Even after Roman Lavrynovych, convicted on Monday of conspiring to commit arson, set fire to Sir Keir Starmer's house, he seemed to know as much about the prime minister as a bullet knows about its target.
His anonymous handler, known by the initials EL, gave a clue in a message: "Look, you attacked the home of a very high-ranking person in Britain. I'll send you money, you need to leave the city."
It was too late: Lavrynovych was arrested within hours.
The 22-year-old Ukrainian builder had been weaponised to target the UK's head of government. But by who?
Our investigation has found the arson attack was just one part of an extensive campaign of sabotage, provocation and lies leading all the way to the Russian state.
The handler EL, who directed Lavrynovych, offered Russian citizenship in return for other attacks and glorified President Vladimir Putin, messages the BBC has uncovered show.
We have identified evidence suggesting that EL is a young Russian diplomat, schooled in information warfare by spies and propagandists, who is close to the highest levels of power in Moscow. His name is Evgeny Lyukshin. He is 23 and the son of a senior official.
Russian operatives ran their sabotage and provocation campaign remotely through social media and the messaging app Telegram, we found, creating fake online far-right and Muslim groups, which were used to organise acts of vandalism in the UK and stir up division and fear.
Accounts based in Russia posted lies about the motive for the arson attacks targeting Starmer, which were spread by figures such as far-right anti-Islam activist Tommy Robinson.
The Russian embassy said: "We reject any attempt to associate Russia or its foreign ministry with unlawful activities."
It said that Russia poses "no threat to the United Kingdom or its people and harbours no aggressive intentions towards Britain".
Lyukshin did not respond to our questions, but hours after contacting him, a propaganda channel we had challenged him on disappeared.
Ukrainian national Lavrynovych, and Ukrainian-born Romanian national Stanislav Carpiuc, 27, have now been convicted at the Old Bailey of conspiring to commit arson by targeting property and a car connected to Prime Minister Sir Keir Starmer.
A third man, Petro Pochynok, 35, was found not guilty of conspiracy to commit arson.
The first fire last year occurred when a Toyota, previously owned by the prime minister, was set ablaze in north London. There were two more arson attacks: one at the entrance to flats where Sir Keir used to live and another at the entrance to his house, which had been rented to his sister-in-law after his move to No 10.
But the trial of the three men was strange, mainly because the true author of the drama was never revealed.
The case focused strictly on a financial motive. The identity, connections and motives of the anonymous handler who offered Lavrynovych money for the attacks were deliberately avoided.
In court, the handler was referred to as "EL Money", which is how he was saved in Lavrynovych's phone, but on the Telegram messaging app he simply used the initials "EL". This app was where EL recruited Lavrynovych, finding him in a group for Ukrainians in London seeking work.
From that innocuous initial connection, Lavrynovych was tasked with actions of escalating criminality, from plastering posters, to graffiti, to arson. Lavrynovych knew he was doing wrong but carried on anyway, hoping to earn a payday.
In court, there were only a limited number of messages from EL, all of them sent to Lavrynovych and Carpiuc, which showed him writing in formal Russian and far less proficient Ukrainian. But we were able to uncover EL's wider activities using open-source tools.
EL's ideology and goals were plain.
Messages from the EL account in various Telegram channels show him glorifying Putin and Russia, attacking the Ukrainian people and promoting Russian narratives.
"It is obvious that Putin is the leader of the white race," he posted in one chat.
EL posted in jobs groups for Ukrainians, asking for "painters to do graffiti" in London - but in other chat groups he used deeply offensive Russian terms for Ukrainian people.
EL incited attacks on conscription centres in Ukraine, which has been at war since Russia's full-scale invasion in 2022. He said that people there who are in favour of the "white Slavic race" should join the "real Third Rome", a reference to the belief that Russia is the successor to the Roman Empire.
"Work for the glory of the nation to spite your enemies," EL added, before offering $1,000 (£749) and Russian citizenship as a reward for arson attacks.
EL also gave hints about his identity, offering Russians in other Telegram groups access to documents from Nato and the CIA. "My father leaks part of it to me, it was not for nothing that he went to Europe," he said.
