The false flag apartment bombings were carried out by actual Russian security services - not Chechen assets, or militants.
On an related unrelated note, some of Russian agents who took part were comically stupid. If you aren’t aware of the Sims vs SIM card mix-up, do yourself a favor and look it up.
Edit: as pointed out below, the Sims vs SIM card was not part of the 1999 false flag operation, but a more recent one (2022). My bad.