After setting fire to Sir Keir Starmer's home, Roman Lavrynovych — found guilty on Monday of conspiracy to commit arson — appeared to understand as little about the prime minister as a bullet does about its target.
His unidentified handler, referred to only as EL, offered a telling remark in a message: "Look, you targeted the residence of an extremely senior figure in Britain. I will transfer you funds, you must get out of the city immediately."
It was too late: Lavrynovych was taken into custody just hours later.
The 22-year-old Ukrainian construction worker had been turned into a weapon aimed at the UK's head of government. But who was behind it?
Our probe has revealed that the arson attack formed just one element of a broader campaign of sabotage, incitement and deceit that traces back to the Russian state.
The handler EL, who gave Lavrynovych his instructions, promised Russian citizenship in return for further assaults and praised President Vladimir Putin, according to messages uncovered by the BBC.
We have uncovered indications that EL is a young Russian diplomat, trained in information warfare by intelligence operatives and propagandists, with connections to the upper echelons of power in Moscow. His name is Evgeny Lyukshin. He is 23 and the son of a senior official.
Russian operatives conducted their sabotage and provocation campaign remotely via social media and the messaging app Telegram, we discovered, establishing fraudulent online far-right and Muslim groups that were used to coordinate acts of vandalism in the UK and foment division and fear.
Accounts based in Russia circulated falsehoods about the motivation for the arson attacks on Starmer, which were amplified by figures such as far-right anti-Islam activist Tommy Robinson.
The Russian embassy stated: "We reject any attempt to associate Russia or its foreign ministry with unlawful activities."
It asserted that Russia poses "no threat to the United Kingdom or its people and harbours no aggressive intentions towards Britain".
Lyukshin did not reply to our inquiries, but shortly after we contacted him, a propaganda channel we had confronted him about was removed.
'Work for the glory of the nation'
Ukrainian national Lavrynovych, along with Ukrainian-born Romanian national Stanislav Carpiuc, 27, have now been found guilty at the Old Bailey of conspiring to damage property and a vehicle linked to the UK prime minister.
A third individual, Petro Pochynok, 35, was acquitted of conspiracy to commit arson.
The first fire last year occurred when a Toyota, previously owned by the prime minister, was set alight in north London. Two further arson attacks followed: one at the entrance to flats where Sir Keir once resided, and another at the entrance to his house, which had been rented to his sister-in-law after he moved to No 10.
However, the trial of the three men was unusual, primarily because the true orchestrator of the events was never disclosed.
The case focused exclusively on a financial motive. The identity, affiliations and motivations of the anonymous handler who provided Lavrynovych with money for the attacks were deliberately omitted.
In court, the handler was identified as "EL Money", the name under which he was saved in Lavrynovych's phone, but on the Telegram messaging app he used only the initials "EL". It was on this app that EL recruited Lavrynovych, locating him in a group for Ukrainians in London seeking employment.
From that seemingly harmless initial contact, Lavrynovych was assigned tasks of increasing criminal severity, ranging from putting up posters and graffiti to arson. Lavrynovych was aware he was acting illegally but persisted, hoping to secure a financial reward.
In court, only a limited number of messages from EL were presented, all sent to Lavrynovych and Carpiuc, showing him writing in formal Russian and less fluent Ukrainian. However, we managed to uncover EL's broader activities using open-source tools.
EL's ideology and objectives were evident.
Messages from the EL account across various Telegram channels show him praising Putin and Russia, denigrating the Ukrainian people, and advancing Russian narratives.
"It is obvious that Putin is the leader of the white race," he posted in one chat.
EL posted in employment groups for Ukrainians, seeking "painters to do graffiti" in London — but in other chat groups, he used deeply offensive Russian terms for Ukrainian people.
EL incited attacks on conscription centres in Ukraine, which has been at war since Russia's full-scale invasion in 2022. He stated that those there who support the "white Slavic race" should join the "real Third Rome", a reference to the notion that Russia is the successor to the Roman Empire.
"Work for the glory of the nation to spite your enemies," EL added, before offering $1,000 (£749) and Russian citizenship as a reward for arson attacks.