There was no mention in the trial of what the posters put up by Lavrynovych on EL's orders actually advertised: a purported far-right group called Direct Action UK.
The group sought to appear as an organic British creation. But we found that Direct Action was created online by Russian operatives to cause division among ordinary people in the UK.
Messages sent in the group bore a Moscow timestamp, used Cyrillic letters, and placed pound signs at the end of numbers, rather than at the start - as in Russian.
The accounts that were principally involved in running Direct Action, particularly EL's, were using other channels to promote Russian political goals and using Russian to communicate.
Direct Action first appeared online in autumn 2024, after the riots that followed the Southport murders, and its propaganda exploited images from the disorder.
Its social media channels, which the posters were advertising, featured videos branding Sir Keir a traitor, promoting hatred of Muslims and offering money for violence and arson, including attacks on mosques and police. Direct Action also lionised Tommy Robinson.
"This is war," the group declared.
But, although Direct Action was fake, it generated real-life attacks. In London, six mosques and an Islamic school were vandalised last year after the group offered payment for Islamophobic graffiti.
Slogans such as "remigration" and "Stop Islam" were spray-painted on mosques from Croydon in the south of the capital to Leyton in the east. Direct Action turned video clips of the vandalism into brash social media videos, to amplify hatred and create fear.
The morning after a mosque and primary school had been vandalised by a Direct Action attack in Leyton, EL posted an innocent-sounding ad in a chat group for Ukrainian people seeking work in London: "Part time job today! Leyton District. You need to take pictures of two buildings." He wanted images of the aftermath, so the vandalism could be publicised online.
Even Direct Action's apparent support on the ground was fake and only existed because it paid people to act. When Lavrynovych himself carried out actions for EL he did so for financial reasons, the court heard, not because he shared Direct Action's ideology.
Anti-racist organisation Hope Not Hate investigated Direct Action and reported its concerns to counter-terror police in February last year, months before the arson attacks relating to the prime minister. Hope Not Hate concluded that Russians were behind the group.
The anti-racist organisation told the authorities people behind the group may be grooming UK residents to launch a "terror attack against a mosque or identifiably Muslim target in the UK".
But no-one replied, says Nick Lowles, CEO of Hope Not Hate, which has since worked with the BBC to investigate Direct Action and the people behind it.
Tell Mama, a group which monitors anti-Muslim hate, also passed evidence to counter-terror police and concluded that Direct Action appeared to be a Russian operation. It received an acknowledgement but nothing more from police.
Iman Atta, Tell Mama's CEO, told us she believed such actions are not taken seriously by police, and it was worrying for Muslim communities to see a group offering cryptocurrency to vandalise mosques and create division.
"It's something that is happening online, but it's actually moving directly into criminal damage and criminal acts of violence and terrorism on our streets," she said.
The Met told the BBC it is investigating seven instances of criminal damage as anti-Muslim hate crimes. No arrests have been made and it is "keeping an open mind" whether offences are linked.
Before EL began running fake far-right groups, he helped to create a bogus Islamic organisation called the Takbir Foundation.
We discovered this because the username for EL's Telegram account previously bore the name of the fake foundation.
The foundation sought to recruit Muslims to spray-paint "sacred graffiti" in the UK. But its real goal was obvious: to inflame the far right with this vandalism. Telegram accounts that pretended to be those of devout Muslims later switched seamlessly to an aggressive anti-Islam agenda with Direct Action.
In a Telegram group for Muslims, another account called "El" posted that the "Takbir Foundation is dedicated to financially supporting jihad throughout England. O mujahideen, be courageous and extend your hand towards the coming caliphate."
The foundation offered up to £150 for graffiti in one location and said: "this is halal money to promote the word of Allah".
But, just as Direct Action would later pay people who were not really on the far-right, Takbir Foundation offered money to non-Muslims to spray Islamic graffiti.
We tracked down two Bristol graffiti artists who separately responded to an ad by a fake Facebook account with the name "Michael John" for "a paid opportunity with a generous budget", with no reference to Islam.
