FT: The Arson Attack On The British Prime Minister’s Family Home Was Orchestrated From Russia

What is known.

A Russian network of cyber saboteurs, which organized far-right protests in the UK and carried out a cyberattack on the Milan Olympics, was behind a series of arson attacks on property linked to British Prime Minister Keir Starmer. The court found Roman Lavrinovich, a 22-year-old construction worker from London, guilty of organizing the attacks. Although prosecutors did not disclose information about the identity of his handler, other than that he used the nickname El Money on Telegram and communicated in Russian and Ukrainian, the investigation Financial Times revealed: El Money was in Russia and was closely linked to NoName057—a pro-Kremlin group that the U.S. has called “a project sanctioned by the Russian state.”

The FT’s investigation is based on materials from Telegram, analysis of cryptocurrency wallets, court documents, and interviews with Western officials. El Money’s handler spent seven months grooming Lavrinovich for acts against Starmer, initially assigning him minor tasks such as printing posters for the far-right group Direct Action and putting them up around London. He contacted Lavrinovich in late 2024, when the latter was actively looking for side jobs in Russian- and Ukrainian-language Telegram groups. Paying him in cryptocurrency, the handler eventually assigned him a task in May 2025 to set fire first to a Toyota RAV4 that had previously belonged to Starmer, then his former apartment, and finally the prime minister’s family home, where his sister-in-law lived with their 9-year-old daughter (Starmer himself lives with his family in the official residence on Downing Street).

El Money promised to pay several thousand dollars if these arson attacks made national news. They did, but Lavrinovich, according to him, never received the money; this was confirmed by an FT analysis of crypto wallets. No one was injured in the arson attacks, although Starmer’s sister-in-law, who has asthma, struggled to breathe when explosions rang out at the front door and smoke filled the room.

NoName, like a number of other Russian cyber groups, enjoys the Kremlin’s support to advance its geopolitical interests and stir up unrest in Europe by spreading disinformation, far-right, and anti-immigrant ideas. To carry out “on-the-ground” sabotage, acts of vandalism, and espionage, they recruit operatives, among whom—not for the first time—are young people who have fled Russian aggression in Ukraine and find themselves in difficult financial circumstances.

For the most part, such groups do not operate on behalf of the Russian authorities, says Mark Galeotti, a military expert and professor emeritus at the School of Slavonic and East European Studies at University College London:

“Many of these people consider themselves patriots. It is clear that the Kremlin is banking on the ability to deny its involvement. The problem is that the more attacks there are, the less credible such a denial becomes.”

In February, Italy’s National Cybersecurity Agency reported that it had thwarted cyberattacks by Russian hackers calling themselves NoName057 on the websites for the Milan and Cortina Olympics. The Russian team was not admitted to the Games due to the war that Vladimir Putin unleashed in Ukraine, although 13 athletes participated in the Games under neutral status.

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), NoName and the methods it uses were developed as part of a “covert project” by a Kremlin-backed IT organization. Some members of the decentralized NoName network are “individuals who support Moscow’s policies but have no direct ties to the government,” while others “appear to be linked to the Russian state through direct or indirect support” from it, CISA noted.

Direct Action, which at first glance appeared to be a British far-right movement, was in fact also organized in Russia. Cyrillic characters would occasionally appear in English-language texts, and administrators sometimes shared content displaying Moscow time, the FT notes.

Photos of Direct Action posters, which Lavrinovich took after putting them up and sent to his handler El Money, later appeared on the Direct Action Telegram channel. They were cited as evidence of support and called for “burning the police.”

In early 2025, Direct Action began urging its subscribers—numbering several hundred—to scrawl anti-Islamic graffiti on mosques and Islamic centers in South London. At his trial, Lavrinovich admitted to having done this at least twice. According to him, he wanted to make money because his father in Ukraine needed medical treatment, and later he began to feel threatened by El Money and feared for his family’s safety.

At the same time, after his arrest, he expressed anti-Russian views and called Putin a “terrorist.”

As the FT discovered, Direct Action is closely linked to Telegram channels, which, in turn, are linked to NoName. Direct Action had a logo that differed only in color from that of the now-closed Russian-language channel “Molodost Diversanta.” The latter provided detailed instructions on recruiting Ukrainians living in Western Europe to carry out sabotage operations in order to “burn NATO’s military infrastructure with someone else’s hands.” Accounts linked to “Molodost Diversanta” interacted directly with the administrators of the official NoName Telegram channel.

You can support the website Charter97.org

MULTI-CURRENCY ACCOUNT FOR ASSISTANCE:

Bank's name: Bank Millennium S.A.
Address: ul. Stanislawa Zaryna, 2A, 02-593, Warszawa
IBAN: PL97116022020000000216711123
SWIFT: BIGBPLPW
Name of the account holder: Fundacja “KARTA ‘97”
Purpose/title of payment: Donation for statuary aims

You can contact us by the e-mail charter97@gmail.com