Russian sabotage network linked to arson attacks on UK Prime Minister's properties - FT
British Prime Minister Keir Starmer (photo: Getty Images)
A Russian online sabotage network linked to pro-Kremlin hackers was behind a series of arson attacks on properties associated with British Prime Minister Keir Starmer, the Financial Times reported.
Who carried out the arson attacks?
On Monday, London's Old Bailey court convicted 22-year-old Ukrainian construction worker Roman Lavrynovych of setting fire to a car and two properties linked to Starmer. The attacks took place in May 2025, a year after Starmer moved into Downing Street. At the time of one of the attacks, the prime minister's stepsister and her nine-year-old daughter were inside the house.
Who was behind the attacker?
According to the FT, Lavrynovych's handler was an anonymous individual using the alias El Money, who communicated with him on Telegram in Russian and Ukrainian. The investigation found that the handler was based in Russia and closely linked to the hacker group NoName057(16), which the United States has described as a Russian "state-sanctioned project."
How the attacker was prepared
El Money recruited Lavrynovych gradually over a period of seven months. Initially, he paid him to distribute flyers for the far-right group Direct Action across London. The organization appeared to be a British far-right movement, but was in fact operated from Russia, where VPNs were used to conceal its location and content was generated using AI.
At the same time, Direct Action encouraged its followers to spray anti-Islam graffiti on mosques. At least seven such attacks took place in London in early 2025.
How the arson attacks were carried out
On May 8, 2025, Lavrynovych set fire to a Toyota RAV4 that had previously belonged to Starmer. On May 11, he targeted an apartment in Islington where the prime minister had lived in the 1990s. During the night of May 12, he attacked a family home in Kentish Town. To carry out the attacks, he purchased white spirit from a B&Q hardware store.
Lavrynovych told the court that he did not know the targets were connected to the prime minister. He later became afraid of his handler and concerned for the safety of his family in Ukraine. He had been promised several thousand dollars in cryptocurrency for carrying out the attacks, but never received the money.
The bigger picture
The operation illustrates a typical Russian approach: using criminal intermediaries for actions that the state can later deny.
"Russia operates on a free-flowing exchange of activity and expertise between state intelligence agencies and criminal groups. Most of the time, hackers and criminals are free to do what they want, as long as they leave Russian interests unharmed or are seen to advance them," said Ciaran Martin, the former head of the UK's National Cyber Security Centre, a branch of the signals intelligence agency GCHQ.
During the hearings, Lavrynovych stated that he had never heard of Starmer and did not know whose property he was setting on fire.
The case fits into a broader pattern of Russian influence through recruitment. The United Kingdom has imposed sanctions on 35 individuals and organizations involved in recruiting migrants for Russia's war against Ukraine. At the same time, Russia is expanding its network for recruiting foreign nationals, with citizens from around 40 African countries being actively encouraged to fight against Ukraine.
