Kremlin's Shadow War Reaches Downing Street: Young Official 'Directed' Fire Attacks on Prime Minister's Home

Even after he had set fire to Sir Keir Starmer’s house, Roman Lavrynovych, a 22-year-old Ukrainian builder convicted on Monday of conspiring to commit arson, appeared to understand as little about the Prime Minister as a bullet might know of its target. His anonymous handler, known only by the initials EL, offered a telling clue in one message: “Look, you attacked the home of a very high-ranking person in Britain. I’ll send you money, you need to leave the city.” It was too late; Lavrynovych was arrested within hours. He had been weaponised to target the head of the British government, but the question of who had wielded him remained unanswered — until now.

An extensive investigation by this publication has uncovered evidence that the arson attacks on the Prime Minister’s property were but one component of a far broader campaign of sabotage, provocation and disinformation originating from the Russian state. The handler EL, who directed Lavrynovych, offered Russian citizenship as a reward for further attacks and glorified President Vladimir Putin, according to messages uncovered by reporters. We have identified evidence suggesting that EL is, in fact, Evgeny Lyukshin, a 23-year-old diplomat and the son of a senior Russian official, schooled in information warfare by spies and propagandists and closely connected to the highest echelons of power in Moscow.

Russian operatives ran their campaign of sabotage and provocation remotely, using social media and the messaging platform Telegram to create fake online far-right and Muslim groups. These phantom organisations were used to organise acts of vandalism across the United Kingdom and to stir up division and fear. Accounts based in Moscow posted falsehoods about the motive behind the Starmer arson attacks, falsehoods that were later amplified by far-right figures such as Tommy Robinson. The Russian embassy, for its part, issued a statement rejecting “any attempt to associate Russia or its foreign ministry with unlawful activities”, insisting that Russia poses “no threat to the United Kingdom or its people and harbours no aggressive intentions towards Britain”. Lyukshin did not respond to our questions, but within hours of our contacting him, a propaganda channel we had challenged him on had vanished.

Lavrynovych and Stanislav Carpiuc, a 27-year-old Ukrainian-born Romanian national, have now been convicted at the Old Bailey of conspiring to target property and a car connected to Sir Keir Starmer. A third man, Petro Pochynok, 35, was acquitted of conspiracy to commit arson. The first fire occurred last year when a Toyota, previously owned by the Prime Minister, was set ablaze in north London. Two further arson attacks followed: one at the entrance to flats where Sir Keir used to live, and another at the entrance to a house that had been rented to his sister-in-law after his move to Number 10. Yet the trial of the three men was remarkable chiefly for what it omitted; the true author of the drama was never revealed. The case focused narrowly on a financial motive, and the identity, connections and intentions of the anonymous handler who offered Lavrynovych money for the attacks were deliberately avoided.

In court, the handler was referred to only as “EL Money”, the name under which he was saved in Lavrynovych’s phone, though on Telegram he used the simpler initials “EL”. It was on this app that EL recruited Lavrynovych, finding him in a group for Ukrainians in London seeking work. From that innocuous initial connection, Lavrynovych was tasked with actions of escalating criminality: plastering posters, graffiti, and finally arson. He knew he was doing wrong, the court heard, but carried on regardless, hoping for a payday. EL’s ideology and goals were plain from his wider activities, which we uncovered using open-source tools. In various Telegram channels, messages from the EL account show him glorifying Putin and Russia, attacking the Ukrainian people and promoting Moscow’s narratives. “It is obvious that Putin is the leader of the white race,” he posted in one chat. He incited attacks on conscription centres in Ukraine, and offered $1,000 (£749) and Russian citizenship as a reward for arson attacks. “Work for the glory of the nation to spite your enemies,” he added.

EL also gave hints about his identity, offering Russians in other Telegram groups access to documents from Nato and the CIA. “My father leaks part of it to me, it was not for nothing that he went to Europe,” he wrote. There was no mention in the trial of what the posters put up by Lavrynovych on EL’s orders actually advertised: a purported far-right group called Direct Action UK. This group sought to appear as a genuine British creation, but we found that Direct Action was created online by Russian operatives to cause division among ordinary people in the UK. Messages in the group bore timestamps from Moscow, used Cyrillic letters, and placed the pound sign at the end of numbers, as is the Russian custom. The accounts principally involved in running Direct Action were using other channels to promote Russian political goals and communicating in Russian.

Direct Action first appeared online in autumn 2024, after the riots that followed the Southport murders, and its propaganda exploited images from that disorder. The group offered cash for attacks on police, branded Sir Keir a traitor, promoted hatred of Muslims, and offered money for violence and arson, including attacks on mosques. “This is war,” the group declared. And although Direct Action was fake, it generated real-life attacks. In London, six mosques and an Islamic school were vandalised last year after the group offered payment for Islamophobic graffiti. Slogans such as “remigration” and “Stop Islam” were spray-painted on mosques from Croydon in the south of the capital to Leyton in the east. Direct Action turned video clips of the vandalism into brash social media videos to amplify hatred and create fear. The morning after a mosque and primary school had been vandalised in Leyton, EL posted an innocent-sounding advertisement in a chat group for Ukrainian people seeking work: “Part time job today! Leyton District. You need to take pictures of two buildings.” He wanted images of the aftermath, so that the damage could be publicised online.

