You can enable subtitles (captions) in the video player
MILES JOHNSON: It’s the early hours of May 13 2025, and British police have just smashed down the door of a young Ukrainian man living in South London. That man was called Roman Lavrynovych, and he was a construction worker who was 21 at the time and lived with his grandmother.
He was arrested on suspicion of setting a series of arsons at properties connected to Sir Keir Starmer, the British prime minister. But in his police interviews, Lavrynovych said that he had no idea who the UK prime minister was and he had never even heard the name Keir Starmer. He called Vladimir Putin a terrorist.
So how did this young Ukrainian living in London end up setting fire to properties connected to the leader of one of his country’s staunchest allies? Lavrynovych had been recruited on the messaging platform Telegram by a Russian-speaking person known to him only as ‘El Money’, and over several months, this handler recruited the young Ukrainian and offered him money to carry out a series of progressively more criminal tasks on the streets of London.
At first, ‘El Money’ asked him to print out and stick up flyers for a supposedly anti-immigration, far-right Telegram group called Direct Action. Then, Lavrynovych was paid to spray Islamophobic graffiti on mosques and Islamic centres in South London. Finally, the Russian-speaking handler asked him to set fire to a car and properties connected to Starmer, but without telling him that the targets were linked to the British prime minister.
An FT investigation has found out that Direct Action was not what it claimed to be. Behind the Union Jack branding and far-right slogans was a Russia-based online network using Telegram, artificial intelligence and fake British identities to inflame tensions in the UK. The group encouraged attacks on mosques and police vehicles, and one of its chats shared bomb-making and knife attack manuals. But its administrators occasionally slipped up, leaving Cyrillic characters in English-language posts and sharing material with Russian time zones visible.
And the trail, it didn’t stop there. Archived Telegram posts show that Direct Action overlapped with a wider ecosystem of Russian-language sabotage and hacktivist channels linked to noname057(16), a pro-Russian hacking collective indicted by multiple western governments. One channel in that network urged its Russian followers to recruit Ukrainians and Europeans, and to use them as proxies for attacks in Nato countries.
Its message was blunt: recruit, manipulate and burn Nato military infrastructure with someone else’s hands. For western officials, this is the new face of Russian-linked disruption: cheap, deniable and outsourced. These are not spies with diplomatic passports, but anonymous handlers on Telegram, finding vulnerable people in European cities, offering them money and pushing them step by step from propaganda to vandalism to fire.
