Russia Linked to Starmer Arson Attacks in UK Sabotage Probe

Starmer arson attacks are being examined as part of a wider investigation into an alleged sabotage network linked to Russian influence operations, according to findings reported this week.

Even after he set fire to Sir Keir Starmer’s house, Roman Lavrynovych, convicted this week of conspiring to commit arson, seemed to know as much about the Prime Minister as a bullet knows about its target. During police questioning, when asked if he knew who the head of the British government was, the 22-year-old Ukrainian builder simply shook his head. He had never heard of Keir Starmer. He was, according to investigators, a “weaponised” individual, recruited through a messaging app to strike at the heart of the British state for a few thousand pounds.

A months-long BBC investigation has now uncovered that the arson attacks targeting properties connected to the Prime Minister were not isolated acts of criminal damage. Instead, they formed the tip of a spear in a sophisticated, Russian-backed campaign of sabotage, provocation, and disinformation designed to sow chaos on the streets of Britain. At the centre of this web is a shadowy handler known only as “EL,” whom the BBC has identified as a young Russian national with ties to the highest levels of the Kremlin’s diplomatic and intelligence circles.

The plot, which saw a car and two residences linked to Sir Keir set ablaze in May 2025, has exposed the evolving frontline of “hybrid warfare.” It is a conflict where the battlefield is the Telegram messaging app, the soldiers are cash-strapped foreign nationals, and the objective is not just physical destruction, but the total erosion of social cohesion in the United Kingdom.

The Three Fires of May

The campaign of violence began in the early hours of 8 May 2025. In a quiet street in Kentish Town, North London, a Toyota car was engulfed in flames. To the casual observer, it was a random act of vandalism. To the police, it was a significant red flag: the car had previously been owned by Sir Keir Starmer.

Three days later, on 11 May, a second fire was discovered at the entrance to a block of flats in Islington where the Prime Minister had once lived. The escalation reached its peak on 12 May, when a fire was set at the front door of Sir Keir’s former family home in Kentish Town. The property, which the Starmers had moved out of upon entering Downing Street, was being occupied by his sister-in-law at the time.

“Three fires in the same area within five days would be pretty unusual,” prosecutor Duncan Atkinson KC told the Old Bailey during the trial of Lavrynovych and his associates. “But fires all involving property linked to the same person were beyond a coincidence.”

The court heard how Lavrynovych had been caught on CCTV buying white spirit—a common accelerant—at a B&Q in South London just days before the attacks. Phone data placed him at the scene of each fire. On his device, police found a “targeting pack” detailing the locations and a series of messages from a handler who went by the name “El Money.”

‘EL’: The Man Behind the Screen

While the trial focused on the physical acts of arson, the BBC has spent months tracing the digital footprint of “EL.” On Telegram, EL presented himself as a source of easy money for Ukrainians living in London. He posted in job groups, initially offering small sums for simple tasks like putting up posters or spraying graffiti.

However, the BBC’s investigation found that EL was far more than a petty criminal. Using open-source intelligence and data leaks, investigators identified EL as 23-year-old Evgeny Lyukshin. Lyukshin is the son of a senior Russian official and has reportedly received training in information warfare and online influence operations.

In private Telegram chats uncovered by the BBC, Lyukshin’s true ideology was on full display. He frequently used derogatory terms for Ukrainians, glorified President Vladimir Putin, and described himself as a defender of the “white Slavic race.” In one message, he boasted that his father “leaks” sensitive documents from NATO and the CIA to him.

“Work for the glory of the nation to spite your enemies,” Lyukshin wrote in one recruitment pitch, offering $1,000 and the promise of Russian citizenship in exchange for arson attacks.

When the BBC challenged Lyukshin on his activities, he did not respond. Hours later, the propaganda channels he managed vanished from the internet.

The ‘Direct Action’ Deception

The arson attacks on the Prime Minister were only one part of Lyukshin’s operation. The BBC investigation found that he was also the architect behind “Direct Action UK,” a fake far-right organization designed to inflame racial and religious tensions in Britain.

Direct Action UK appeared online in the autumn of 2024, capitalizing on the civil unrest that followed the Southport murders. The group’s social media channels featured slickly produced videos branding Sir Keir Starmer a “traitor” and calling for a “war” against the Islamisation of Britain. It lionized far-right figures like Tommy Robinson and offered cash rewards for attacks on mosques and police stations.

But the group was a digital phantom. Messages sent in the Direct Action Telegram group bore Moscow timestamps and used Cyrillic characters. The “grassroots” support it claimed to have was bought and paid for.

The real-world consequences, however, were devastating. In London, six mosques and an Islamic school were vandalised with Islamophobic graffiti—including slogans like “Stop Islam” and “Remigration”—after Direct Action offered payment for the acts. The morning after a mosque in Leyton was defaced, Lyukshin posted an ad in a Ukrainian job group asking for someone to “take pictures of two buildings” in the area. He wanted the photographic evidence to amplify the fear online.

The Mirror Image: Takbir Foundation

In a chilling display of “double-agent” tactics, the investigation revealed that Lyukshin also ran a mirror-image organization called the “Takbir Foundation.” This group presented itself as a radical Islamic movement, calling for “jihad throughout England” and offering “halal money” for graffiti on British landmarks.

