Arson targeting Keir Starmer properties originated in Russia

A Russian online sabotage network was behind a series of arson attacks on Sir Keir Starmer’s family home and other targets linked to the UK prime minister, an FT investigation has found.

Roman Lavrynovych, a 22-year-old Ukrainian construction worker based in London, was on Monday convicted of the arsons, which Starmer last year called “an attack on democracy”, after a six-week trial at the Old Bailey.

Prosecutors in the case did not disclose information about the identity of Lavrynovych’s handler, other than to reveal that they used the Telegram handle “El Money” and communicated in Russian and Ukrainian.

An FT investigation based on Telegram archives, cryptocurrency wallets, court evidence and interviews with western officials has established that El Money was located in Russia and was closely aligned with NoName057(16), a pro-Kremlin hacktivist group that the US has called a Russian “state-sanctioned project”.

NoName and other Russian patriotic cyber groups have sought to recruit proxies online to further the Kremlin’s geopolitical interests, as well as foment disorder across Europe by amplifying far-right and anti-migrant messages.

The same handler who orchestrated the arson attacks also recruited people in the UK to paint anti-Islamic graffiti at mosques and other sites across London — illustrating the extent to which Russia-based actors have attempted to exacerbate social tensions in Britain. 

The extent of NoName’s operational ties to the Russian government is murky. The US Cybersecurity and Infrastructure Security Agency has said NoName and the hacking tools associated with it were created as a “covert project” of an information technology organisation established by the Kremlin.

CISA said some people within the decentralised NoName network are “individuals who support Moscow’s agenda but lack direct governmental ties” but that others “appear to have associations with the Russian state through direct or indirect support”.

Mark Galeotti, a military expert and honorary professor at University College London’s School of Slavonic and East European Studies, said: “In the main, these hacking groups are not tasked by the authorities . . . A lot of these people will regard themselves as patriots. Obviously, the Kremlin relies on deniability. The trouble is, the more attacks there are, the more implausible the deniability.”

Moscow-linked sabotage operations across Europe have increased in frequency and aggressiveness in recent years, but the arson attacks at Starmer’s properties are the most dramatic example of a western leader being targeted by Russian hacktivists using criminal proxies.

“Russia operates on a free-flowing exchange of activity and expertise between state intelligence agencies and criminal groups,” said Ciaran Martin, the former head of the UK’s National Cyber Security Centre, a branch of signals intelligence agency GCHQ. “Most of the time, hackers and criminals are free to do what they want, as long as they leave Russian interests unharmed or are seen to advance them.”

El Money recruited Lavrynovych on Telegram in late 2024, a time when the Ukrainian had been posting in Russian- and Ukrainian-language Telegram groups seeking “casual work” in London, messages obtained by the FT show. He posted more than 100 times asking for jobs between August 2024 and May 2025.

Lavrynovych was initially paid by El Money to print posters advertising a group called Direct Action and put them up at night across London, according to evidence obtained from his phone by British police.

On the surface, Direct Action was an English language far-right movement that encouraged people in Britain to attack mosques and police vehicles. One of its Telegram channels shared bomb-making and knife-attack manuals. On X it offered payment for people to “burn the police” as a form of protest against Starmer’s government.

The group began to operate after riots in the UK in the summer of 2024 sparked by false claims that a knife attacker at a children’s dance class had been Muslim or an asylum seeker. 

In fact Direct Action was administered by people in Russia who used virtual private networks to hide their locations and identities, and generated far-right videos and other content using AI.

They occasionally slipped up, accidentally posting Cyrillic characters into English-language posts and sharing content with a Russian timezone displayed.

Pictures taken by Lavrynovych and sent to his Russian-speaking handler to prove that he had put up Direct Action posters in London were later posted by the administrators of the group’s Telegram channel, messages collected by the UK anti-Islamophobia group Tell Mama show.

By early 2025, Direct Action had begun encouraging its online followers — which numbered in the low hundreds — to spray anti-Islamic graffiti on mosques and Islamic centres in south London.

