A BBC investigation has concluded that a coordinated campaign of sabotage and online provocation originating in Russia played a central role in arson attacks on properties linked to UK Prime Minister Sir Keir Starmer. The inquiry links the operations to a network that used Telegram and social platforms to create fake far‑right and faux‑Islamic groups, recruit people in the UK, pay them to commit vandalism and spread disinformation.
Convictions and the anonymous handler
Roman Lavrynovych, a 22‑year‑old Ukrainian builder, was convicted of conspiring to commit arson after being recruited on Telegram. Messages shown in court and recovered by the BBC reveal an anonymous handler saved in Lavrynovych’s phone as “EL Money” (or simply “EL” on Telegram) who pushed him from posters and graffiti to arson, offering cash and — according to some messages — Russian citizenship as incentives. Lavrynovych was arrested within hours of setting fire to a car formerly owned by the prime minister. Two co‑defendants, including Petro Pochynok, were tried; Pochynok was found not guilty.
Identity and alleged links to the Russian state
Open‑source analysis by the BBC identified the initials “EL” with Evgeny Lyukshin, a 23‑year‑old linked online to the Russian foreign ministry and training at MGIMO, the Moscow diplomatic academy. Lyukshin’s social posts and membership in Telegram channels used to push the campaign match language and timestamps pointing to Russia. The BBC found images placing him at diplomatic events and in ministry premises; he is the son of a senior Russian diplomat. Lyukshin did not respond to BBC questions. Hours after being contacted about his membership of one channel, that Telegram channel and several related propaganda channels disappeared.
Methods: fake groups, paid attacks and disinformation
The campaign ran multiple fake entities to stoke division. Direct Action UK was presented as a homegrown far‑right group offering cash for attacks on police, mosques and other targets. Takbir Foundation was a bogus Islamic organisation apparently designed to provoke the far right by encouraging “sacred graffiti” on public buildings. Both operations used payments — often small sums or cryptocurrency — to recruit people who would then produce real‑world vandalism, which was amplified online.
Direct Action’s material included videos branding the prime minister a traitor and calling for violence; it also lionised figures such as Tommy Robinson. After the arson attacks, Russia‑based accounts pushed an entirely false narrative that the Ukrainian suspects were sex workers and that the fires were linked to a personal scandal; that lie was amplified by Robinson and reposted by prominent Russian figures.
The fake groups also coordinated specific tasks. The BBC traced attempts to hire people to spray‑paint the Islamic shahada and Quranic verses on UK buildings, and other ads offering payment to photograph vandalised sites so the material could be publicised. Some people approached refused; others, including Lavrynovych, carried out acts for money, according to court testimony.
Impact and reporting to authorities
Direct Action’s campaigns preceded and coincided with a wave of mosque vandalism across London: the BBC identified incidents in Croydon, Leyton and elsewhere where anti‑Muslim graffiti appeared after the group offered payment for Islamophobic attacks. Anti‑racist group Hope Not Hate and Tell Mama, which monitors anti‑Muslim hate, reported their concerns to UK counter‑terror police, warning that the operation appeared to be grooming or paying people to mount attacks. Both groups say they received limited responses from authorities at the time.
Official responses and assessments
The Russian embassy rejected the BBC’s findings, saying it “rejects any attempt to associate Russia or its foreign ministry with unlawful activities” and denied hostile intentions toward the UK. The Metropolitan Police said it was investigating seven criminal damage incidents as anti‑Muslim hate crimes and is “keeping an open mind” about links between offences; it also said it had not proven EL’s identity or established state backing. Counter Terrorism Policing London said the aim of the attacks was “to intimidate and create fear for the prime minister and to attack the UK.”
Sources in the UK and Ukraine have told the BBC they privately concluded that Russia was behind the attacks. Former defence secretary Ben Wallace told the BBC the evidence pointed to a “very deliberate and definite escalation against the British state” and that ordering attacks on property linked to the prime minister would likely have come from senior levels.
Broader context: hybrid warfare and training
The BBC investigation connects the campaign’s techniques to a wider Russian playbook of “hybrid” operations: creating false grassroots channels, amplifying polarising content, recruiting proxies and using layers of deniability. The report links the same networks to Rybar, a state‑linked media organisation accused by US and UK authorities of running campaigns to sow discord abroad. The BBC found that Lyukshin trained with programmes on “information warfare” associated with Rybar and that those courses are taught by figures with deep ties to Russian intelligence and the Kremlin.
Conclusion
The BBC’s reporting shows a sustained online and offline effort using fake organisations, paid recruitment and disinformation to provoke criminal acts and public division in the UK. While the Metropolitan Police says it has no evidence to prove state backing and Lyukshin has not answered the BBC’s inquiries, the pattern of activity, the ties to Russian‑based channels and the disappearance of related propaganda feeds after questioning strengthen the case that the attacks were part of a Russia‑linked campaign.