A faction of the Islamic State group claimed responsibility for the March 22, 2024, massacre at the Crocus City Hall concert venue.
Authorities said four gunmen, identified as citizens of Tajikistan, shot people who were waiting for a show by a popular rock band and then set the building on fire.
All 19 defendants were handed lengthy prison terms: 15 received life sentences, one received 22 and a half years and three were given 19 years and 11 months each.
Those with life sentences will serve part of them in a prison and the rest in a special regime penal colony, according to the verdict.
They were also ordered to pay fines ranging from 500,000 roubles to 2.7 million roubles (from $A8900 to $A48,000).
The trial began in August 2025 in a military court, as is customary for terrorism charges, and took place behind closed doors, with authorities citing security concerns.
Three military court judges presided.
President Vladimir Putin and other Russian officials have claimed that Ukraine had a role in the attack.
Ukraine has strongly denied any involvement.
The Investigative Committee, Russia's top criminal investigation agency, said the attack was "planned and carried out in the interests of the current leadership of Ukraine in order to destabilise the political situation in our country".
It also noted the four suspected gunmen tried to flee to Ukraine.
They were arrested hours after the attack and later appeared in a Moscow court with signs of being severely beaten.
Those tried alongside them included three men who sold the suspected gunmen a car, a man they rented an apartment from, and 10 others accused of terrorist ties, according to independent Russian news site Mediazona.
