Amateur saboteurs: the young men carrying out attacks for gangs, Russia and Iran - Finance news and analysis from Global Banking & Finance Review
Finance

Amateur saboteurs: the young men carrying out attacks for gangs, Russia and Iran

Published by Global Banking & Finance Review

Posted on June 15, 2026

5 min read

· Last updated: June 15, 2026

Add as preferred source on Google

Young Recruits and Foreign Proxies in the UK Sabotage Attacks Explained

By Michael Holden and Sam Tobin

The Rise of Proxy Sabotage Attacks in the UK

LONDON, June 15 (Reuters) - Shortly after midnight on May 13, 2025, Ukrainian national Roman Lavrynovych messaged someone he knew as 'EL Money', a mystery figure who had instructed him to commit three arson attacks on property linked to British Prime Minister Keir Starmer.

"I hope I will have an opportunity to shake your hand soon ... Be in touch," he said in a text message.

An hour later, counter-terrorism officers raided his London home and he was charged with committing arson with intent to endanger life.

With his conviction on Monday, the 22-year-old Lavrynovych joins a growing list of mainly young men, lured on social media and found guilty in Britain of carrying out serious criminal acts on behalf of shadowy online figures for money which, more often than not, they never even received.

Authorities' Perspective on Proxy Attacks

"Clearly the tasking (instruction) was to intimidate and create fear for the prime minister and to attack the UK," said Helen Flanagan, head of counter-terrorism policing in London, in an interview for British media. 

"There is no evidence to suggest they knew who they were targeting or why. It was a quick dash for cash really."

Use of Proxies Grows

Foreign States and Proxy Tactics

Foreign states using unreliable and untrained individuals - many of them minors - to carry out such tasks was almost unheard of until recent years but a flurry of incidents in Britain and across Europe has brought the issue into focus.

The authorities say the aim is to sow unrest and division while allowing hostile governments to deny any involvement. 

Russia has used the proxy tactic extensively in Ukraine: since its full-scale invasion in 2022, roughly one in five of the more than 1,100 Ukrainians accused of committing arson, terrorism or sabotage have been minors, Ukraine's security service has said.

British authorities say doing so in Britain became necessary after more than 600 Russian operatives, including over 400 spies, were expelled following the poisoning of Sergei Skripal and his daughter Yulia in Salisbury, southern England, in 2018.

Historical Context of Russian Operations

A British inquiry last year concluded Russian President Vladimir Putin must have ordered that attack, carried out by GRU military intelligence officers. An inquest into the murder of Alexander Litvinenko with radioactive polonium in London in 2006 reached a similar conclusion.

Iran's Alleged Involvement

Iran is now accused of using the same strategy. Both Moscow and Tehran reject such accusations, saying it is Western propaganda.

Those behind the activities might be acting without direct instructions from those in the Kremlin or elsewhere, and could be freelance operatives or even criminal gangs motivated by cash or seeking favours from those in power, UK security officials say.

Lavrynovych, for example, told police he did not even know who Starmer was, though 'EL Money' did tell him he had "attacked a home of a very high ranking individual".

Such "proxies" have been jailed for arson attacks on warehouses in London linked to UK support for Ukraine and reconnaissance on broadcaster Iran International, which is critical of Tehran. This month, two Romanians were convicted of stabbing an Iran International journalist.

Spate of Attacks Since War in Iran

Incidents Linked to Iran and Jewish Community

Since the U.S. and Israel launched strikes on Iran in February, there have also been numerous incidents in London involving sites linked to the Jewish community or Iranian dissidents.

While the British authorities have not directly blamed the Iranian government, they have made it clear they see Tehran as a likely source for most attacks. Pro-Iranian Islamist group Harakat Ashab al-Yamin al-Islamiya (HAYI) has claimed responsibility for some incidents.

International Connections and Accusations

Earlier this month, the U.S. charged Iraqi national Mohammad Baqer Saad Dawood al-Saadi with being involved in multiple attacks against American and Israeli interests in Europe, including against the Jewish community in London. He denies directing people to carry out attacks in the name of HAYI.

U.S. prosecutors allege Al-Saadi was a close associate of Iranian commander Qassem Soleimani, killed by a U.S. drone in 2020. By contrast, those charged or found guilty in Britain seem to have little or no connection to Iran whatsoever.

Recruitment and Motivation of Proxies

How Young Recruits Are Targeted

Lavrynovych said he had been working on a construction site and was first contacted by EL Money on a Telegram chat used by Ukrainians to find jobs.

He told police he had felt threatened to comply with his orders and was worried about his grandmother, with whom he lived.

"I needed some more money," he told London's Old Bailey court. "I didn't know where he contacted me from."

Financial Incentives and Deception

British police and security officials say using such proxies is a growing concern.

"The likelihood is he took that tasking for money, had no ideological motivation or awareness of who he was targeting," counter-terrorism official Flanagan said.

Many of those charged as apparent proxies have been offered relatively small sums, though Austrian national Magomed-Husejn Dovtaev was convicted of tracking Iran International workers said he was offered €50,000 ($57,655). 

Dovtaev, who flew into London from Vienna in 2023 to carry out the surveillance, told a parole board hearing in April that he had been given an opportunity to make "easy money".

Communication and Payment Methods

Messages extracted from Lavrynovych's phone showed the relationship between him and EL Money developed over seven months, and that he had been previously paid by him to put up posters around London. 

He told police he was offered £1,500 (around $2,000) to check out two addresses. 'EL Money' had offered to pay him via PayPal or in cryptocurrency, but the money never arrived.

Currency Exchange Rates

($1 = 0.8672 euros)

($1 = 0.7484 pounds)

(Reporting by Michael Holden)

Key Takeaways

  • Roman Lavrynovych was convicted for arson linked to PM Starmer after being recruited via Telegram by a mysterious Russian‑speaking handler “El Money” (apnews.com).
  • Ukraine security estimates ~22% of individuals recruited by Russian intelligence for sabotage are minors, many manipulated via addiction or socioeconomic vulnerability (old.imi.org.ua).
  • Iran is suspected of orchestrating low‑level hybrid warfare in Europe by recruiting criminal proxies—including teens—via messaging apps to target Jewish sites and dissident media, though direct state links remain unproven (theguardian.com).

References

Frequently Asked Questions

How are young men being recruited for sabotage attacks in the UK?
Young men are lured on social media by shadowy figures and instructed to commit crimes, often without knowing their targets or receiving promised payments.
Which foreign states are implicated in UK-based sabotage attacks?
Authorities link Russia and Iran to recent proxy attacks in the UK, although both countries deny involvement.
Why has the use of proxies for sabotage increased in recent years?
After the expulsion of Russian operatives from the UK, hostile states began using unreliable proxies, many of them minors, to create unrest while denying official ties.
What types of targets have been selected for these sabotage acts?
Targets include property linked to government officials, warehouses related to UK support for Ukraine, and sites linked to the Jewish community or Iranian dissidents.
What is the UK's response to these foreign-backed attacks?
UK authorities have jailed perpetrators and increased counter-terrorism measures, while highlighting the growing threat of foreign proxy involvement.

Tags

Related Articles

More from Finance

Explore more articles in the Finance category