BBC investigation: Russia behind arson attack targeting British Prime Minister

Even after setting fire to Sir Keir Starmer's house, Roman Lavrinovich — who was convicted of conspiracy to commit arson on Monday — seemed to know as much about the prime minister as a bullet knows about its target.

His anonymous principal, known by the initials EL, gave a hint in one message: “Listen, you attacked the home of a very high-ranking person in Britain. I will send you money, you must leave town.”

It was too late: Lavrinovich was arrested within hours.

A 22-year-old Ukrainian construction worker was used as a weapon to attack the head of the British government. But who used him?

A BBC investigation has shown that the arson was just one part of a wider campaign of sabotage, provocation and lies leading all the way to the Russian state.

The mastermind behind EL, who directed Lavrinovich, offered Russian citizenship in exchange for other attacks and praised President Vladimir Putin, according to messages obtained by the BBC.

We have identified evidence that suggests that EL is a young Russian diplomat, trained in information warfare by spies and propagandists, close to the highest levels of power in Moscow. His name is Yevgeny Lyukshin. He is 23 years old and the son of a high-ranking official.

Russian operatives, we have determined, have been conducting their campaign of sabotage and provocation remotely via social media and the messaging app Telegram, creating fake online far-right and Muslim groups, which have been used to organize acts of vandalism in the United Kingdom and to incite division and fear.

Accounts from Russia published lies about the motive for setting fires at properties linked to Starmer, which were then spread by individuals such as far-right anti-Islam activist Tommy Robinson.

The Russian embassy said: "We reject any attempt to link Russia or its foreign ministry to illegal activities."

They added that Russia "poses no threat to the United Kingdom or its citizens and has no aggressive intentions towards Britain."

Lyukshin did not respond to our questions, but a few hours after we contacted him, one propaganda channel we asked him about disappeared.

"Work for the glory of the nation"

Ukrainian national Lavrynovych and Ukrainian-born Romanian national Stanislav Karpiuk, aged 27, have now been convicted at the Old Bailey of conspiracy to attack property and a car associated with the British Prime Minister.

A third man, Petro Počinok, 35, was acquitted of conspiracy to commit arson.

The first fire last year occurred when a Toyota previously owned by the Prime Minister was set on fire in north London. Two other arson attacks followed: one at the entrance to the apartment building where Sir Keir previously lived, and the other at the entrance to his house, which was rented to his sister-in-law after he moved to 10 Downing Street.

However, the trial of the three men was unusual, mainly because the true author of this drama was never discovered.

The case focused strictly on the financial motive. The identity, connections, and motives of the anonymous payer who offered Lavrinovich money for the attacks were deliberately avoided.

In court, the payer was referred to as “EL Money,” because that’s how it was saved on Lavrynovych’s phone, but on the Telegram app, he used only the initials “EL.” It was through that app that EL recruited Lavrynovych, finding him in a group for Ukrainians in London looking for work.

From that seemingly innocent first relationship, Lavrinovich was given assignments of increasing criminal gravity — from putting up posters, to graffiti, to setting fires. Lavrinovich knew he was doing something wrong, but he continued, hoping for a payoff.

Only a limited number of messages from EL were shown in court, all sent to Lavrynovych and Karpiuk, in which he wrote in formal Russian and much weaker Ukrainian. But the BBC, using open source tools, was able to uncover EL's broader activities.

The ideology and goals of the EL were clear.

Messages from the EL account in various Telegram channels show that he glorified Putin and Russia, attacked the Ukrainian people, and promoted Russian narratives.

"It's obvious that Putin is the leader of the white race," he posted in one chat.

EL posted messages in job groups aimed at Ukrainians, looking for “graffiti painters” in London, but in other chat groups he used highly offensive Russian terms for Ukrainian people.

EL has encouraged attacks on recruitment centers in Ukraine, which has been at war since the start of a full-scale Russian invasion in 2022. He has said that those who favor a “white Slavic race” should join the “true Third Rome,” a reference to the belief that Russia is the heir to the Roman Empire.

"Work for the glory of the nation, in defiance of your enemies," EL added, before offering $1.000, or £749, and Russian citizenship as a reward for setting the arson.

EL also gave hints about his identity, offering Russians in other Telegram groups access to NATO and CIA documents. “My father passed me some of it, he didn’t go to Europe for nothing,” he wrote.

