Even after Roman Lavrynovych was convicted on Monday for plotting arson, he appeared to grasp little about Prime Minister Sir Keir Starmer, much like a bullet understands nothing of its mark.

His unnamed controller, identified only by the initials EL, hinted at the stakes in one note: "Look, you struck the residence of a top British official. I will forward funds so you can exit the city."

By then it was too late, as Lavrynovych was detained hours later.

The 22-year-old Ukrainian construction worker had been turned into a tool against the UK leader. Yet the question remained: by whom?

Our inquiry shows the blaze formed part of a broad effort in sabotage, incitement and deception that traces directly to the Russian government.

The handler EL, who guided Lavrynovych, dangled Russian citizenship for further strikes and praised President Vladimir Putin, according to messages obtained by the BBC.

Evidence points to EL as a young Russian diplomat trained in information operations by intelligence and media figures, with ties to Moscow's inner circle. His name is Evgeny Lyukshin. At 23, he is the son of a high-ranking official.

Russian agents managed their disruption and provocation efforts from afar via social platforms and Telegram, we discovered, by setting up sham online far-right and Muslim communities used to stage vandalism across the UK and sow discord.

Accounts operating from Russia spread falsehoods about the motive behind the Starmer arson attempts, which were then amplified by voices including far-right activist Tommy Robinson.

The Russian embassy stated: "We reject any attempt to associate Russia or its foreign ministry with unlawful activities."

It added that Russia presents "no threat to the United Kingdom or its people and harbours no aggressive intentions towards Britain".

Lyukshin offered no reply to our queries, yet shortly after we reached him a propaganda channel we had questioned him about vanished.

'Work for the glory of the nation'

A third individual, Petro Pochynok, 35, was acquitted of conspiracy to commit arson.

The initial incident last year saw a Toyota once belonging to the prime minister torched in north London. Two further blazes followed: one at the doorway to former flats linked to Sir Keir and another at the entrance to his former house, now occupied by his sister-in-law.

The trial of the three men proved unusual, chiefly because the real force behind the events stayed hidden.

Proceedings centred only on monetary gain. The identity, links and aims of the anonymous handler who paid Lavrynovych were sidestepped.

In court the handler appeared as "EL Money", the label saved in Lavrynovych's phone, though on Telegram he simply used "EL". That app served as the recruitment site, where EL found Lavrynovych in a channel for Ukrainians in London hunting jobs.

From that harmless start, Lavrynovych received orders for rising offences, from hanging posters to graffiti to arson. He recognised the wrongdoing yet persisted in hopes of payment.

Only a handful of EL messages featured in court, all directed at Lavrynovych and Carpiuc, written in stiff Russian and weaker Ukrainian. We traced EL's broader reach through open-source methods.

EL's beliefs and aims stood clear.

Posts from the EL account across Telegram channels reveal praise for Putin and Russia, attacks on Ukrainians and promotion of Russian lines.

"It is obvious that Putin is the leader of the white race," one post read.

EL placed job ads in Ukrainian groups seeking "painters to do graffiti" in London, yet in other chats he used crude Russian slurs for Ukrainians.

EL urged strikes on draft offices in Ukraine, at war since Russia's 2022 invasion. He urged those backing the "white Slavic race" to join the "real Third Rome", invoking Russia's claim as heir to the Roman Empire.

"Work for the glory of the nation to spite your enemies," EL wrote, while dangling $1,000 and Russian citizenship for arson jobs.

EL dropped clues about his background, promising Russians in other groups access to Nato and CIA papers. "My father leaks part of it to me, it was not for nothing that he went to Europe," he said.

'This is war'

The trial omitted what the posters ordered by EL actually promoted: a supposed far-right outfit named Direct Action UK.

The group posed as a genuine British creation. Yet we traced Direct Action to online creation by Russian operatives aiming to divide UK residents.

Messages in the group carried Moscow timestamps, used Cyrillic script and placed pound signs after numbers, following Russian style.

The main accounts running Direct Action, especially EL's, also pushed Russian political aims in other channels and wrote in Russian.

Direct Action surfaced online in autumn 2024, after the Southport riots, and its material drew on images from that unrest.

Its social channels, promoted by the posters, showed clips calling Sir Keir a traitor, stoking anti-Muslim sentiment and offering cash for violence and arson, including on mosques and police. Direct Action also praised Tommy Robinson.

"This is war," the group proclaimed.

Though fake, Direct Action sparked real attacks. Six mosques and an Islamic school in London suffered vandalism last year after the group offered payment for anti-Muslim graffiti.

