The conviction of two Eastern European men for a series of arson attacks on properties linked to Prime Minister Sir Keir Starmer has exposed a direct line from a Russian-speaking Telegram handler to the heart of Moscow’s diplomatic apparatus. At the Old Bailey on Monday, Ukrainian builder Roman Lavrynovych, 22, and Romanian national Stanislav Carpiuc, 27, were found guilty of conspiracy to damage property by fire, while a third defendant, Ukrainian Petro Pochynok, was acquitted. The attacks, carried out over four days in May 2025, saw a Toyota RAV4 once owned by Starmer torched in Kentish Town, and the front doors of two houses set ablaze — one of them the prime minister’s former family home, then occupied by his sister-in-law and her children. Nobody was injured, but prosecutors argued the intent was to endanger life and spread terror.

From the outset, the investigation focused on the figure who recruited the perpetrators via Telegram under the alias ‘El Money’ or ‘EL’. He offered Lavrynovych £3,000 in cryptocurrency, demanded video proof, and later messaged: “Look, you attacked the home of a very high-ranking person in Britain.” Joint reporting by the BBC and the Financial Times, corroborated by Russian independent outlets, has now identified the handler as 23-year-old Evgeny Lukin, the son of a chief adviser in the Russian foreign ministry’s Situation-Crisis Centre. Lukin, described as a “young Russian diplomat”, is also linked to a hacking network tied to the Russian state. The arson, investigators concluded, was not an isolated crime but one node in an extensive campaign of sabotage, provocation and disinformation aimed at destabilising the United Kingdom.

Viewed from London, the case marks a troubling escalation in the Kremlin’s use of low-level criminal proxies on British soil. Commander Dominic Murphy, head of the Met’s counter-terrorism command, said the plot was designed to strike “fear” into the prime minister and cause “unrest” across the country. In Moscow, state media reported the verdicts with conspicuous brevity, while independent Russian-language outlets such as Meduza, iStories and Dozhd amplified the investigative findings linking Lukin to the attacks. The affair mirrors a pattern observed across Europe: amateur saboteurs, often young men recruited on social media, paid to carry out arson or vandalism for handlers who vanish into encrypted channels. Australian agencies last year blamed Iranian operatives for a similar “fee for service” model, suggesting a broader proliferation of deniable hybrid warfare tactics.

For Western security analysts, the Starmer arson plot crystallises a growing vulnerability. The perpetrators were not trained intelligence officers but economically precarious foreigners lured by cash and promises of citizenship, easily discarded once their task was complete. Lavrynovych was arrested within hours of the final fire, his handler already urging him to flee. The use of such disposable assets allows hostile states to maintain plausible deniability while testing the resilience of democratic societies. As the sentencing of the two convicted men approaches, the unanswered question is how far up the chain of command the authorisation travelled — and what other operations may already be in motion, their puppet masters still hidden behind pseudonyms on encrypted apps.