At trial, Lavrynovych admitted carrying out at least two of these attacks. At least seven took place in London in January and February 2025. British authorities have not charged anyone with organising the graffiti campaign.

Evidence from the trial showed that the Russian handler El Money spent seven months grooming Lavrynovych to take part in initial low-level acts.

El Money eventually instructed Lavrynovych to attack a Toyota RAV4 formerly owned by Starmer as well as the prime minister’s family home and a property he previously lived in. No one was injured in the incidents.

El Money offered to pay Lavrynovych several thousand dollars in tether cryptocurrency, providing the arsons made national news. Lavrynovych said he was not told by El Money that the car and the two properties he was targeting were connected to the prime minister. Lavrynovych expressed anti-Russian sentiments in his police interviews after being arrested, calling Vladimir Putin a “terrorist”.

Evidence presented at Lavrynovych’s trial showed how on May 6 last year, two days before the first fire, Lavrynovych went to a B&Q near where he lived in Sydenham, south London. Police later obtained CCTV and till records showing he bought an accelerant: white spirit.

In the early hours of May 8 Lavrynovych travelled from his home by bus to Kentish Town, north London, where he set fire to the Toyota RAV4 that previously belonged to Starmer. Pictures of the car had been published by the British media in 2020 after Starmer had been involved in a collision with a cyclist.

Then on May 11 Lavrynovych travelled back to north London where he set a fire outside a flat in Islington where Starmer used to live in the 1990s.

The next attack was shortly after midnight on May 12. Lavrynovych set a fire at Starmer’s family home in Kentish Town. The prime minister’s sister-in-law was residing there. Starmer had moved to Downing Street after his election the previous year.

At 1.10am, Starmer’s sister-in-law called the fire brigade after hearing loud bangs and seeing smoke and fire at the front door. Her nine-year-old daughter was woken by smoke; the sister-in-law, who has asthma, struggled to breathe.

Lavrynovych told the jury at the Old Bailey that he had wanted to earn money because his father in Ukraine required medical treatment, and he had later begun to feel threatened by El Money and feared for his family’s safety.

It was only after the attacks that El Money revealed how much trouble Lavrynovich might be in.

During the trial the Metropolitan Police said it had been unable to establish if Lavrynovych had been paid for any of the jobs he did for El Money. Lavrynovych said he had been paid for earlier work, such as putting up the posters, but was never paid for the arsons. 

FT analysis of a cryptocurrency wallet address sent to El Money by Lavrynovych shows that the wallet received multiple small payments between January and November 2024 from wallets that had transacted with Garantex, a Russia-based crypto exchange.

Last year the US Treasury imposed sanctions on Garantex and said it had “directly facilitated notorious ransomware actors and other cyber criminals”.

El Money’s identity is unclear, but the FT has found that Direct Action had strong links to NoName-affiliated Telegram channels.

Direct Action shared a logo design, operational strategy and similar terror-related material with a now-deleted Russian-language Telegram group called Youth of the Saboteur.

Youth of the Saboteur provided detailed operational guides for its Russian followers to recruit Ukrainians living in western Europe to unwittingly carry out acts of sabotage, and to “burn Nato military infrastructure with someone else’s hands”.

Accounts associated with Youth of the Saboteur collaborated directly with the administrators of the official NoName Telegram channel, according to messages recovered by Molfar, a Ukrainian open-source intelligence company.

Lavrynovych’s co-defendant Stanislav Carpiuc, 27 was convicted of assisting him to carry out the arson attacks. A third defendant Petro Pochynok, 35, was acquitted.

Lavrynovych was convicted of conspiracy to commit damage with fire and two counts of damaging property by fire being reckless as to whether it would endanger life. He was acquitted of two counts of damaging property by fire with intent to endanger life.

In the early hours of May 13 last year, Lavrynovych was in the house he shared with his grandmother desperately messaging El Money on Telegram to see when he would receive payment for the arsons.

It was the last exchange Lavrynovych had with El Money. An hour and a half later, at 1.52am, the Metropolitan Police smashed down his front door and arrested him.