Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

Belarus sent tank and mechanized battalions to training grounds near Poland and Lithuania for four-day drills that Minsk says focus on border security, counter-sabotage operations, and defense against drones and light aircraft, Militarnyi reported on 17 September, citing the Belarusian Defense Ministry.

The exercise includes tank and mechanized infantry battalions, units typically used in conventional ground warfare. Minsk says their tasks include guarding checkpoints and infrastructure and defending against drones. Some drills are taking place near the Suwałki Gap, the only land route connecting Lithuania, Latvia, and Estonia to the rest of NATO. The corridor lies between Belarus and Russia’s Kaliningrad region, which is separated from the rest of Russia. Belarus denies any offensive intent.

What Belarus says it is practicing

Belarus’s Western Operational Command is holding the exercises from 15 to 18 September under Chief of the General Staff Pavel Muraveyko, according to the ministry’s schedule outlined by Militarnyi.

The drills are taking place at the Gozha range near Lithuania and at the Brest and Ruzhany ranges near Poland. RBC-Ukraine wrote that mechanized and tank battalions are taking part and that the Brest and Ruzhany sites lie about 15 and 60 kilometers from the Polish border, respectively. Reservists have also been called up to local territorial-defense units, the ministry said.

Militarnyi cited the ministry as saying that one unit guarded a water intake, another directed traffic with police, and a mechanized brigade manned a checkpoint with border guards. The ministry also said truck-mounted fire teams were posted around the clock to defend against drones and practiced firing at targets imitating surveillance drones.

Muraveyko said the army was not considering offensive action and called allegations of preparations for an attack baseless, according to remarks quoted by Militarnyi. Belarus has not disclosed the total number of troops involved, and the exercise’s scale has not been independently verified.

The Moscow Times reported that the ministry also claimed the exercise remained below the notification thresholds set by the 2011 Vienna Document, an international agreement requiring advance notice of large military exercises.

How Russia could exploit the Suwałki Gap

In December 2025, security analyst Taras Zhovtenko warned that Russian propaganda had laid the groundwork to cite an alleged blockade of Kaliningrad to justify a limited incursion and the establishment of temporary checkpoints.

A German war game later modeled Russia staging border incidents before seizing key routes, although Baltic officials said the scenario severely underrated their armed forces.

Separately, French open-source analyst Clément Molin found that defenses along the Polish and Baltic borders with Russia and Belarus remained patchy and shallow, with Lithuania the most exposed. These assessments describe possible vulnerabilities, not evidence that an attack is planned.