EL also provided clues about his identity, offering Russians in other Telegram groups access to documents from Nato and the CIA. "My father leaks part of it to me, it was not for nothing that he went to Europe," he said.
'This is war'
The trial made no mention of what the posters put up by Lavrynovych on EL's orders actually promoted: a purported far-right group called Direct Action UK.
The group aimed to appear as an organic British creation. However, we discovered that Direct Action was established online by Russian operatives to sow division among ordinary people in the UK.
Messages sent in the group bore a Moscow timestamp, used Cyrillic letters, and placed pound signs at the end of numbers, rather than at the beginning — as is customary in Russian.
The accounts primarily involved in running Direct Action, particularly EL's, were using other channels to promote Russian political objectives and communicating in Russian.
Direct Action first emerged online in autumn 2024, after the riots that followed the Southport murders, and its propaganda exploited images from the unrest.
Its social media channels, which the posters were advertising, featured videos branding Sir Keir a traitor, promoting hatred of Muslims and offering money for violence and arson, including attacks on mosques and police. Direct Action also celebrated Tommy Robinson.
"This is war," the group declared.
However, although Direct Action was fake, it sparked real-world attacks. In London, six mosques and an Islamic school were vandalised last year after the group offered payment for Islamophobic graffiti.
Slogans such as "remigration" and "Stop Islam" were spray-painted on mosques from Croydon in the south of the capital to Leyton in the east. Direct Action turned video clips of the vandalism into brash social media videos to amplify hatred and instil fear.
The morning after a mosque and primary school had been vandalised by a Direct Action attack in Leyton, EL posted an innocuous-sounding ad in a chat group for Ukrainian people seeking work in London: "Part time job today! Leyton District. You need to take pictures of two buildings." He wanted images of the aftermath, so the vandalism could be publicised online.
Even Direct Action's apparent grassroots support was fake and existed only because it paid people to participate. When Lavrynovych himself carried out actions for EL, he did so for financial reasons, the court heard, not because he shared Direct Action's ideology.
Anti-racist organisation Hope Not Hate investigated Direct Action and reported its concerns to counter-terror police in February last year, months before the arson attacks relating to the prime minister. Hope Not Hate concluded that Russians were behind the group.
The anti-racist organisation told the authorities that individuals behind the group may be grooming UK residents to launch a "terror attack against a mosque or identifiably Muslim target in the UK".
However, no response was received, says Nick Lowles, CEO of Hope Not Hate, which has since worked with the BBC to investigate Direct Action and the people behind it.
Tell Mama, a group that monitors anti-Muslim hate, also passed evidence to counter-terror police and concluded that Direct Action appeared to be a Russian operation. It received an acknowledgement but nothing further from police.
Iman Atta, Tell Mama's CEO, told us she believed such actions are not taken seriously by police, and it was concerning for Muslim communities to see a group offering cryptocurrency to vandalise mosques and create division.
"It's something that is happening online, but it's actually moving directly into criminal damage and criminal acts of violence and terrorism on our streets," she said.
The Met told the BBC it is investigating seven instances of criminal damage as anti-Muslim hate crimes. No arrests have been made, and it is "keeping an open mind" about whether offences are linked.
Hate leaflets
Before EL began running fake far-right groups, he helped to create a bogus Islamic organisation called the Takbir Foundation.
We discovered this because the username for EL's Telegram account previously bore the name of the fake foundation.
The foundation sought to recruit Muslims to spray-paint "sacred graffiti" in the UK. However, its true goal was obvious: to inflame the far right with this vandalism. Telegram accounts that pretended to be those of devout Muslims later switched seamlessly to an aggressive anti-Islam agenda with Direct Action.
In a Telegram group for Muslims, another account called "El" posted that the "Takbir Foundation is dedicated to financially supporting jihad throughout England. O mujahideen, be courageous and extend your hand towards the coming caliphate."
The foundation offered up to £150 for graffiti in one location and said: "this is halal money to promote the word of Allah".
However, just as Direct Action would later pay people who were not genuinely on the far right, the Takbir Foundation offered money to non-Muslims to spray Islamic graffiti.