Anti-racist organisations Hope Not Hate and Tell Mama investigated Direct Action and reported their concerns to counter-terror police months before the arson attacks. Hope Not Hate concluded that Russians were behind the group and warned that people behind it might be grooming UK residents to launch a “terror attack against a mosque or identifiably Muslim target in the UK”. No reply was received, said Nick Lowles, CEO of Hope Not Hate. Tell Mama also passed evidence to counter-terror police and received only an acknowledgement. Iman Atta, Tell Mama’s CEO, expressed concern that such actions were not taken seriously by the authorities, noting that what begins online is “moving directly into criminal damage and criminal acts of violence and terrorism on our streets”. The Metropolitan Police told the BBC it is investigating seven instances of criminal damage as anti-Muslim hate crimes, adding that it is “keeping an open mind” as to whether the offences are linked.

Before EL began running fake far-right groups, he helped to create a bogus Islamic organisation called the Takbir Foundation. The username for EL’s Telegram account previously bore the foundation’s name, and the foundation sought to recruit Muslims to spray-paint “sacred graffiti” in the UK, inflaming the far right. The foundation offered up to £150 for graffiti in one location, claiming “this is halal money to promote the word of Allah”. But just as Direct Action would later pay people who were not genuinely on the far right, the Takbir Foundation offered money to non-Muslims to spray Islamic graffiti. We tracked down two Bristol graffiti artists who separately responded to an advertisement by a fake Facebook account for a “paid opportunity with a generous budget”, with no reference to Islam. Both were asked to spray-paint the Islamic shahada on a defunct Debenhams in the city centre; one was also asked to spray a Quranic verse on a Conservative Club. Both refused.

EL was sowing hatred on Britain’s streets, and then his fake foundation was ensuring the message spread to the Muslim community online. The attack on the Prime Minister’s property was also used for online propaganda. One lie spread on social media by Russia-based accounts became particularly well-known: that the three Ukrainian suspects were sex workers, implying the fires were the result of a personal sex scandal. The claim was entirely untrue, but it was taken up by Tommy Robinson, the very figure who had been promoted by Direct Action, EL’s fake far-right group. Robinson claimed on X that Sir Keir Starmer had been “banging” Ukrainian male sex workers and posted a fake image of the Prime Minister with the suspects. Putin’s special presidential envoy, Kirill Dimitriev, reposted one of these messages.

These attacks fit the pattern of a wave of Russian-backed sabotage across Europe over the past five years, in which proxies are recruited for acts of violence and espionage. The National Police of Ukraine stated that, in one Russian network plotting sabotage in 11 countries including the UK, a third of participants were Ukrainians — a tactic that serves to discredit Ukraine in the eyes of its allies. More often, it is age rather than nationality that attracts recruiters, with young people offered “easy money” for low-level crime and blackmailed if they attempt to refuse. In the Direct Action Telegram chat group, we identified a member of the Russian elite associated with the Ministry of Foreign Affairs: Evgeny Lyukshin, whose initials match those of the handler. We found Lyukshin again in a private chat for Radio Southport, a channel created by Rybar, a state-controlled media organisation accused by the US of seeking “to sow discord, promote social division, stoke partisan and racial discord, and encourage hate and violence”. Rybar has also been sanctioned by the UK government.

A picture posted by the Ministry of Foreign Affairs shows Lyukshin standing behind Deputy Foreign Minister Alexander Grushko at a Diplomats’ Day event in Moscow in February. Another photo he posted on social media placed him in the car park of the Ministry of Foreign Affairs, with a further image showing his pass for a Russian embassy. Lyukshin, whose father previously served as counsellor at the embassy in Denmark, has been training at the Moscow State Institute of International Relations (MGIMO), a diplomatic academy controlled by the foreign ministry, where Rybar operates a “media school”. We found an image, posted on Telegram by Rybar, showing Lyukshin in a group of “future diplomats” who had “trained using Rybar’s manuals”. His face had been blurred in the photograph, but we matched his distinctive hoodie to photos from social media. The Rybar course that Lyukshin attended is part of a programme devoted to “information warfare”, taught by spies and close Putin allies, including Andrey Bezrukov, who spent decades spying in the West before his arrest in 2010, and Sergey Nalobin, widely accused of being a spy who once worked at the Russian embassy in London.

We do not know for certain that Evgeny Lyukshin is EL. He did not respond when we contacted him. But he was present in the fake far-right group created by Russian operatives, his details match EL’s, and he is trained in information warfare and surrounded by Putin’s allies. Ben Wallace, the Conservative former defence secretary and security minister, told us the evidence showed Russia conducting a “very deliberate and definite escalation against the British state”, an attack that would not have originated from “a low-level individual” but would have been ordered “from the very top”. Commander Helen Flanagan, head of Counter Terrorism Policing London, said the aim of the attacks was clearly to intimidate the Prime Minister, though she maintained that police have not been able to prove EL’s identity. Nevertheless, sources have told this publication that authorities in both the United Kingdom and Ukraine have privately concluded that Russia was behind the arson attacks. Hours after we contacted Lyukshin, mentioning that we knew he was a member of the Radio Southport Telegram channel, that channel vanished, along with four more channels created by Rybar to stoke hatred in Britain.