"This is war"

The trial did not mention what the posters Lavrinovic put up at the behest of EL actually advertised: an alleged far-right group called Direct Action UK.

The group tried to appear as an authentic British organization. But we discovered that Direct Action was created online by Russian operatives to cause division among ordinary people in the United Kingdom.

Messages sent in the group had a Moscow timestamp, used Cyrillic letters, and placed the pound sign at the end of numbers rather than at the beginning — as in Russian.

The accounts that were mainly run by the Direct Action group, especially EL's account, used other channels to promote Russian political goals and communicated in the Russian language.

Direct Action first appeared online in the fall of 2024, following the riots that followed the Southport murders, and its propaganda used images from those riots.

The group's social media channels, advertised by posters, featured videos that branded Sir Cyrus a traitor, promoted hatred of Muslims, and offered money for violence and arson, including attacks on mosques and police. Direct Action also glorified Tommy Robinson.

"This is war," the group said.

But although Direct Action was a fake group, it did cause real attacks. Six mosques and an Islamic school were vandalized in London last year after the group offered money for Islamophobic graffiti.

Slogans like “remigration” and “Stop Islam” were spray-painted on mosques from Croydon in the south of the capital to Leyton in the east. Direct Action turned videos of the vandalism into eye-catching social media posts to fuel hatred and incite fear.

The morning after a mosque and primary school were vandalised in a Direct Action attack in Leyton, EL posted an innocuous advert in a chat group for Ukrainian job seekers in London: “Part-time job today! Leyton Borough. Need to take photos of two buildings.” He wanted pictures of the aftermath of the attack so the vandalism could be published online.

Even the alleged support that Direct Action had on the ground was fake and existed only because the group paid people to act. When Lavrinovich carried out tasks for EL, he did so for financial reasons, not because he shared Direct Action's ideology, the court was told.

Anti-racism organisation Hope Not Hate investigated Direct Action and reported its suspicions to anti-terror police in February last year, months before the arson attacks on properties linked to the prime minister. Hope Not Hate concluded that the group was Russian-backed.

The anti-racism organization told authorities that those behind the group may be recruiting UK residents to carry out a "terrorist attack on a mosque or identifiable Muslim target in the UK."

But no one responded, says Nick Lawles, executive director of Hope Not Hate, which later collaborated with the BBC in investigating Direct Action and the people behind the group.

Tell Mama, an organization that monitors anti-Muslim hate, also handed over evidence to counterterrorism police and concluded that Direct Action looked like a Russian operation. It received an acknowledgement of receipt, but nothing more from the police.

Iman Ata, CEO of Tell Mama, told us that she believes the police do not take such activities seriously and that it is concerning for Muslim communities to see a group offering cryptocurrency to vandalize mosques and create division.

"It's something that happens online, but it actually translates directly into crimes of property damage, violence and terrorism on our streets," she said.

The Metropolitan Police told the BBC that they were investigating seven incidents of property damage as anti-Muslim hate crimes. No arrests have been made, and police are "leaving open the possibility" that the acts are linked.

Hate leaflets

Before EL began leading fake far-right groups, he helped create a fake Islamic organization called the Takbir Foundation.

We discovered this because the username of EL's Telegram account previously bore the name of that fake foundation.

The foundation attempted to recruit Muslims to write “holy graffiti” in the United Kingdom. But its real goal was obvious: to inflame the far right through vandalism. Telegram accounts that posed as those of devout Muslims later seamlessly transitioned to Direct Action’s aggressive anti-Islam agenda.

In a Telegram group for Muslims, another account named “El” announced that “The Takbir Foundation is dedicated to financially supporting jihad across England. O Mujahideen, be brave and extend your hand towards the coming caliphate.”

The foundation offered up to £150 for graffiti at one location and said: "This is halal money for promoting the word of Allah."

But, just as Direct Action would later pay people who were not actually far-right, the Takbir Foundation offered money to non-Muslims to write Islamic graffiti.

We found two graffiti artists from Bristol who had separately responded to an ad from a fake Facebook account under the name “Michael John” for a “paid opportunity with a generous budget”, without any mention of Islam.