The goal was transparent: to provide the far-right with the very provocations they needed to justify their own violence. In Bristol, two graffiti artists were recruited by a fake Facebook account linked to Lyukshin to spray Islamic declarations of faith on a defunct department store and a Conservative Club. Neither artist was Muslim; they were simply looking for a “paid opportunity with a generous budget.”

By running both sides of the extremist coin, Russian operatives were able to create a self-sustaining cycle of hatred and division, all while remaining thousands of miles away.

A Campaign of Disinformation

Following the arson attacks on Sir Keir’s properties, a second wave of the operation began: the disinformation campaign. Within hours of the fires, Russian-linked social media accounts began spreading a false narrative that the attacks were linked to a personal sex scandal involving the Prime Minister.

These claims were amplified by high-profile far-right activists in the UK, creating a cloud of suspicion and distracting from the true nature of the plot. Security experts say this is a classic “active measures” tactic—flooding the information space with multiple, conflicting stories to ensure that the truth becomes impossible to discern.

“The objective isn’t always to make you believe a specific lie,” says one former intelligence officer. “It’s to make you stop believing in anything at all. It’s about creating a state of permanent confusion.”

Warnings Ignored

Perhaps most troubling is the revelation that British authorities were warned about the Russian link months before the attacks on the Prime Minister took place.

Nick Lowles, CEO of the anti-racism organization Hope Not Hate, told the BBC that his team had identified Direct Action UK as a Russian operation as early as February 2024. They reported their concerns to counter-terrorism police, warning that the group was “grooming UK residents to launch a terror attack.”

Tell Mama, a group that monitors anti-Muslim hate, also passed evidence to the authorities. Both organizations say they received little more than a standard acknowledgement.

“It’s something that is happening online, but it’s actually moving directly into criminal damage and criminal acts of violence on our streets,” says Iman Atta, CEO of Tell Mama. “We feel these warnings were not taken seriously enough.”

In response, the Metropolitan Police stated that they are investigating several instances of criminal damage as hate crimes and are “keeping an open mind” regarding potential links to foreign state actors.

The New Frontline of Sabotage

The plot against Sir Keir Starmer is part of a broader, more aggressive pattern of Russian sabotage across Europe. Since the full-scale invasion of Ukraine in 2022, intelligence agencies have reported a surge in arson attacks, GPS jamming, and assassination plots linked to the GRU, Russia’s military intelligence service.

In London, several men are currently awaiting trial for a Russian-ordered arson attack on a warehouse providing aid to Ukraine. In Germany and Poland, individuals have been arrested for plotting to sabotage military infrastructure.

Former UK Defence Secretary Ben Wallace described the targeting of the Prime Minister’s properties as a “significant escalation.” He argued that any operation of this magnitude would have required approval from the highest levels of the Russian system.

“This is not just a few rogue hackers,” Wallace said. “This is a state-sponsored campaign of terror designed to undermine our democracy and our resolve.”

The Verdict and the Future

On Monday, the trial of the three men at the Old Bailey concluded. Roman Lavrynovych and Stanislav Carpiuc were found guilty of conspiracy to commit arson. A third man, Petro Pochynok, was acquitted.

For Lavrynovych, the “halal money” and the promise of a new life in Russia never materialized. Instead, he faces a lengthy prison sentence in a country whose politics he claimed not to understand.

The Russian Embassy in London continues to deny any involvement, dismissing the findings as “baseless allegations” and insisting that Russia “harbours no aggressive intentions towards Britain.”

But for the security services, the case of the Starmer fires is a wake-up call. It has demonstrated that the barriers between the digital and physical worlds have dissolved. A young man in a Moscow suburb can now reach into a London street and set a house on fire with little more than a Telegram account and a few thousand dollars in cryptocurrency.

As Britain prepares for future threats, the lesson of the May arson plot is clear: the most dangerous weapons in modern warfare are no longer missiles or tanks, but the “useful idiots” recruited through the screens in our pockets.

The Anatomy of a Hybrid Attack

The campaign against Keir Starmer followed a precise, multi-stage blueprint that security experts call the “Hybrid Attack Lifecycle.”

This model allows a hostile state to achieve strategic objectives—destabilizing a rival government—without ever firing a shot or risking the lives of its own agents. It is cheap, effective, and, until now, largely conducted in the shadows.

Key Figures in the Investigation

•Roman Lavrynovych: A 22-year-old Ukrainian builder who carried out the arson attacks. Convicted of conspiracy.

•Evgeny Lyukshin (EL): The suspected Russian handler. A 23-year-old with ties to Russian diplomatic circles.

•Sir Keir Starmer: The target of the campaign. Properties linked to him were set on fire to send a message of intimidation.

•Nick Lowles: CEO of Hope Not Hate, whose organization first identified the Russian link to “Direct Action UK.”

•Duncan Atkinson KC: The lead prosecutor who detailed the “coincidence” of the three fires at the Old Bailey.

Do you believe Russia is increasingly using online influence and covert operations to destabilise Western countries, or are such claims difficult to prove? Share your thoughts in the comments.