to stabilize Chechnya. Friday’s attack revived the sense of vulnerability that Putin has sought to replace with strong control and domestic stability, despite the war in Ukraine.

Kremlin critics assailed Putin for focusing Russia’s massive police and security services on stifling political opponents, human rights groups and LGBTQ+ activists while leaving the country unprotected from threats by armed extremists.

Maria Pevchikh, a top associate of opposition leader Alexei Navalny — who died in an Arctic penal colony last month — said the security agencies were “too busy fighting politicians, activists and journalists, so they didn’t have time left to deal with terrorists.”

Many commentators wondered how the attackers could conduct their deadly raid and leave the entertainment complex without any police response. Officials said the suspected gunmen were arrested hours later in the western Bryansk region as they headed for Ukraine.

“What happened is unique in that for the first time in Russia, during a terror attack of this scale, security forces were unable to prevent the terrorists’ action in any way: They freely entered the building, killed and wounded scores of people, and calmly left the scene of the massacre,” political analyst Vladislav Inozemtsev wrote in a commentary. “Years of tightening security and trillions of rubles were spent in vain.”

U.S. officials confirmed the claim of responsibility by the Islamic State affiliate and said they had shared information this month with Russia about a planned assault in Moscow, adding that there was no Ukrainian involvement whatsoever. But three days before the attack, Putin denounced the U.S. warning as an attempt to frighten the Russians and “blackmail” the Kremlin ahead of the presidential election.

Mark Galeotti, head of the Mayak Intelligence consultancy, said Putin had suffered a major blow to his image as the “tough defender of the motherland.”

He said the raid — the deadliest attack on Russian soil in two decades — would eat at Putin’s legitimacy, creating “that slow and accelerating sense that this is no longer the Putin that was, that he’s no longer really fit for the times, that he’s no longer able to deliver on his promises.”

Galeotti countered allegations by some Kremlin critics that a slow and bungled official response to the attack was a possible sign of a false-flag operation.

Putin has warned that recent Ukrainian attacks on the border regions “won’t be left unpunished.”

Hours before Friday’s concert hall bloodshed, the Russian military unleashed a barrage on Ukraine’s energy system, crippling its largest hydroelectric plant and leaving over 1 million without power in what the Russian Defense Ministry described as “strikes of retribution.” More strikes followed over the weekend.

On Sunday, Poland demanded an explanation from Russia after one of its missiles strayed briefly into Polish airspace during a major missile attack on Ukraine, prompting the NATO member to activate F-16 fighter jets.