Both were asked to write the Islamic shahada — a declaration of faith — in Arabic on an abandoned Debenhams building in the city centre. One was also asked to write a Quranic verse about “the devil’s work” on the Conservative Club building in the city.

They were sent photos of buildings with the precise locations where graffiti was to be applied marked. This was the same approach used by EL, which sent similar images of mosques when it asked for them to be desecrated with Islamophobic graffiti.

The artists were offered a payout from the Takbir Foundation, but both turned down the job, considering the demands illegal.

Another connection between EL and the Takbir Foundation shows how the mastermind and his fake groups sought to provoke and divide ordinary people.

EL provided Roman Lavrinovich with an anti-Muslim poster, designed to look like it was written by a Hindu, as it referenced the destruction of an ancient Indian mosque by right-wing Hindu groups in 1992. “Every mosque closed = 100 fewer crimes,” the poster read.

Lavrinovich was asked to place it on a specific street in Southall, west London, where the large Southall Central Masjid mosque is located.

It is not clear whether Lavrinovich carried out this task. However, we found that the Takbir Foundation Facebook account had posted a photo of the same poster — allegedly on a brick wall — in a Muslim community group, claiming that the poster had been pasted in Southall. “Hate leaflets found near Southall Central Masjid,” the post read.

EL sowed hatred on the streets of the United Kingdom — and then his fake foundation ensured that the message spread among the Muslim community online.

The attack on the prime minister's property was also used for online propaganda.

One lie spread on social media by accounts from Russia has become particularly well-known — that the three Ukrainian suspects are sex workers, with the implication that the fires were the result of a personal sex scandal.

It was all untrue. The suspects did not know the Prime Minister personally and were not sex workers. But that lie was taken up by Tommy Robinson, the very person promoted by Direct Action, EL's fake far-right group.

Robinson, whose real name is Stephen Yaxley-Lennon, claimed on Platform X that Sir Keir Starmer had “slept” with Ukrainian male sex workers and posted a fake picture of the prime minister with the suspects. Putin’s special presidential envoy Kirill Dmitriyev shared one of his messages about the case.

“Incitement to hatred and violence”

These attacks fit a pattern of a wave of Russian-backed sabotage that has hit Europe over the past five years, targeting Ukraine and its allies — from explosions on railway lines to incendiary devices on planes bound for the United Kingdom.

Russia recruits people as “middlemen,” offering them money to carry out violence, sabotage, and espionage. There can be multiple layers of middlemen, making it easier for Russia to deny involvement. Within Russia itself, several organizations run such operations, and not all are formally part of the government.

Ukrainians are often targeted by Russian recruitment for sabotage across Europe. The National Police of Ukraine said that a Russian network planning sabotage in 11 countries, including the United Kingdom, recently uncovered in a joint operation with the EU, comprised a third of Ukrainians.

"It's easier for the Russians because it discredits Ukraine in the eyes of our partners and European countries," said Vitaly Sova, a senior investigator.

Yet, more often than nationality, saboteur-recruiters are attracted by age, he says. Young people are approached via social media, offered “easy money” for a low-level crime, often disguised as a harmless task, and then blackmailed if they try to refuse further action.

The United States has long been a target of Russian hybrid warfare. In one instance, the US accused the state-controlled media organization Rybar of seeking “to sow discord, promote social divisions, incite partisan and racial conflicts, and incite hatred and violence.” Rybar was also sanctioned by the UK government, which said it was using “classic Kremlin manipulation tactics.”

Rybar ran an online campaign called TEXASvsUSA, designed to look like real activism ahead of the final US presidential election in 2024, exploiting the issue of undocumented migrants crossing the US border.

Hope Not Hate identified the Telegram account that created the TEXASvsUSA channel and discovered that the same account created a series of five channels targeting the United Kingdom, including one called Radio Southport, which appeared after the riots in the summer of 2024.

All promoted a relentlessly bleak image of the United Kingdom and spread racist slurs about migrants and Muslims — following the same pattern as Direct Action.

A well-connected Russian in the company

In the Direct Action Telegram chat group, we identified a member of the Russian elite connected to the Foreign Ministry: Yevgeny Lyukshin, whose initials “EL” match those of the mastermind directing the attack on the British Prime Minister.

