Ukrainian Illia Bilyk admitted spraying Islamophobic graffiti on mosques in east London in 2025, recruited and paid by Russian state actors linked to sabotage and arson against UK Prime Minister Keir Starmer.

Political & Legal SubversionUnknownUnknown

Aggressor

Summary

Illia Bilyk, a 21-year-old Ukrainian man, pleaded guilty to racially and religiously aggravated vandalism involving Islamophobic graffiti sprayed on several mosques and Islamic institutions in east London in January 2025. Bilyk admitted he was recruited and paid by a Russian-speaking operative via Telegram to carry out the graffiti attacks. This activity is linked to a broader Russian state sabotage and provocation campaign behind arson attacks targeting UK Prime Minister Sir Keir Starmer and Islamophobic vandalism across London. The Russian network, involving a Russian operative known as EL and a Russian diplomat Evgeny Lyukshin, used fake far-right groups such as Direct Action UK to organise and incite these acts remotely. Other Ukrainians involved in similar arson attacks and graffiti were also recruited on Telegram and paid by the Russian handlers. The case highlights Moscow's use of covert proxy elements and disinformation as hybrid warfare tools targeting UK social cohesion and leadership.

Classification

Confidence: High

The incident involves covert Russian state manipulation and sabotage through proxy actors recruiting and directing vandalism and arson attacks in the UK to sow social division and target political figures, fulfilling criteria for hybrid hostile activity using information operations and proxy irregular tactics.

Source URL

https://bbc.com/news/articles/c8dx5gldrk0ko

Open source

Provenance

Publisher: extension
Submitted: Sep 28, 2026, 07:04 UTC
Last updated: Nov 8, 2026, 15:12 UTC
Event time: Jan 23, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "07fb2741-54e3-4e35-904c-3b08066e370a",
  "url": "https://bbc.com/news/articles/c8dx5gldrk0ko",
  "source": "extension",
  "status": "processed",
  "category": "Political & Legal Subversion",
  "subcategory": "Unknown",
  "incident_type": "Unknown",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "2",
  "tags": [
    "Russia",
    "United Kingdom",
    "Russia-linked sabotage",
    "Islamophobic vandalism",
    "Hybrid warfare",
    "Telegram recruitment",
    "information operations",
    "Direct Action UK",
    "Arson attacks",
    "Keir Starmer",
    "Proxy recruitment"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Illia Bilyk, a 21-year-old Ukrainian man, pleaded guilty to racially and religiously aggravated vandalism involving Islamophobic graffiti sprayed on several mosques and Islamic institutions in east London in January 2025. Bilyk admitted he was recruited and paid by a Russian-speaking operative via Telegram to carry out the graffiti attacks. This activity is linked to a broader Russian state sabotage and provocation campaign behind arson attacks targeting UK Prime Minister Sir Keir Starmer and Islamophobic vandalism across London. The Russian network, involving a Russian operative known as EL and a Russian diplomat Evgeny Lyukshin, used fake far-right groups such as Direct Action UK to organise and incite these acts remotely. Other Ukrainians involved in similar arson attacks and graffiti were also recruited on Telegram and paid by the Russian handlers. The case highlights Moscow's use of covert proxy elements and disinformation as hybrid warfare tools targeting UK social cohesion and leadership.",
  "summary_short": "Ukrainian Illia Bilyk admitted spraying Islamophobic graffiti on mosques in east London in 2025, recruited and paid by Russian state actors linked to sabotage and arson against UK Prime Minister Keir Starmer.",
  "summary_extended": null,
  "actor_primary": "Russian operative 'EL'",
  "target_primary": null,
  "location_text": "East London, UK",
  "location_region": null,
  "location_coordinates_lat": 55.378051,
  "location_coordinates_lon": -3.435973,
  "location_precision": "Exact",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The incident involves covert Russian state manipulation and sabotage through proxy actors recruiting and directing vandalism and arson attacks in the UK to sow social division and target political figures, fulfilling criteria for hybrid hostile activity using information operations and proxy irregular tactics.",
  "event_time_utc": "2025-01-23T00:00:00.000Z",
  "end_time_utc": "2025-01-25T00:00:00.000Z",
  "event_time_confidence": "pm24h",
  "created_at": "2026-09-28T07:04:01.308Z",
  "updated_at": "2026-11-08T15:12:04.633Z",
  "reliability_band": "strong",
  "location_precision_band": "exact",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Exact

Source reliability

Info credibility

Event time

Jan 23, 2025, 00:00 UTC

End time

Jan 25, 2025, 00:00 UTC

Event time confidence

pm24h

Location

East London, UK

Primary actor

Russian operative 'EL'

Country

United Kingdom

Tags

Russia, United Kingdom, Russia-linked sabotage, Islamophobic vandalism, Hybrid warfare, Telegram recruitment, information operations, Direct Action UK, Arson attacks, Keir Starmer, Proxy recruitment

Loading signal...

{ "id": "07fb2741-54e3-4e35-904c-3b08066e370a", "url": "https://bbc.com/news/articles/c8dx5gldrk0ko", "source": "extension", "status": "processed", "category": "Political & Legal Subversion", "subcategory": "Unknown", "incident_type": "Unknown", "country": "United Kingdom", "source_reliability": "B", "info_credibility": "2", "tags": [ "Russia", "United Kingdom", "Russia-linked sabotage", "Islamophobic vandalism", "Hybrid warfare", "Telegram recruitment", "information operations", "Direct Action UK", "Arson attacks", "Keir Starmer", "Proxy recruitment" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "Illia Bilyk, a 21-year-old Ukrainian man, pleaded guilty to racially and religiously aggravated vandalism involving Islamophobic graffiti sprayed on several mosques and Islamic institutions in east London in January 2025. Bilyk admitted he was recruited and paid by a Russian-speaking operative via Telegram to carry out the graffiti attacks. This activity is linked to a broader Russian state sabotage and provocation campaign behind arson attacks targeting UK Prime Minister Sir Keir Starmer and Islamophobic vandalism across London. The Russian network, involving a Russian operative known as EL and a Russian diplomat Evgeny Lyukshin, used fake far-right groups such as Direct Action UK to organise and incite these acts remotely. Other Ukrainians involved in similar arson attacks and graffiti were also recruited on Telegram and paid by the Russian handlers. The case highlights Moscow's use of covert proxy elements and disinformation as hybrid warfare tools targeting UK social cohesion and leadership.", "summary_short": "Ukrainian Illia Bilyk admitted spraying Islamophobic graffiti on mosques in east London in 2025, recruited and paid by Russian state actors linked to sabotage and arson against UK Prime Minister Keir Starmer.", "summary_extended": null, "actor_primary": "Russian operative 'EL'", "target_primary": null, "location_text": "East London, UK", "location_region": null, "location_coordinates_lat": 55.378051, "location_coordinates_lon": -3.435973, "location_precision": "Exact", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The incident involves covert Russian state manipulation and sabotage through proxy actors recruiting and directing vandalism and arson attacks in the UK to sow social division and target political figures, fulfilling criteria for hybrid hostile activity using information operations and proxy irregular tactics.", "event_time_utc": "2025-01-23T00:00:00.000Z", "end_time_utc": "2025-01-25T00:00:00.000Z", "event_time_confidence": "pm24h", "created_at": "2026-09-28T07:04:01.308Z", "updated_at": "2026-11-08T15:12:04.633Z", "reliability_band": "strong", "location_precision_band": "exact", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }