Britain confronts rise in online-recruited proxy attacks for foreign sponsors

Britain’s latest security headache is not a classic spy ring or a lone extremist. It is a cheaper, messier model: hostile states and criminal networks recruiting young people online to carry out arson, sabotage and intimidation, then discarding them before investigators can trace the chain back to the sponsor.

That pattern was laid bare in the case of Roman Lavrynovych, a 22-year-old Ukrainian national who messaged a handler known as EL Money shortly after midnight on May 13, 2025. A Toyota RAV4 formerly owned by Keir Starmer had been set on fire in Kentish Town, north London, in the early hours of May 8, 2025, and Lavrynovych later became one of three men tried over attacks linked to the Labour leader. Lavrynovych and Stanislav Carpiuc were found guilty, while Petro Pochynok was acquitted. The Crown Prosecution Service said Lavrynovych and Carpiuc will be sentenced at the Old Bailey on Friday, June 19, 2026.

The Starmer case has become a window into a wider threat that British officials say is expanding fast. Counter-terrorism police have said hostile state activity in the UK has risen five-fold since the 2018 Salisbury poisonings of Sergei and Yulia Skripal. They say about one-fifth of current casework now involves threats beyond traditional terrorism, including state-sponsored espionage, sabotage and targeted violence. Officials have warned that some of the recruits used for such work are as young as their mid-teens, drawn in online and then left unpaid, or “ghosted,” after carrying out the task.

That makes these operations difficult to police. The people who set the fires, deliver the threats or pass along instructions are often low-level criminals with no obvious ideological commitment and only a thin digital trail. The real sponsors gain distance and plausible deniability. British officials say that is exactly the appeal for foreign intelligence services and their criminal partners: the attacks can be cheap, fast and hard to attribute.

Iran has also been accused of using similar methods. The UK government said in July 2025 that Iran-linked intelligence activity posed a state-threat problem involving criminal proxies, and UK and allied governments have publicly accused Iranian intelligence services of collaborating with criminal organizations to kill, kidnap and harass people in Europe and North America. Russia denies similar allegations, as does Iran, both dismissing them as Western propaganda.

The Salisbury precedent still shapes the British response. After the 2018 nerve-agent attack, Britain expelled 23 Russian diplomats, and allies later expelled more than 100 Russian intelligence officers in a coordinated response. For security services, the lesson is stark: the frontier now runs through social media, petty crime and disposable recruits, where sabotage can be outsourced and responsibility blurred before the smoke has cleared.