They are based in Afghanistan right?
Ostensibly yes, although most of their activity over the years has been in Syria, including US controlled regions. There's also been a lot of informed speculation that there almost is no cohesive organisational structure really anymore. That it's more of a loose-knit web of small, disparate figures with some contacts (and funding) in common, and that it's increasingly just mercenary actions for pay.
Putin has said the attack was Ukranian. They have the terrorists in custody so hopefully some kind of evidence can be produced either way.
It seems that they're Tajik guys, some of whom had residency and other connections in Ukraine, who were recruited through a Telegram channel for a specific preacher by an unknown third party. They're clear not very bright and were provided weapons, Intel etc from an outside source and claim they were offered $5000 in rubles (half before, half to be paid after) to do the job.
That's a tiny amount but a lot of Tajiks in and around Russia and Ukraine a pretty desperately poor, often have dubious immigration status, and are routinely exploited by everything from slum lords to seasonal farming work and dodgy construction work.
The other Ukrainian connection is that for the reasons above, Ukraine has been actively recruiting Tajiks to fight in its foreign legion style army with even ministers putting out public calls for them to get paid to fight for Ukraine in recent weeks and months. So let's just say it certainly fits a pattern.