- Category
- World
Russian Cyber Network “NoName” Orchestrated Arson Attacks Against UK Prime Minister
Prefer U24 Media on Google
- Authors
![Photo of Cyril Barabaltchouk]( "Photo of Cyril Barabaltchouk")
-72b63a4e0c8c475ad81fe3eed3f63729.jpeg "Photo of Cyril Barabaltchouk")
A Russian online sabotage network orchestrated a series of arson attacks targeting properties connected to UK Prime Minister Keir Starmer, an investigation by the Financial Times has revealed on June 15.
The disclosure follows the conviction of Roman Lavrynovych, a 22-year-old Ukrainian construction worker based in London, who was found guilty at the Old Bailey following a six-week trial.
We bring you stories from the ground. Your support keeps our team in the field.
According to the Financial Times, prosecutors revealed that Lavrynovych was directed by a Russia-based handler using the Telegram pseudonym “El Money.” A cross-analysis of Telegram archives, cryptocurrency wallets, and court records conducted by the publication linked the handler to NoName057(16), a prominent pro-Kremlin hacktivist group. The US Cybersecurity and Infrastructure Security Agency has previously classified NoName as a covert project operating under a state-sanctioned Russian IT organization.
The network operates by recruiting local proxies to advance Moscow’s geopolitical interests and stoke domestic instability across Europe, the Financial Times reported. In the UK, the network aimed to exploit social fractures by generating and amplifying far-right, anti-migrant, and anti-Islamic propaganda.
To recruit foot soldiers, the Russian operators established an online English-language extremist movement called “Direct Action” following the UK riots in the summer of 2024. While the group presented itself as a grassroots British movement, the Financial Times established that it was run by administrators inside Russia who used VPNs to mask their identities but occasionally exposed their locations by posting content containing Cyrillic characters or Russian time zones.
Before escalating to arson, the handler spent seven months grooming Lavrynovych through lower-level criminal activities, the Financial Times reported. He was initially paid to distribute far-right propaganda posters and deface mosques with anti-Islamic graffiti across south London in early 2025. The campaign intensified rapidly in May 2025, when the handler directed Lavrynovych to carry out targeted strikes against three separate locations connected to the British Prime Minister, though court evidence indicated the worker was unaware of the properties' political significance.
The arson campaign began in the early hours of May 8, 2025, when Lavrynovych set fire to a Toyota RAV4 in North London that had previously belonged to Starmer, according to details published by the Financial Times. A few days later, on May 11, a second arson attack was carried out outside an Islington flat where Starmer had resided during the 1990s. The operation culminated just after midnight on May 12, when a fire was set directly at Starmer’s family home in Kentish Town while his sister-in-law and nine-year-old niece were inside the property.
Following the final attack, the handler instructed Lavrynovych to discard his clothing and prepare to flee London, promising a payout in Tether cryptocurrency, according to intercepted chat logs reviewed by the Financial Times. The handler warned him that he had targeted the home of a very high-ranking individual in Britain, advising him to stay low and use the secret code word “Geran” to receive legal assistance if detained.
“Look you attacked the home of a very high ranking individual in Britain. I will send you money, you need to leave the city. If police detain you, send a secret message ‘Geran’ (Geranium), and I will send a lawyer over to you.” — Telegram message from “El Money” to Lavrynovych, published by the Financial Times.
“Geran” is the Russian designation for Iranian-designed suicide drone used by Russia in its war against Ukraine, notably the Geran-2 (based on the Shahed-136).
Blockchain analysis conducted by the Financial Times showed that Lavrynovych’s digital wallet had previously received transactions originating from Garantex, a Moscow-based cryptocurrency exchange under US Treasury sanctions for facilitating cybercrime. British police arrested Lavrynovych at his residence hours after the final text exchange before any payment for the arson attacks could be finalized.
He was convicted of conspiracy to commit damage with fire and two counts of damaging property by fire being reckless as to whether life was endangered, the Financial Times reported. His co-defendant, 27-year-old Stanislav Carpiuc, was also convicted of assisting in the operations, while a third individual was acquitted.
This exposure of the group’s physical sabotage tactics follows a major law enforcement crackdown on its digital infrastructure. Dutch authorities had previously dismantled web networks heavily utilized by NoName057(16), seizing 800 servers from hosting companies operating inside the Netherlands on suspicion of violating international sanctions.
The operation highlighted the group’s expensive European campaign—which has included disruptive cyberattacks against Danish government sites and France’s postal service—and underlined how the Kremlin-backed collective relies on Western-based hardware to direct its operations.
Discuss this article:
-c439b7bd9030ecf9d5a4287dc361ba31.jpg "Photo of Katherina Popilnichenko")
-111f0e5095e02c02446ffed57bfb0ab1.jpeg "Photo of Roman Kohanets")