Both were asked to spray-paint the Islamic shahada - the declaration of faith - in Arabic on a defunct Debenhams in the city centre. One was also asked to spray a Quranic verse about the "devil's handiwork" on a Conservative Club in the city.
They were sent images of the buildings with precise areas highlighted showing where the graffiti was to be sprayed. This was the same approach as EL, who sent similar images of mosques when asking for them to be defaced with Islamophobic graffiti.
The artists were offered payment from the Takbir Foundation, but both refused the work, regarding the requests as illegal.
Another link between EL and the Takbir Foundation underlines how the handler and his fake groups sought to provoke and divide ordinary people.
EL had provided Roman Lavrynovych with an anti-Muslim poster, designed to appear like it had been written by a Hindu by referencing the 1992 destruction of an ancient Indian mosque by right-wing Hindu groups. "Every mosque closed = 100 fewer crimes," the poster said.
Lavrynovych was asked to put it up on a specific road in Southall, west London, which is home to a large mosque, Southall Central Masjid.
It is unclear if Lavrynovych carried out the task. However, we found the Takbir Foundation's Facebook account had posted a photo of the same poster - apparently on a brick wall - in a Muslim community group, claiming it had been plastered up in Southall. "Hate leaflets were found near Southall Central Masjid," the post said.
EL was sowing hatred on the UK's streets - and then his fake foundation was ensuring the message spread to the Muslim community online.
The attack on the prime minister's property was also used for online propaganda.
One lie spread on social media by Russia-based accounts became particularly well-known - that the three Ukrainian suspects were sex workers, with the implication that the fires were the result of a personal sex scandal.
It was all untrue. The suspects did not know the prime minister personally and they were not sex workers. But the lie was taken up by Tommy Robinson, the very person who had been promoted by Direct Action, EL's fake far-right group.
Robinson, whose real name is Stephen Yaxley-Lennon, claimed on X that Sir Keir Starmer had been "banging" Ukrainian male sex workers and posted a fake image of the prime minister with the suspects. Putin's special presidential envoy Kirill Dimitriev reposted one of his messages about the case.
These attacks fit the pattern of a wave of Russian-backed sabotage which has hit Europe over the past five years, targeting Ukraine and its allies - from explosions on railway lines to firebombs on planes destined for the UK.
Russia recruits people as "proxies", offering payment to carry out acts of violence, sabotage, and espionage. There can be layers of proxies, making it easier for Russia to deny involvement. In Russia itself, several organisations run such operations, not all of them formally part of the government.
Ukrainians are frequently targeted for Russian sabotage recruitment across Europe. The National Police of Ukraine said that in one Russian network plotting sabotage in 11 countries, including the UK - which was recently uncovered in a joint operation with the EU - a third of participants were Ukrainians.
"It's easier for the Russians this way, because it discredits Ukraine in the eyes of our partners and European countries," said Vitaliy Sova, a senior investigator.
More often, however, it is age rather than nationality that attracts sabotage recruiters, he says. Approached on social media, young people are offered "easy money" for a low-level crime, often masked as innocent tasks, then blackmailed if they try to refuse further actions.
The US has long been a target of Russian hybrid warfare. In one example, it accused a state-controlled media organisation, Rybar, of seeking "to sow discord, promote social division, stoke partisan and racial discord, and encourage hate and violence". Rybar has also been sanctioned by the UK government, which said it uses "classic Kremlin manipulation tactics".
Rybar ran an online campaign called TEXASvsUSA which was designed to look like real activism in the run-up to the last US presidential election in 2024, exploiting the issue of undocumented immigrants crossing the US border.
Hope Not Hate identified the account on Telegram that had created the TEXASvsUSA channel, and found it had also created a series of five UK-focused channels, including one called Radio Southport, which appeared after the riots in summer 2024.
They all promoted a relentlessly bleak view of the UK and spread racist abuse about migrants and Muslims - the same blueprint as Direct Action.
In the Direct Action Telegram chat group, we identified a member of the Russian elite associated with the ministry of foreign affairs: Evgeny Lyukshin, whose initials "EL" match those of the handler who directed the attack on the UK prime minister.
