We can reach you anywhere—that's the message.
Over five days in May 2025, three fires were set at properties connected to British Prime Minister Keir Starmer — a car, a residential building, a private home — in what UK authorities now describe as a coordinated campaign directed from Moscow. Two men, a Ukrainian and a Romanian national, were convicted after investigators traced their recruitment and payment to a Russian-speaking handler operating through encrypted messaging apps. The alleged architect, believed to be a Russian diplomat trained in information warfare, reportedly promised money, escape routes, and even Russian citizenship to those he recruited. The episode raises a question that history rarely answers cleanly: where does provocation end and the opening move of something larger begin.
- Three arson attacks on Starmer-linked properties within five days signaled a deliberate, escalating campaign rather than random acts of violence.
- A handler known only as 'El Money' groomed at least one recruit through Telegram — starting with small tasks, building dependency, then directing him toward targets at the heart of British government.
- One suspect was arrested the day after the final fire; another was caught at Luton Airport minutes before boarding a flight out of the country, suggesting the operation was unraveling faster than its architects anticipated.
- Beyond the fires, investigators allege Russian operatives ran fake far-right and Muslim online communities to deepen social fractures in the UK — a hybrid warfare playbook mixing physical sabotage with digital manipulation.
- No one was killed or injured, but Counter Terrorism Policing London made clear that was a matter of luck, not restraint — and that the evidence pointed squarely toward terrorism.
In May 2025, three fires broke out across five days at properties connected to British Prime Minister Keir Starmer — first a car that had once been his, then the entrance of a building tied to a company where he had served as director, then a house he owned. British police now say the attacks were orchestrated from Moscow.
Two men were convicted in connection with the campaign: Roman Lavrynovych, 22, a Ukrainian national, and Stanislav Carpiuc, 27, a Romanian also born in Ukraine. A third defendant was acquitted. What emerged from the investigation was a portrait of methodical recruitment — Lavrynovych was approached on Telegram by a Russian-speaking handler saved in his phone as 'El Money,' who began with minor requests before escalating toward the attacks, offering payment, escape funds, and Russian citizenship along the way. In one intercepted message, the handler congratulated Lavrynovych on targeting 'a very high-ranking person in Britain' and promised money to leave the city.
Lavrynovych was arrested on May 13th, the day after the final fire. Carpiuc was stopped at Luton Airport four days later, moments before boarding a flight to Romania. Investigators believe the handler was a Russian diplomat with training in information warfare, coordinating a broader operation from Moscow that also included fake far-right and Muslim online communities designed to amplify division across the UK — a hybrid warfare strategy blending physical sabotage with digital manipulation. The Russian Embassy denied any involvement.
Commander Helen Flanagan of Counter Terrorism Policing London noted plainly that no one died or was injured by luck alone. The three fires, taken together, were treated as acts of terrorism — because the evidence suggested that is precisely what they were. Whether they represent an isolated escalation or a signal of what follows remains the question Western intelligence agencies are now quietly trying to answer.
In May of last year, someone set fire to a Toyota that had once belonged to Keir Starmer. Three days later, flames appeared at the entrance of a residential building connected to the prime minister through a company where he had served as director. The day after that, a house he owned caught fire. Over five days, three separate attacks. British police now say they were orchestrated from Moscow.
The investigation that followed led authorities to Roman Lavrynovych, a 22-year-old Ukrainian national, and Stanislav Carpiuc, a 27-year-old Romanian who was also born in Ukraine. Both men were convicted. A third defendant, Petro Pochynok, 35, was acquitted. The story that emerged from the courtroom and police statements painted a picture of recruitment, direction, and payment flowing through encrypted messaging apps—a coordinated campaign designed to strike at the heart of British government.
Lavrynovych, according to investigators, was approached on Telegram by someone saved in his phone as "El Money." The handler was Russian-speaking and methodical. He began with small tasks, gradually escalating the requests, each time promising payment. By the time the actual attacks came, Lavrynovych had been thoroughly conditioned. In one intercepted message cited by the Kyiv Post, the handler wrote: "Look, you attacked the home of a very high-ranking person in Britain. I'll send you the money you need to leave the city." The handler also dangled Russian citizenship as an incentive and frequently expressed support for Vladimir Putin.
Police say Lavrynovych conducted reconnaissance before each fire—movements captured on CCTV and tracked through phone records. He was arrested on May 13, the day after the third attack. Carpiuc was caught at Luton Airport on May 17, stopped in the departure lounge moments before boarding a flight to Romania. The speed of his attempted escape suggested he understood the gravity of what he had done.
Investigators believe the handler was a diplomat trained in information warfare, part of a larger Russian operation directed from Moscow. The campaign, according to the Kyiv Post's reporting, extended beyond the physical attacks. Russian operatives allegedly used fake far-right and Muslim online communities to amplify division and fear across the United Kingdom—a textbook hybrid warfare operation mixing kinetic action with digital manipulation. The Russian Embassy denied involvement, rejecting what it called "any attempt to associate Russia or its foreign ministry with unlawful activities."
Commander Helen Flanagan of Counter Terrorism Policing London offered a stark assessment: the attacks were reckless, and the fact that no one died or was injured amounted to luck rather than design. A vehicle fire, a residential building entrance, a private home—each could have claimed lives. Each was treated as a potential act of terrorism, because that is what the evidence suggested it was.
The three fires in May 2025 marked an escalation in what Western intelligence agencies have long described as Russian hybrid warfare—the blending of conventional espionage, sabotage, disinformation, and social division into a coordinated assault on an adversary's stability. That such an operation would target the prime minister's own properties suggested either confidence or desperation, or perhaps both. The question now is whether this was an isolated incident or a signal of what comes next.
Notable Quotes
The actions of the two men involved in these arson attacks were incredibly reckless, and it was sheer luck that nobody was killed or injured.— Commander Helen Flanagan, Counter Terrorism Policing London
Look, you attacked the home of a very high-ranking person in Britain. I'll send you the money you need to leave the city.— Alleged message from handler 'El Money' to Lavrynovych, cited by investigators
The Hearth Conversation Another angle on the story
Why would Russia go after Starmer specifically? What's the strategic angle?
Starmer is the prime minister of a NATO country that has been consistently critical of Russian actions in Ukraine. Targeting him personally—his home, his property—is both a message and a test. It says: we can reach you anywhere. It also creates fear and instability at the top of government.
But they used Ukrainian nationals to do it. Doesn't that seem like a risk?
It does, which is why the handler was careful. He recruited people who might have grievances, promised them money and citizenship, and kept them at arm's length through encrypted apps. If something went wrong, there was plausible deniability. The handler was a diplomat—someone with immunity, someone harder to touch.
The fake online communities—the far-right and Muslim groups—how do those connect to the fires?
They're part of the same operation. While the arson attacks were happening, Russian operatives were amplifying division online, creating the impression of chaos and internal conflict. It's not just about burning a building. It's about making people feel unsafe, making them question their own society.
Did it work?
The attacks happened. No one died, which was luck. But the operation succeeded in its basic aim: it demonstrated capability and will. It showed that the prime minister's own home was not safe. That's a powerful message, whether or not the broader disinformation campaign took root.
What happens now?
That depends on whether this was a one-off or the beginning of something larger. If it's the latter, you'd expect to see similar operations targeting other NATO leaders, other critical infrastructure. The fact that investigators traced it back to a diplomat suggests they have evidence. The question is what Britain does with that evidence.