A high-stakes trial at London’s Old Bailey concluded on Monday, June 15, 2026, exposing a chilling campaign of foreign-directed sabotage on British soil. Two men were found guilty of conspiracy to commit damage with fire after targeting multiple properties and a vehicle directly linked to UK Prime Minister Keir Starmer.
The Guardian
+ 1
While the physical perpetrators were low-level proxies recruited in London, investigations published by the BBC and the Financial Times have traced the puppet strings straight back to a Russian state-sanctioned sabotage network.
The Guardian
According to media reports, the arson wave was coordinated via Telegram by an elusive, Russian-speaking handler operating under the digital alias “El Money” (or “Hroshi” in Ukrainian). The BBC reported that investigators have tied the operation to a network overseen by Russian intelligence assets, representing a dramatic escalation in Moscow’s “hybrid warfare” campaign against Ukraine’s Western allies.
The Guardian
Anatomy of the Sabotage Campaign
Target Date of Attack Incident Details
Former Vehicle May 8, 2025 A Toyota RAV4 previously owned by Starmer was set ablaze in Kentish Town.
Past Residence May 11, 2025 An arson attack was launched at a flat in Islington where Starmer lived in the 1990s.
Family Home May 12, 2025 The front door of Starmer’s family home was set on fire while his sister-in-law and a child were inside.
Groomed on Telegram: How “El Money” Recruited Unwitting Proxies
The trial revealed that the Kremlin-aligned network did not send elite spies to carry out the attacks. Instead, they weaponized the gig economy and online job forums.
The primary operative, Roman Lavrynovych (a 22-year-old Ukrainian construction worker living in London), was recruited on a Telegram group meant for Ukrainians seeking employment in the UK. Court evidence showed that “El Money” spent seven months grooming Lavrynovych—initially paying him small sums in cryptocurrency to spray-paint anti-government and far-right graffiti around London.
Radio Free Europe
+ 1
Eventually, the instructions escalated to violence. El Money offered Lavrynovych £3,000 in Tether cryptocurrency to execute the fires, under the condition that he film the blazes as proof and ensure they made national news. Crucially, counter-terrorism police stated that Lavrynovych and his accomplice, Stanislav Carpiuc (27), had no idea the properties belonged to the Prime Minister. They were simply desperate for cash.
The Guardian
The Turning Point: Hours after the final attack on Starmer’s Kentish Town home, which forced the Prime Minister’s sister-in-law to flee choking smoke, El Money messaged Lavrynovych on Telegram: “Look, you attacked the home of a very high-ranking person in Britain. I’ll send you money, you need to leave the city.”
The Guardian
The NoName057(16) Connection: State-Sponsored Cyber Terror
Digital forensics conducted on the cryptocurrency wallets used to pay the arsonists showed a clear paper trail. The wallets received multiple funds originating from Garantex, a sanctions-evading, Russia-based crypto exchange.
Western intelligence officials believe “El Money” is a prominent actor within NoName057(16), a notorious pro-Kremlin hacktivist collective described by the U.S. government as a “state-sanctioned project.”
The group runs an extremist recruitment platform called Youth of the Saboteur, which actively publishes operational manuals guiding handlers on how to trick Eastern European nationals living in the West into conducting acts of vandalism and arson. The explicit goal? To “burn NATO military and political infrastructure with someone else’s hands.”
“An Attack on Democracy”: The UK Government Responds
Though the fires occurred just before Starmer fully transitioned his family to Downing Street, the political shockwaves are hitting Westminster now. Commander Helen Flanagan, head of London’s counter-terrorism policing, noted that while the defendants had “no ideological motivation,” the orchestration behind them was deeply sinister.
The Guardian
Following the verdicts, Chief Prosecutor Frank Ferguson issued a stern warning:
“These offences go beyond damage to property—they are intended to intimidate and undermine public confidence, and that will not be tolerated.”
The Guardian
Security experts warn that this represents a permanent shift in how European security must operate. Russia is increasingly relying on a “free-flowing exchange” between state intelligence agencies and freelance digital criminals to cause chaos across Europe without triggering a direct military response from NATO.
YouTube
Conclusion: The New Era of Deniable Sabotage
The conviction of Lavrynovych and Carpiuc marks a victory for British counter-terrorism, but the true mastermind remains comfortably out of reach behind a keyboard in Russia. As European nations continue their unwavering support for Ukraine, the battlefront is no longer contained to eastern Europe—it is playing out on dark Telegram channels and quiet suburban streets in London.
What are your thoughts? Should the UK treat cyber-recruited arson as an act of state terrorism? Let us know in the comments below.
