I have heard different versions, but even knowing that ISIS is a thing of its own and defies any understanding, they are Muslims, and now is the holy month of Ramadan. AFAIK, war is allowed in Ramadan, Muslims can even break the fast to fight, especially if it is a defensive war. If it is a terrorist act, I'd expect the terrorists to make a certain manifesto, to demand something. ISIS fighters are unafraid to die, would they not make a declaration before death?
These men had no weapons, no "shahid's belts" on them when caught. You'd expect a person ready for martyrdom to blow up himself, the car and the arresting group. This would be the straight way into heaven. Yet it didn't happen.
Everyone seems to connect the terrorist act with ISIS, and ISIS took the responsibility, but I question if the detained are "the same terrorists from ISIS" who killed and burned people in Crocus? Or perhaps ISIS used these people as decoy, and their tortures being caught on camera and posted online is a big plus for ISIS.
Muslim diaspora in Russia is huge. Migrants are the important part of economy in many countries. Muslims working in Russia may get scared and leave, which will be a blow for Russian economy. Plus, now ISIS might unleash true terror in revenge for the torture and the humiliation of their Muslim brothers. Plus, situations like this pave the way for ISIS to recruit new members.
IMHO, ISIS was most likely involved, but I am not quite sure if these four were not used in the dark. We've seen the Chechen fighters, we have seen ISIS. They usually don't allow to capture themselves alive.