If you have information about this story or a similar one you would like to share with the BBC News Investigations team, please email security.investigations@bbc.co.uk — please include a contact number if you are willing to speak to a BBC journalist
Or click here to learn how to use SecureDrop, an anonymous whistleblowing tool that works only in the Tor browser, and follow the advice to stay secure
We tracked down two Bristol graffiti artists who separately responded to an ad by a fake Facebook account with the name "Michael John" for "a paid opportunity with a generous budget", with no reference to Islam.
Both were asked to spray-paint the Islamic shahada — the declaration of faith — in Arabic on a defunct Debenhams in the city centre. One was also asked to spray a Quranic verse about the "devil's handiwork" on a Conservative Club in the city.
They were sent images of the buildings with precise areas highlighted showing where the graffiti was to be sprayed. This was the same approach as EL, who sent similar images of mosques when asking for them to be defaced with Islamophobic graffiti.
The artists were offered payment from the Takbir Foundation, but both refused the work, considering the requests illegal.
Another link between EL and the Takbir Foundation underscores how the handler and his fake groups sought to provoke and divide ordinary people.
EL had provided Roman Lavrynovych with an anti-Muslim poster, designed to appear as though it had been written by a Hindu by referencing the 1992 destruction of an ancient Indian mosque by right-wing Hindu groups. "Every mosque closed = 100 fewer crimes," the poster said.
Lavrynovych was asked to put it up on a specific road in Southall, west London, which is home to a large mosque, Southall Central Masjid.
It is unclear if Lavrynovych carried out the task. However, we found the Takbir Foundation's Facebook account had posted a photo of the same poster — apparently on a brick wall — in a Muslim community group, claiming it had been plastered up in Southall. "Hate leaflets were found near Southall Central Masjid," the post said.
EL was sowing hatred on the UK's streets — and then his fake foundation was ensuring the message spread to the Muslim community online.
The attack on the prime minister's property was also used for online propaganda.
One lie spread on social media by Russia-based accounts became particularly well-known — that the three Ukrainian suspects were sex workers, with the implication that the fires were the result of a personal sex scandal.
It was all untrue. The suspects did not know the prime minister personally, and they were not sex workers. However, the lie was taken up by Tommy Robinson, the very person who had been promoted by Direct Action, EL's fake far-right group.
Robinson, whose real name is Stephen Yaxley-Lennon, claimed on X that Sir Keir Starmer had been "banging" Ukrainian male sex workers and posted a fake image of the prime minister with the suspects. Putin's special presidential envoy Kirill Dimitriev reposted one of his messages about the case.
'Encourage hate and violence'
These attacks fit the pattern of a wave of Russian-backed sabotage that has hit Europe over the past five years, targeting Ukraine and its allies — from explosions on railway lines to firebombs on planes destined for the UK.
Russia recruits people as "proxies", offering payment to carry out acts of violence, sabotage, and espionage. There can be layers of proxies, making it easier for Russia to deny involvement. In Russia itself, several organisations run such operations, not all of them formally part of the government.
Ukrainians are frequently targeted for Russian sabotage recruitment across Europe. The National Police of Ukraine said that in one Russian network plotting sabotage in 11 countries, including the UK — which was recently uncovered in a joint operation with the EU — a third of participants were Ukrainians.
"It's easier for the Russians this way, because it discredits Ukraine in the eyes of our partners and European countries," said Vitaliy Sova, a senior investigator.
More often, however, it is age rather than nationality that attracts sabotage recruiters, he says. Approached on social media, young people are offered "easy money" for a low-level crime, often masked as innocent tasks, then blackmailed if they try to refuse further actions.
The US has long been a target of Russian hybrid warfare. In one example, it accused a state-controlled media organisation, Rybar, of seeking "to sow discord, promote social division, stoke partisan and racial discord, and encourage hate and violence". Rybar has also been sanctioned by the UK government, which said it uses "classic Kremlin manipulation tactics".
Rybar ran an online campaign called TEXASvsUSA, which was designed to look like real activism in the run-up to the last US presidential election in 2024, exploiting the issue of undocumented immigrants crossing the US border.
