UK Prime Minister's Home Arson Attacks Linked to Russian Cybercriminals Tied to Taiwan Cyberattacks

(Central News Agency reporter Chen Yun-yu, London, 15th) In May last year, three arson attacks occurred in the UK targeting properties and a vehicle linked to Prime Minister Keir Starmer. A court today found a Ukrainian man and a Romanian man, both residing in the UK, guilty. Sentencing will be announced on the 19th.

According to an investigation by the UK's 'Financial Times' (Financial Times), the mastermind behind the arson attacks is based in Russia and closely linked to the pro-Moscow hacker group NoName057(16).

Notably, in addition to the Financial Times report, public records indicate that NoName057 has also launched cyberattacks against Taiwan's government ministries, tax authorities, courts, financial institutions, private enterprises, airports, and metro systems. These attacks occurred after Taiwan made comments in September 2024 regarding historical territorial disputes with China and Russia.

According to information from the UK Crown Prosecution Service (CPS), 22-year-old Ukrainian national Roman Lavrynovych and 28-year-old Romanian national Stanislav Carpiuc were convicted. Lavrynovych was the direct perpetrator of the arson attacks, while Carpiuc participated in coordination and planning.

The Financial Times reported that UK prosecutors did not disclose the identity of Lavrynovych's 'handler,' only identifying the individual by the Telegram username 'El Money,' who communicated in Russian and Ukrainian.

Based on the Financial Times' investigation and interviews with Western officials, 'El Money' is located in Russia and has close ties to NoName057(16).

Multiple investigations have shown that NoName and other pro-Moscow or Moscow-affiliated hacker collectives not only recruit operatives online under anonymity, using financial incentives to lure individuals into carrying out subversive and destructive activities, but also spread extreme ideologies—including far-right and far-left narratives and anti-immigrant rhetoric—to deepen societal divisions in Western nations and incite further unrest and hatred.

The Financial Times reported that 'El Money,' the handler of Lavrynovych, previously recruited operatives in the UK via online platforms to spray anti-Islamic graffiti at mosques in Greater London. In recent years, Moscow-linked sabotage operations in Europe have increased in frequency, aggression, and provocation. However, the arson attacks targeting Starmer represent one of the most politically targeted incidents to date.

Ciaran Martin, former CEO of the UK's National Cyber Security Centre (NCSC), stated that in Russia, there is a natural flow of collaboration between state intelligence agencies and criminal groups, including the exchange of expertise and technology. As long as Moscow perceives its so-called national interests are not threatened, hackers are essentially free to act as they please.

According to the report, 'El Money' recruited Lavrynovych via Telegram in 2024. Lavrynovych, living in London, had been searching for local job opportunities in Ukrainian and Russian language groups, posting over 100 times between August 2024 and May 2025.

Lavrynovych first printed posters for the radical group 'Direct Action' under El Money's instructions and pasted them across London at night.

'Direct Action' appeared on the surface to be an English-language far-right group, advocating for attacks on mosques and police, and even instructing members on how to make bombs and conduct knife attacks.

Investigations revealed that 'Direct Action's' online activities were actually managed by individuals based in Russia, who used virtual private networks (VPNs) to conceal their identities and locations, and employed artificial intelligence (AI) tools to generate videos and other content.

However, the group's operators occasionally slipped up—for example, inadvertently revealing the Russian time zone.

During court proceedings, Lavrynovych admitted to carrying out at least two anti-Islamic actions for 'Direct Action.' Evidence obtained by the Financial Times shows that 'El Money' spent approximately seven months gradually guiding and indoctrinating Lavrynovych, encouraging him to escalate from lower-level acts of vandalism.

After becoming desensitized through repeated actions and overcoming psychological barriers, Lavrynovych set fire in May last year to Starmer's privately owned Toyota RAV4, his family residence, and his former home. Fortunately, no injuries were reported.

'El Money' had promised Lavrynovych several thousand dollars in cryptocurrency, on the condition that the attacks became major national news. After his arrest, Lavrynovych claimed that 'El Money' did not inform him that the vehicle and properties were linked to Starmer.

During the trial, Lavrynovych expressed disdain for Russia and referred to Russian President Vladimir Putin as a 'terrorist.'

Lavrynovych stated in court that he needed money due to medical needs for his family in Ukraine. Additionally, 'El Money' later threatened him, causing him to fear for his family's safety in Ukraine. It was only after completing the arson attacks that 'El Money' revealed the true severity of the situation.

During the trial, the Metropolitan Police in London stated they were unable to confirm whether Lavrynovych had received any payment from 'El Money.'

Lavrynovych claimed that 'El Money' had paid him for earlier actions but never compensated him for the arson attacks linked to Starmer.

Telegram screenshots obtained by the Financial Times show that in the early hours of May 13 last year, Lavrynovych messaged 'El Money' multiple times, urgently asking when payment would be made. Lavrynovych lived in London with his grandmother.

Shortly after Lavrynovych's final communication with 'El Money,' at 1:52 a.m. on the same day, London police raided his home and arrested him.

The Financial Times investigation revealed that 'Direct Action' is closely linked to NoName057. (Editor: Chen Cheng-chien) 1150615

Stand with the facts. Your support is a force in defending press freedom.

Download the Central News Agency 'First News' app to stay updated with the latest news.

Text, images, and videos on this website may not be reproduced, broadcast, publicly transmitted, or used without authorization.