Read part one of our Direct Action series: Over a year later, why has nobody been arrested for the far-right graffiti on various mosques in London?
A social account linked to an infamous fake far-right Telegram channel that offered cryptocurrency in exchange for vandalising mosques in the UK had seemingly connected to X (formerly Twitter) in Russia, a Tell MAMA investigation can reveal.
One of the purchased accounts those behind Direct Action UK used to promote themselves on X (formerly Twitter) mysteriously attempted to remove all references to it when accessing the platform via the Russian Federation Android App.
At some point between Tell MAMA publishing its report on Direct Action UK in December 2025 and the trial and subsequent convictions of Roman Lavrynovych and Stanislav Carpiuc in June 2026, an X account we identified in that report removed biographical information and deleted various posts about the extremist far-right channel, accessing the platform via the “Russian Federation Android App” and using a VPN to show a location in France, information gleaned after X rolled out a location transparency feature in late 2025, which is not without flaws nor controversies, however.
The individual(s) responsible have since removed Direct Action from its profile name, banner, and removed a link to the defunct Telegram channel. Its profile name now reads “Direct”, not “Direct Action”. It also mass-deleted various far-right, anti-migrant, anti-Muslim and Islamophobic materials cross-posted from the defunct Telegram channel. A notable deletion wrote, “#summer #riots Can we do it again?” made in January 2025 at a time when it was offering money to those who would vandalise mosques, accompanied by a picture of the prime minister depicted as a clown.
The account was one of several we identified as purchased X accounts used to create a false sense of authenticity of Direct Action, which began in September 2024, offering financial incentives (paid via cryptocurrency) to encourage attacks on police officers in hopes of encouraging far-right violence and disorder seen following the tragic murders and stabbings in Southport.
It launched its Telegram channel on 3 September 2024 before going private in mid-to-late February 2025, but not before using a similar tactic: offering financial rewards (via cryptocurrency) to vandalise mosques with far-right slogans in January.
Tell MAMA monitored their online activities in late January, providing the police and counter-terrorism with regular updates.
Direct Action UK, however, did not exist in the UK, but it worked hard to reach those who were.
Enter Roman Lavrynovych
Roman Lavrynovych, 22, was found guilty of conspiracy to damage property by fire and convicted of two counts of damaging property by fire (recklessness to whether it would endanger life), alongside Stanislav Carpiuc, over three arson attacks linked to properties and a car of the prime minister, Sir Kier Starmer, and faces sentencing on 19 June.
During the trial, it emerged that Roman Lavrynovych, under instruction from a Russian-speaking handler named “El Money”, printed and displayed Direct Action posters across part of London on the promise of financial payment. Whilst there is no evidence that Lavrynovych accessed the Telegram channel, the photographs of the poster (all using the same brand of tape) appeared in the main Direct Action UK Telegram channel. Evidence of this connection appeared in the Starmer arson trials, but was not developed further, despite police finding such evidence on his mobile phone.
The Financial Times published a wide-ranging article this week that revealed that “El Money” was based in Russia with close ties to a pro-Kremlin hacktivist network named NoName057(16), described by the Department of Justice in the United States as a “state-sponsored cyber criminal hacking group,” as the UK’s National Cyber Security Centre has mentioned NoName with regards to DDoS attacks on UK and international websites.
Our research report into Direct Action, published in December 2025, suggested links between it and other pro-Russian hacktivist groups, including “Юность Диверсанта” – The youth of the saboteur, suggesting more of a clandestine, not state-backed operation.
Taken from Tell MAMA’s report: The Risk of Foreign Influence on the UK Far-Right and Anti-Muslim Hate (December 2025).
Through heavy usage of AI-generated content (visual and text) alongside real-world footage of rioting post-Southport, it used TikTok, YouTube and X in tandem with Lavrynovych to put up posters (often containing a QR code and the URL of its short-lived TikTok account) across London (some of which claimed Manchester also) in mid to late 2024, to cultivate the idea of authenticity for far-right extremists seeking an alternative group post-Southport.
Our analysis found many textual inconsistencies and basic errors, suggesting a reliance on AI-generated content to appeal to an English-speaking audience. And on occasion, they would slip up, including leaving Cyrillic characters in English-language posts.
Examples of the errors detected in the Direct Action UK propaganda on social media.
An early Direct Action video included the text “Want? Make money and fight? Write to us!”
As Tell MAMA’s research report details at length, those within the Direct Action UK channels shared various terror manuals alongside guides to build Molotov cocktails, improvised explosive devices and instructions to commit terror attacks with bladed objects or vehicles. We observed discussions between members about how to target mosques, including one individual in the Cheshire area who stole discarded papers from a mosque and uploaded himself burning them. Encouraged by other members, he escalated his behaviour, including burning a copy of the Quran. In another example, a Manchester-based neo-Nazi received encouragement from those behind Direct Action to target a mosque in his area. A channel admin replied, “Looks like it, bro, here’s our graffiti stencil. Manchester needs graffiti too. You’ve got a chance to take home the prize for the coolest graffiti.”
Tell MAMA’s monitoring of the far-right extremism in two Direct Action UK Telegram channels, showed the admin trying to convince a Manchester-based neo-Nazi to vandalise a local mosque.
Other forms of AI-generated content sought to push racist violence fuelled by ideological grievance politics and other forms of extremist violence, notably towards the police, across their social media. With the latter forming a critical part of the group’s origins, which sought to exploit lingering tensions post-Southport in hopes of encouraging physical violence and the burning of police cars, offering sums of money (paid in cryptocurrency) up to £4,000. The scripted posts read “The government doesn’t notice your dissent? Let them feel it. Realise your protest. Fire + Police car = 4.000£ for you.”
The vandalism campaign against mosques gave more indication of the foreign element to the channel, writing, “For this direct action, you’ll need a can graffiti spray ~2-5£ and an hour of your time in the evening” People who create the most beautiful graffiti on mosques will receive a gift from our movement – 100£ in any cryptocurrency.” In other posts, they offered £200 in any cryptocurrency (again, written incorrectly with the £ symbol displayed in reverse).
Across various platforms, including YouTube and X, we misspelt hashtags like “#Glassgow” and the “#UnitedKingdoom” on numerous posts. The YouTube account was listed as “Direct Actions UK”, which only ever boasted one subscriber, had lain dormant in some form since its creation in 2022.
As the report stressed, we identified various individuals within the UK – from London, Manchester, Southampton, and other cities keen to involve themselves in extreme far-right direct action, demonstrating an appetite to cause harm and violence.
Further examples of in-group dynamics encouraging one member to go further and burn a copy of the Quran, after he stole rubbish from a local mosque to burn at home. It was one of many examples that Tell MAMA raised with the police.
During our monitoring of the Telegram channels, we alerted police to an individual who had stolen materials from the bin of a mosque to burn at home, boasting about it in the smaller, more extremist channel. When pushed by others, he would later post a video of himself burning a copy of the Quran.
With the police investigations into the graffiti on several mosques, Islamic centres and an Islamic school, and news of a third unknown suspect, there remain many questions for the Metropolitan Police and counter-terrorism with regards to Direct Action UK and the targeting of Muslim communities.