Hope Not Hate identified the account on Telegram that had created the TEXASvsUSA channel and found it had also created a series of five UK-focused channels, including one called Radio Southport, which appeared after the riots in summer 2024.
They all promoted a relentlessly bleak view of the UK and spread racist abuse about migrants and Muslims — the same blueprint as Direct Action.
A well-connected Russian in the chat
In the Direct Action Telegram chat group, we identified a member of the Russian elite associated with the ministry of foreign affairs: Evgeny Lyukshin, whose initials "EL" match those of the handler who directed the attack on the UK prime minister.
We found Lyukshin again in a private chat for Radio Southport, the channel created by Rybar. He was also in another chat that glorified the Wagner Group, the Russia-controlled military organisation whose late founder Yevgeny Prigozhin previously funded Rybar.
A picture posted by the Ministry of Foreign Affairs shows him standing behind Deputy Foreign Minister Alexander Grushko at a Diplomats' Day event in Moscow in February, where Foreign Minister Sergei Lavrov gave a speech.
Another photo he posted on social media placed him in the car park of the Ministry of Foreign Affairs in Moscow, with another showing his pass for a Russian embassy. A further image showed him posing in a military outfit holding bullets.
Lyukshin, 23, is the son of a senior Russian diplomat, who previously served as counsellor at the embassy in Denmark.
This means Lyukshin's father was in Europe, potentially with access to and knowledge of sensitive documents. This accords with the Telegram post by EL which stated he had access to Nato and CIA documents because his father had been in Europe.
Lyukshin has been training at the Moscow State Institute of International Relations (MGIMO), a diplomatic academy controlled by the foreign ministry, where Rybar has a "media school".
In a Telegram group of MGIMO students, which Lyukshin was the administrator of, the BBC has found discussion about "conducting pro-Russian propaganda" as part of the course.
Among the public Telegram groups shared between students was Lyukshin's own "The Lost Britain" group, where he had posted in English calling for taxpayer money to be "diverted" to the NHS instead of being spent on "support for Ukraine".
We found an image, posted on Telegram by Rybar, showing Lyukshin in a group of "future diplomats" who had "trained using Rybar's manuals". His face had been blurred in the photo, but we matched his distinctive hoodie to photos from social media showing him wearing the same top.
In the Rybar photo, Lyukshin was pictured with the organisation's director, Mikhail Zvinchuk, who has been sanctioned by the UK and is wanted by US law enforcement for the TEXASvsUS campaign. Zvinchuk is closely involved with President Putin and sits on "special working groups" for the Ukraine war created by the Russian president.
The Rybar course that Lyukshin studied on was part of an entire programme devoted to "information warfare", created two years ago at the direction of the Kremlin.
It is jointly run by Putin's presidential administration and Andrey Sushentsov, who is sanctioned by the European Union for his close association with Putin and involvement in policies that threaten democracy and security.
The programme is taught by spies and close Putin allies.
One is Andrey Bezrukov, who spent decades as a spy in the West, using the identity of a dead Canadian, before his arrest in an FBI operation in 2010. The lives of Bezrukov and his wife, who also used a stolen identity, partly inspired the TV show "The Americans".
Another tutor is Sergey Nalobin, widely accused of being a spy, who once worked at the Russian embassy in London.
Lyukshin was previously at the prestigious First Moscow Cadet Corps, and images of him in military uniform have been posted online by his family, including one described as being taken in the Kremlin.
We do not know for sure if Evgeny Lyukshin is EL. Lyukshin did not respond when we contacted him setting out the evidence that he is.
However, he was in the fake far-right group created by Russian operatives to cause hatred in the UK, his details match EL, he is trained in information warfare, and surrounded by Putin allies.
We set out our evidence about the attacks targeting the prime minister to Ben Wallace, the Conservative former defence secretary and security minister, who was in office during the Salisbury nerve agent attack and the full-scale invasion of Ukraine.
He says the evidence showed Russia conducting a "very deliberate and definite escalation against the British state".
Launching attacks on property linked to the UK prime