We found Lyukshin again in a private chat for Radio Southport, the channel created by Rybar. He was also in another chat that glorified the Wagner Group, the Russia-controlled military organisation whose late founder Yevgeny Prigozhin previously funded Rybar.
A picture posted by the Ministry of Foreign Affairs shows him standing behind Deputy Foreign Minister Alexander Grushko at a Diplomats' Day event in Moscow in February, where Foreign Minister Sergei Lavrov gave a speech.
Another photo he posted on social media placed him in the car park of the Ministry of Foreign Affairs in Moscow, with another showing his pass for a Russian embassy. A further image showed him posing in a military outfit holding bullets.
Lyukshin, 23, is the son of a senior Russian diplomat, who previously served as counsellor at the embassy in Denmark.
This means Lyukshin's father was in Europe, potentially with access to and knowledge of sensitive documents. This accords with the Telegram post by EL which stated he had access to Nato and CIA documents because his father had been in Europe.
Lyukshin has been training at the Moscow State Institute of International Relations (MGIMO), a diplomatic academy controlled by the foreign ministry, where Rybar has a "media school".
In a Telegram group of MGIMO students, which Lyukshin was the administrator of, the BBC has found discussion about "conducting pro-Russian propaganda" as part of the course.
Among the public Telegram groups shared between students was Lyukshin's own "The Lost Britain" group, where he had posted in English calling for taxpayer money to be "diverted" to the NHS instead of being spent on "support for Ukraine".
We found an image, posted on Telegram by Rybar, showing Lyukshin in a group of "future diplomats" who had "trained using Rybar's manuals". His face had been blurred in the photo but we matched his distinctive hoodie to photos from social media showing him wearing the same top.
In the Rybar photo, Lyukshin was pictured with the organisation's director, Mikhail Zvinchuk, who has been sanctioned by the UK and is wanted by US law enforcement for the TEXASvsUS campaign. Zvinchuk is closely involved with President Putin and sits on "special working groups" for the Ukraine war created by the Russian president.
The Rybar course that Lyukshin studied on was part of an entire programme devoted to "information warfare", created two years at the direction of the Kremlin.
It is jointly run by Putin's presidential administration and Andrey Sushentsov, who is sanctioned by the European Union for his close association with Putin and involvement in policies that threaten democracy and security.
The programme is taught by spies and close Putin allies.
One is Andrey Bezrukov, who spent decades as a spy in the West, using the identity of a dead Canadian, before his arrest in an FBI operation in 2010. The lives of Bezrukov and his wife, who also used a stolen identity, partly inspired the TV show "The Americans".
Another tutor is Sergey Nalobin, widely accused of being a spy, who once worked at the Russian embassy in London.
Lyukshin was previously at the prestigious First Moscow Cadet Corps, and images of him in military uniform have been posted online by his family, including one described as being taken in the Kremlin.
We do not know for sure if Evgeny Lyukshin is EL. Lyukshin did not respond when we contacted him setting out the evidence that he is.
But he was in the fake far-right group created by Russian operatives to cause hatred in the UK, his details match EL, he is trained in information warfare, and surrounded by Putin allies.
We set out our evidence about the attacks targeting the prime minister to Ben Wallace, the Conservative former defence secretary and security minister, who was in office during the Salisbury nerve agent attack and the full-scale invasion of Ukraine.
He says the evidence showed Russia conducting a "very deliberate and definite escalation against the British state".
Launching attacks on property linked to the UK prime minister was a change of policy that "would not have just come from a low-level individual, it would have come from the very top", he said.
Cdr Helen Flanagan, head of Counter Terrorism Policing London, said the aim of the attacks was clearly "to intimidate and create fear for the prime minister and to attack the UK". But she said police have not been able to prove the identity of EL or who he was working for, and that "we've got no evidence to suggest that this was a state-backed threat".
However, sources have told us that authorities in the UK and in Ukraine have privately concluded Russia was behind the arson attacks.
Hours after we contacted Lyukshin, mentioning that we knew he was a member of the Radio Southport Telegram channel, that channel vanished.
Four more channels also created by Rybar to stoke hatred in the UK disappeared with it, and the photo of Lyukshin with the deputy foreign minister was taken down by a Russian news site.