Phrases such as "remigration" and "Stop Islam" appeared on mosques from Croydon to Leyton. Direct Action turned footage of the damage into flashy videos to spread hatred and alarm.

The day after a mosque and primary school in Leyton were hit, EL posted a plain job notice in a Ukrainian work chat: "Part time job today! Leyton District. You need to take pictures of two buildings." He sought proof of the damage for online sharing.

Even Direct Action's apparent local backing was manufactured, existing only because it paid actors. Lavrynovych acted for EL purely for money, the court heard, not shared beliefs.

Anti-racist group Hope Not Hate probed Direct Action and alerted counter-terror police in February last year, well before the Starmer-linked fires. Hope Not Hate judged Russians responsible.

The organisation warned authorities that those behind the group might be grooming UK residents for "a terror attack against a mosque or identifiably Muslim target in the UK".

No reply came, says Nick Lowles, CEO of Hope Not Hate, which later joined the BBC investigation into Direct Action and its backers.

Tell Mama, which tracks anti-Muslim incidents, also shared evidence with counter-terror police and concluded Direct Action looked like a Russian project. It received only an acknowledgement.

Iman Atta, Tell Mama's CEO, said such matters receive little police attention, leaving Muslim communities concerned by a group offering cryptocurrency for mosque vandalism and division.

"It's something that is happening online, but it's actually moving directly into criminal damage and criminal acts of violence and terrorism on our streets," she said.

The Met confirmed to the BBC it is examining seven cases of criminal damage as anti-Muslim hate crimes. No arrests have occurred and it is "keeping an open mind" on possible links.

Hate leaflets

Before EL ran sham far-right pages, he helped launch a fake Islamic body called the Takbir Foundation.

We found this because EL's Telegram username once matched the fake foundation's name.

The foundation tried to recruit Muslims for "sacred graffiti" in the UK. Its true aim was plain: to provoke the far right through such acts. Telegram accounts posing as devout Muslims later flipped to a harsh anti-Islam stance under Direct Action.

In a Muslim Telegram group, another "El" account posted that the "Takbir Foundation is dedicated to financially supporting jihad throughout England. O mujahideen, be courageous and extend your hand towards the coming caliphate."

The foundation offered up to £150 for graffiti at one site and called it "halal money to promote the word of Allah".

Just as Direct Action later paid non-far-right actors, Takbir Foundation paid non-Muslims to spray Islamic slogans.

security.investigations@bbc.co.uk - please include a contact number if you are willing to speak to a BBC journalist
Or click here to learn how to use SecureDrop, an anonymous whistleblowing tool that works only in the Tor browser and follow the advice to stay secure

We located two Bristol graffiti artists who each answered an ad from a fake Facebook account named "Michael John" for "a paid opportunity with a generous budget", without any Islamic reference.

Both were told to spray the Islamic shahada in Arabic on a closed Debenhams in the city centre. One was also asked to paint a Quranic verse about the "devil's handiwork" on a Conservative Club.

They received images of the buildings with exact spots marked for the graffiti. This matched EL's method of sending marked images of mosques for Islamophobic tags.

The artists were offered Takbir Foundation payment but both declined, viewing the requests as illegal.

Another tie between EL and the Takbir Foundation shows how the handler and his fronts aimed to provoke and split ordinary citizens.

EL gave Roman Lavrynovych an anti-Muslim poster made to look as if written by a Hindu, citing the 1992 destruction of an ancient Indian mosque by Hindu nationalists. "Every mosque closed = 100 fewer crimes," it read.

Lavrynovych was told to post it on a specific road in Southall, west London, near Southall Central Masjid.

It is unknown if he completed the task. Yet we found the Takbir Foundation's Facebook account had shared a photo of the same poster on a brick wall in a Muslim community group, claiming it appeared in Southall. "Hate leaflets were found near Southall Central Masjid," the post stated.

EL was spreading hatred on UK streets while his fake foundation pushed the message into Muslim online spaces.

The strike on the prime minister's property also fed online propaganda.

One falsehood circulated by Russia-based accounts claimed the three Ukrainian suspects were sex workers, implying the fires stemmed from a personal scandal.

All of it was false. The suspects had no personal tie to the prime minister and were not sex workers. Still the claim was echoed by Tommy Robinson, the same figure promoted by Direct Action, EL's sham far-right group.

Robinson, whose real name is Stephen Yaxley-Lennon, asserted on X that Sir Keir Starmer had been "banging" Ukrainian male sex workers and shared a fabricated image of the prime minister with the suspects. Putin's special presidential envoy Kirill Dimitriev reposted one of Robinson's messages on the case.