Lyukshin was also found in the private chat room of the Radio Southport channel, which Rybar created. He was also in another chat room that glorified the Wagner Group, a Russian-controlled military organization whose late founder, Yevgeny Prigozhin, had previously funded Rybar.

A photo released by the Foreign Ministry shows him standing behind Deputy Foreign Minister Alexander Grushko at a Diplomats' Day event in Moscow in February, where Foreign Minister Sergei Lavrov gave a speech.

Another photo he posted on social media places him in the parking lot of the Ministry of Foreign Affairs in Moscow, while another shows him with a pass to the Russian embassy. In yet another picture, he poses in military uniform holding bullets.

Lyukshin, 23, is the son of a senior Russian diplomat, who was previously a counselor at the embassy in Denmark.

This means that Lyukshin's father was in Europe, potentially with access to and knowledge of sensitive documents. This coincides with EL's Telegram post stating that he had access to NATO and CIA documents because his father was in Europe.

Lyukshin trained at the Moscow State Institute of International Relations, MGIMO, a diplomatic academy controlled by the Ministry of Foreign Affairs, where Rybar has a “media school.”

In a Telegram group of MGIMO students, of which Lyukshin was an administrator, the BBC found a discussion about “conducting pro-Russian propaganda” as part of the course.

Among the public Telegram groups shared by students was Lyukshin's own group, "The Lost Britain," in which he posted a call in English for taxpayers' money to be "redirected" to the NHS instead of being spent on "supporting Ukraine."

We found a photo posted on Telegram by Rybar, showing Lyukshin among a group of “future diplomats” who were “training using Rybar’s manuals.” His face was blurred in the photo, but we compared his distinctive sweatshirt to photos on social media of him wearing the same item of clothing.

Rybar’s photo showed Lyukshin with the organization’s director, Mikhail Zvinchuk, who has been sanctioned by the United Kingdom and is wanted by U.S. law enforcement for his TEXASvsUSA campaign. Zvinchuk is closely associated with President Putin and is a member of the “special task forces” for the war in Ukraine formed by the Russian president.

The Rybar course that Lyukshin attended was part of a whole program dedicated to “information warfare,” created two years ago at the behest of the Kremlin.

The program is jointly run by Putin's presidential administration and Andrei Sushentsov, who has been sanctioned by the European Union for his close ties to Putin and involvement in policies that threaten democracy and security.

The program is taught by spies and close allies of Putin.

One of them is Andrei Bezrukov, who was a spy in the West for decades, using the identity of a deceased Canadian, before being arrested in an FBI operation in 2010. The lives of Bezrukov and his wife, who also used a stolen identity, partly inspired the TV series “The Americans.”

The second lecturer is Sergei Nalobin, widely alleged to be a spy, who once worked at the Russian embassy in London.

Lyukshin previously attended the prestigious First Moscow Cadet Corps, and photos of him in military uniform were posted online by his family, including one said to have been taken in the Kremlin.

We do not know for sure whether Yevgeny Lyukshin is EL. Lyukshin did not respond when we contacted him and presented evidence that he was that person.

But he was in a fake far-right group created by Russian operatives to stir up hatred in the UK, his credentials match EL, he is trained in information warfare and surrounded by Putin allies.

We presented evidence of the attacks on the Prime Minister to Ben Wallace, the former Conservative Defence Secretary and Security Minister, who was in office during the Salisbury nerve agent attack and the full-scale Russian invasion of Ukraine.

He says the evidence shows Russia is carrying out a "very deliberate and clear escalation against the British state".

Launching a raid on property linked to the British prime minister represented a change in policy that “wouldn’t just come from some low-level person, it would come from the very top,” he said.

Commander Helen Flanagan, head of London’s counter-terrorism police, said the aim of the attack was clearly “to intimidate and instill fear in the Prime Minister and to attack the United Kingdom”. However, she said police had been unable to establish EL’s identity or who he worked for, and that “we have no evidence to suggest this was a state-sponsored threat”.

However, sources told us that authorities in the United Kingdom and Ukraine have privately concluded that Russia was behind the arson.

A few hours after we contacted Lyukshin, mentioning that we knew he was a member of the Radio Southport Telegram channel, that channel disappeared.

With him, four other channels that Rybar also created to incite hatred in the United Kingdom disappeared, and a photo of Lyukshin with the Deputy Foreign Minister was removed from a Russian news website.