Russia-Based Network Used Telegram Recruits to Target Starmer Properties
Financial Times reporter Miles Johnson traces the arson attacks on properties linked to Keir Starmer to a Russia-based online network that allegedly recruited a 21-year-old Ukrainian in London through Telegram. Johnson’s account argues that Roman Lavrynovych was moved from posting far-right propaganda to vandalism and then fire-setting without being told the political significance of the targets. The case is presented as an example of Russian-linked disruption that is cheap, deniable and designed to look like local extremism.
A Ukrainian recruit was pushed from propaganda to arson without being told the political target
A 21-year-old Ukrainian construction worker suspected of arson attacks on properties linked to Sir Keir Starmer was recruited by a Russian-speaking Telegram handler and moved through a sequence of paid tasks that escalated from propaganda to vandalism to fire. Roman Lavrynovych, who lived in south London with his grandmother, was arrested in the early hours of May 13, 2025, after British police forced entry to his home.
Lavrynovych was arrested on suspicion of setting a series of fires at properties connected to Starmer, the British prime minister. In police interviews, however, he said he did not know who the UK prime minister was and had never heard Starmer’s name. He also called Vladimir Putin a terrorist. The contradiction is central to the mechanism described by Miles Johnson: a young Ukrainian in London ended up attacking properties linked to one of Ukraine’s staunchest allies because the person directing him did not disclose the significance of the targets.
Lavrynovych had been recruited on Telegram by a Russian-speaking handler known to him only as “El Money”. The approach was gradual. Over several months, the handler offered money for tasks that became progressively more criminal. The first work was political theatre: printing and posting flyers for what purported to be an anti-immigration, far-right Telegram group called Direct Action.
Images credited to Tell MAMA showed the flyers taped to street furniture and poles. One carried the language: “DANGER BDL KILLING OUR CHILDREN, TAKING OVER OUR HOMES.” Another showed a QR code and the handle “TIKTOK.COM/@DIRECTACTION_UK.” The material was designed to look like domestic extremist agitation, not foreign direction.
The tasks then escalated. Lavrynovych was paid to spray Islamophobic graffiti on mosques and Islamic centres in south London. A photograph credited to Tell MAMA showed the word “REMIGRATION” painted near a mosque. The final stage was arson: the Russian-speaking handler asked him to set fire to a car and properties connected to Starmer, but without telling him that the targets were linked to the prime minister.
Direct Action’s British far-right identity concealed a Russia-based network
The Financial Times investigation found that Direct Action was not what it claimed to be. On the surface, it used Union Jack branding, far-right slogans and British grievance language. Behind that presentation was a Russia-based online network using Telegram, artificial intelligence and fake British identities to inflame tensions in the UK.
The group’s own materials were explicit about encouraging violence and intimidation. A Telegram channel page for Direct Action used the line “Are you ready to fight?” and linked to a bot called “@Burning_Police_bot.” A screenshot of a post attributed to Direct Action on X offered money for an attack on a police car: “Starmer administration can’t hear you disagree? Let him see it. Flame+Police car = 4.000£ for you.” The visible text also identified the attached clip as an “AI generated video.”
The network distributed instructions for vandalism as well as propaganda. One Telegram post framed anti-Muslim graffiti as “a peaceful and safe way for activists to send a message to Muslims that they are not welcome here and should know their place.” It then gave operational advice: use black spray paint, wear a hooded jacket and face covering, conceal the spray can and stencil in a backpack, and wear trainers “to run away quickly.”
The group encouraged attacks on mosques and police vehicles. One of its chats also shared bomb-making and knife-attack manuals. The visual evidence included files titled “Improvised_Land_Mines.pdf,” “Homemade_Detonators.pdf,” “Improvised_Radio_Detonation.pdf” and “Incendiaries - Advanced Improvised.pdf.”
Taken together, the materials shown by Johnson presented Direct Action as a channel that mixed political branding, recruitment prompts, target suggestions, payment offers and practical instructions for vandalism and attacks.
The attribution trail relied on operational mistakes and network overlap
Miles Johnson did not describe a trail built from one visible Russian marker. The evidence shown points instead to repeated slips in supposedly English-language material and to Direct Action’s overlap with a broader Russian-language ecosystem.
Administrators occasionally left Cyrillic characters in English posts. One screenshot magnified a stray Cyrillic character inside an English sentence. Another screenshot, credited to Hope Not Hate, showed Russian interface elements around an item about a UK news story, including “08 янв. 25” and Russian labels for views, reposts, quotes, likes and bookmarks.
Archived Telegram posts showed Direct Action overlapping with Russian-language sabotage and hacktivist channels. One displayed channel was called “Юность Диверсанта” and the visible Russian text referred to activity on NATO territory and teaching others. Another Russian-language post was shown with an English translation overlaid: “the difficulty of recruitment is increasing, particularly among Ukrainians. As for Europe, at present, methods that no longer work in Ukraine continue to work in European countries.”
Johnson linked that wider ecosystem to NoName057(16), described as a pro-Russian hacking collective indicted by multiple Western governments. A Telegram screenshot credited to Tell MAMA showed Russian-language material mentioning NoName057(16) in connection with an attack on General Dynamics European Land Systems, described there as a company supplying Leopard tanks to Ukraine.
The most direct strategic statement shown in translation came from a Russian Telegram post.
Recruit, manipulate, [and] burn Nato military infrastructure with someone else’s hands.
Johnson said one channel in the network urged Russian followers to recruit Ukrainians and Europeans and use them as proxies for attacks in NATO countries. Lavrynovych’s Ukrainian identity therefore does not contradict the alleged Russian connection described here. It fits the model shown in the network’s own language: recruit people already present in European cities, obscure the handler, obscure the political target and leave the visible actor to carry out the attack.
The disruption model is cheap, deniable and outsourced
For Western officials, this is “the new face of Russian-linked disruption”: cheap, deniable and outsourced. The street-level actors are not spies with diplomatic passports. They are people recruited through anonymous accounts on messaging platforms, offered money and moved step by step from low-level propaganda to vandalism and then to fire.
The escalation pattern matters. Lavrynovych was not first asked to attack a prime minister’s property. He was first asked to put up flyers. Then to spray Islamophobic graffiti. Then to set fires. The targets and the purpose were controlled elsewhere, while the recruit experienced the work as a sequence of paid tasks.
Trial evidence shown by the Metropolitan Police supplied the physical record around the alleged attacks: CCTV from a bus, a burning car on a residential street, black-and-white footage of a man walking, and vertical video of a hand using a lighter to ignite paper on the ground. The apparatus described is not built around diplomatic cover or a visible command structure. It is built around Telegram handles, fake local branding, small payments and incremental escalation.
The arson attacks are connected in the FT account to a broader pattern of social destabilisation rather than treated as a self-contained criminal episode. The same network pushed anti-immigration material, Islamophobic vandalism, attacks on police vehicles and recruitment language about NATO infrastructure. Its method depended on making Russian direction look like local British extremism, while using people in European cities as proxies.