When detectives from Counter Terrorism Policing London took over the investigation into three mysterious fires in north London in May 2025, they weren’t looking at a traditional spy ring. There were no dead drops, no invisible ink, and no diplomatic passports. Instead, the entire blueprint of a state-backed sabotage campaign was sitting inside a cheap smartphone seized in a Sydenham bedroom.
Following the June 15, 2026, guilty verdicts at the Old Bailey, newly released prosecution files have exposed the exact digital forensics used to dismantle the cell. Over 320 highly encrypted Telegram messages between the primary operative, Roman Lavrynovych, and his Russian-speaking handler, “El Money,” provided an unprecedented look at how Moscow recruits, funds, and handles its deniable assets in the West.
The Guardian
The Luton Airport Escape and the Logistics Node
The investigation moved at lightning speed once digital connections were established. While 22-year-old Lavrynovych was the physical hand that lit the matches, data analysis quickly pointed to a second man: 27-year-old Stanislav Carpiuc, a Romanian national living in Romford.
The Guardian
Carpiuc acted as the local financial and planning node, communicating with both “El Money” and Lavrynovych to coordinate timing and distribute the expected cryptocurrency payouts. Recognizing the heat from the Metropolitan Police, Carpiuc attempted to flee the country. On May 17, 2025—just five days after the final attack—counter-terrorism officers intercepted Carpiuc in the departure lounge at Luton Airport as he was about to board a flight to Romania.
Met Police News – Metropolitan Police
The Forensic Evidence Dossier
Evidence Type Source/Location Context in Trial
Retail CCTV B&Q Store Captures Lavrynovych purchasing white spirit (accelerant) days before the fires.
Physical DNA Crime Scene A discarded petrol can found near the burnt Toyota RAV4 matched Lavrynovych.
Chemical Analysis Suspect’s Clothing Lavrynovych’s trainers tested positive for traces of the exact white spirit used in Islington.
Location Data Mobile Networks Cell tower pings placed both defendants near all three targets in the dead of night.
“Write the Word Geranium”: The Kremlin’s Legal Contingency Plan
The most damning evidence presented to the jury was the emergency exit protocol provided by El Money. The Russian handler was well aware that his low-level recruits were walking into a high-visibility counter-terrorism trap.
Court logs revealed that after the final fire at the Kentish Town residence, El Money realized the scale of the police response and ordered Lavrynovych to flee London immediately. Knowing the 22-year-old construction worker was panicking about money, the handler sent a message containing a specific safety word:
Internazionale
“If the police detain you, secretly write the word ‘geranium’ and I’ll send a lawyer to you, I’ll give you money for a week and a new phone.”
The choice of the word “Geranium” (Geran in Russian) is highly symbolic in military circles—it is the exact name Russia uses for the Iranian-designed kamikaze drones it deploys to strike Ukrainian cities. For Western intelligence analysts, this linguistic fingerprint cemented the link between “El Money” and state-aligned hybrid warfare networks.
The Grooming Process: From Graffiti to Reckless Arson
The trial illustrated how rapidly an online target can be escalated from petty vandalism to major crime. The defense argued that Lavrynovych was trapped; he originally took online jobs because his father in Ukraine desperately needed expensive medical treatment.
Internazionale
The handler initially paid small sums for non-violent tasks, such as putting up political posters and spraying anti-Islamic graffiti at mosques across London during January and February 2025. This phase was designed to test the asset’s reliability and desensitize them to breaking British law.
South China Morning Post
By May, the financial leverage was absolute, and the instructions shifted to arson. However, the promised massive cryptocurrency payouts never arrived. Security officials used this failure as a warning to other vulnerable individuals online: these networks promise thousands, but they routinely abandon their proxies the moment the match is struck.
What Happens Next? The June 19 Sentencing
With the trial concluded, Justice at the Old Bailey has set the formal sentencing date for Friday, June 19, 2026.
Met Police News – Metropolitan Police
Because Lavrynovych was convicted of conspiracy alongside two counts of arson being reckless as to whether life was endangered—particularly concerning the fire where Starmer’s sister-in-law and a nine-year-old child had to flee choking smoke—legal analysts expect the court to hand down maximum sentences to deter future foreign-contracted sabotage.
The Crown Prosecution Service
Conclusion: A Fragmented Shield Against Cyber Recruitment
The UK government has made it clear that while the perpetrators didn’t know they were striking the Prime Minister’s property, the intent to cause terror on British streets remains a severe violation of national security. The physical cell has been broken, but as long as handlers like “El Money” can operate freely behind international borders with a Telegram account and a crypto wallet, the threat of outsourced sabotage remains active.
