Amateur saboteurs: the young men carrying out attacks for gangs, Russia and Iran

LONDON - Shortly after midnight on May 13, 2025, Ukrainian national Roman Lavrynovych messaged someone he knew as 'EL Money', a mystery figure who had instructed him to commit three arson attacks on property linked to British Prime Minister Keir Starmer.

"I hope I will have an opportunity to shake your hand soon ... Be in touch," he said in a text message.

An hour later, counter-terrorism officers raided his London home and he was charged with committing arson with intent to endanger life.

With his conviction on Monday, the 22-year-old Lavrynovych joins a growing list of mainly young men, lured on social media and found guilty in Britain of carrying out serious criminal acts on behalf of shadowy online figures for money which, more often than not, they never even received.

"Clearly the tasking (instruction) was to intimidate and create fear for the prime minister and to attack the UK," said Helen Flanagan, head of counter-terrorism policing in London, in an interview for British media.

"There is no evidence to suggest they knew who they were targeting or why. It was a quick dash for cash really."

USE OF PROXIES GROWS

Foreign states using unreliable and untrained individuals - many of them minors - to carry out such tasks was almost unheard of until recent years but a flurry of incidents in Britain and across Europe has brought the issue into focus.

The authorities say the aim is to sow unrest and division while allowing hostile governments to deny any involvement.

Russia has used the proxy tactic extensively in Ukraine: since its full-scale invasion in 2022, roughly one in five of the more than 1,100 Ukrainians accused of committing arson, terrorism or sabotage have been minors, Ukraine's security service has said.

British authorities say doing so in Britain became necessary after more than 600 Russian operatives, including over 400 spies, were expelled following the poisoning of Sergei Skripal and his daughter Yulia in Salisbury, southern England, in 2018.

A British inquiry last year concluded Russian President Vladimir Putin must have ordered that attack, carried out by GRU military intelligence officers. An inquest into the murder of Alexander Litvinenko with radioactive polonium in London in 2006 reached a similar conclusion.

Iran is now accused of using the same strategy. Both Moscow and Tehran reject such accusations, saying it is Western propaganda.

Those behind the activities might be acting without direct instructions from those in the Kremlin or elsewhere, and could be freelance operatives or even criminal gangs motivated by cash or seeking favours from those in power, UK security officials say.

Lavrynovych, for example, told police he did not even know who Starmer was, though 'EL Money' did tell him he had "attacked a home of a very high ranking individual".

Such "proxies" have been jailed for arson attacks on warehouses in London linked to UK support for Ukraine and reconnaissance on broadcaster Iran International, which is critical of Tehran. This month, two Romanians were convicted of stabbing an Iran International journalist.

SPATE OF ATTACKS SINCE WAR IN IRAN

Since the U.S. and Israel launched strikes on Iran in February, there have also been numerous incidents in London involving sites linked to the Jewish community or Iranian dissidents.

While the British authorities have not directly blamed the Iranian government, they have made it clear they see Tehran as a likely source for most attacks. Pro-Iranian Islamist group Harakat Ashab al-Yamin al-Islamiya (HAYI) has claimed responsibility for some incidents.

Earlier this month, the U.S. charged Iraqi national Mohammad Baqer Saad Dawood al-Saadi with being involved in multiple attacks against American and Israeli interests in Europe, including against the Jewish community in London. He denies directing people to carry out attacks in the name of HAYI.

U.S. prosecutors allege Al-Saadi was a close associate of Iranian commander Qassem Soleimani, killed by a U.S. drone in 2020. By contrast, those charged or found guilty in Britain seem to have little or no connection to Iran whatsoever.

Lavrynovych said he had been working on a construction site and was first contacted by EL Money on a Telegram chat used by Ukrainians to find jobs.

He told police he had felt threatened to comply with his orders and was worried about his grandmother, with whom he lived.

"I needed some more money," he told London's Old Bailey court. "I didn't know where he contacted me from."

British police and security officials say using such proxies is a growing concern.

"The likelihood is he took that tasking for money, had no ideological motivation or awareness of who he was targeting," counter-terrorism official Flanagan said.

Many of those charged as apparent proxies have been offered relatively small sums, though Austrian national Magomed-Husejn Dovtaev was convicted of tracking Iran International workers said he was offered €50,000 ($57,655).

Dovtaev, who flew into London from Vienna in 2023 to carry out the surveillance, told a parole board hearing in April that he had been given an opportunity to make "easy money".

Messages extracted from Lavrynovych's phone showed the relationship between him and EL Money developed over seven months, and that he had been previously paid by him to put up posters around London.

He told police he was offered £1,500 (around $2,000) to check out two addresses. 'EL Money' had offered to pay him via PayPal or in cryptocurrency, but the money never arrived.

($1 = 0.8672 euros)

($1 = 0.7484 pounds)

(Reporting by Michael Holden)

Copyright Reuters or USA Today Network via Reuters Connect.

This story was originally published June 15, 2026 at 9:36 AM.