Ukrainian guilty of vandalism at mosques linked to Russian network behind Starmer arson attack

A Pattern of Orchestrated Sabotage

Illia Bilyk, a 21-year-old Ukrainian national, has pleaded guilty to five counts of racially and religiously aggravated criminal damage following a series of targeted vandalism attacks against Muslim institutions in east London. The incidents, which occurred in January 2025, saw Bilyk spray abusive graffiti on the Stratford Islamic Association, Al-Birr Mosque, Leyton Jamia Masjid, Noor Ul Islam Primary School, and the Islamic Shariah Council. These acts were not isolated incidents of bigotry but were part of a broader, calculated campaign of sabotage and provocation orchestrated by a Russian-linked network.

Bilyk admitted to investigators that he was recruited via the messaging app Telegram by a Russian-speaking handler. Under the direction of this individual, Bilyk was instructed on which locations to target and was compensated financially for his actions. This revelation confirms that the vandalism was a component of a larger, state-aligned effort to sow discord and fear within British communities by exploiting existing social tensions.

The Shadowy Network Behind the Attacks

The investigation into Bilyk’s activities has uncovered a direct link to a sophisticated Russian sabotage operation that previously targeted the highest levels of the British government. Earlier in 2026, two other Ukrainian men, Roman Lavrynovych and Stanislav Carpiuc, were convicted for their roles in arson attacks against properties connected to former Prime Minister Sir Keir Starmer. Evidence presented during those proceedings and subsequent investigations revealed that these arsonists were also recruited and directed by the same Russian-speaking handler, known by the initials EL.

The handler, who operated through encrypted Telegram channels, utilized a fake far-right organization called Direct Action UK to coordinate these acts of violence and vandalism. By creating the illusion of organic, grassroots British extremism, the network aimed to destabilize public order and provoke societal division. Digital forensics, including timestamps and linguistic markers, have pointed toward the involvement of Russian state-linked actors, with some evidence suggesting the handler may be Evgeny Lyukshin, an individual with ties to Russian diplomatic circles and training in information warfare.

The arson plot was one element of a larger operation in which Russian-linked operatives used social media and Telegram to create fake far-right and purported Muslim groups, encourage vandalism and spread fear among British communities.

The Mechanics of Remote Recruitment

The recruitment process employed by the Russian network highlights the vulnerability of individuals to digital manipulation and financial coercion. The handler, EL, frequently utilized Telegram to post job advertisements, offering cryptocurrency payments in exchange for acts of sabotage, photography of specific buildings, or the dissemination of inflammatory propaganda. By targeting vulnerable individuals and offering incentives such as money or even promises of Russian citizenship, the network successfully outsourced its destabilization efforts to local actors.

This model of remote, decentralized sabotage represents a significant evolution in how state actors conduct hybrid warfare. By operating through intermediaries and utilizing encrypted platforms, the architects of these campaigns attempt to maintain plausible deniability while effectively executing operations on foreign soil. The use of fake groups like Direct Action UK serves to amplify the impact of these physical attacks, as images of the vandalism are shared online to further polarize public discourse and incite further unrest.

Broader Implications for National Security

The conviction of Bilyk and the preceding arson trials underscore the growing threat posed by foreign-directed sabotage campaigns within the United Kingdom. These incidents are no longer viewed as mere criminal acts but as deliberate attempts to undermine democratic stability and social cohesion. The involvement of Russian operatives in orchestrating both high-profile arson and localized Islamophobic vandalism demonstrates a multi-pronged strategy designed to exploit domestic grievances and erode public trust.

As authorities continue to dismantle these networks, the case serves as a stark reminder of the challenges posed by the intersection of social media, anonymous recruitment, and state-sponsored hybrid warfare. The British government and security services are now tasked with addressing not only the physical perpetrators but also the sophisticated digital infrastructure that enables these attacks. Bilyk is scheduled to be sentenced in October, marking another step in the ongoing effort to hold those responsible for this campaign of provocation to account.