How an Iran-linked network is turning teenagers into hitmen across Europe

For years, organised crime groups across Europe have relied on experienced criminals to carry out contract killings and violent attacks.

Investigators now say that model has changed dramatically.

Instead of recruiting seasoned gang members, criminal organisations are increasingly turning to teenagers, identifying vulnerable young people through social media, promising them large sums of money and directing them to carry out murders using encrypted messaging applications, said a BBC report published on Saturday.

At the centre of one of Europe’s most extensive investigations is Sweden’s Foxtrot Network, an organised crime syndicate that police believe has transformed murder-for-hire into what Europol describes as “violence-as-a-service” (VaaS).

Intelligence gathered by police in several countries suggests that after its leader, Rawa Majid, relocated to Tehran, elements of the network were allegedly used to target individuals regarded by Iran as enemies, including dissidents, journalists and Israeli-linked interests.

Iran has categorically denied any involvement with the gang.

Organised crime with political violence

The Foxtrot Network first gained notoriety in Sweden through its involvement in gang violence and drug trafficking. Since then, investigators say its operations have expanded far beyond domestic criminal rivalries.

According to the BBC, police believe the organisation has been behind approximately 35 murders since 2022.

In addition to fatal shootings, investigators have linked the network to multiple attacks and attempted attacks against Israeli targets across Europe, including incidents involving explosives and hand grenades.

The organisation is headed by Rawa Majid, a Swedish gang leader who fled Sweden before later relocating to Turkey. Police now believe he is living in Tehran, where investigators allege the relationship between the network and the Iranian regime deepened after October 2023.

Diamant Salihu, an investigative journalist with Swedish broadcaster SVT who has spent three years researching the organisation, believes the network’s activities changed significantly following Majid’s move.

“The regime is ordering the leader of the Foxtrot Network to instigate his network to commit attacks against the Iranian regime’s enemies,” he told BBC.

According to Salihu, those targets are not limited to one category. “It can be dissidents, journalists that are in the opposition against the regime, and it can also be Israeli targets.”

Salihu also described what investigators believe enabled Majid to remain in Iran. “He had to make a deal to be able to live freely in Iran, under condition that he and his network work for the regime.”

British authorities cited similar concerns when they imposed sanctions on Majid and the Foxtrot Network in April last year, accusing the organisation of carrying out attacks against Jewish and Israeli targets in Europe on behalf of the Iranian regime.

The United States had already sanctioned the group a month earlier, alleging that it had participated in international drug trafficking while also carrying out attacks targeting Israelis and Jews in Europe alongside its fugitive leader.

Following the British sanctions, the Iranian embassy in London stated, “The Embassy of the Islamic Republic of Iran categorically rejects the allegations connecting the Iranian government to the activities of a Swedish-based criminal gang, known as Foxtrot.”

How social media became the gang’s recruitment tool

According to Europol, vulnerable teenagers are approached through social media platforms and offered what appear to be life-changing amounts of money in exchange for carrying out murders.

The Foxtrot Network is regarded by investigators as one of the leading adopters of this strategy.

Rather than exposing senior members to direct involvement, the organisation allegedly delegates the violence to young recruits, many of whom have little understanding of the legal consequences or the dangers involved.

Investigators say communication rarely takes place face-to-face. Instead, recruits receive instructions digitally through encrypted messaging services, allowing organisers to remain hidden while coordinating operations across several countries.

Europol says this has evolved into what it calls a “violence-as-a-service” model. According to investigators, every stage of an operation — from recruitment and travel arrangements to locating hidden weapons and identifying cash drops—is coordinated remotely through digital communication.

Operational Taskforce (OTF) GRIMM, the Europol initiative established to combat this emerging threat, says recruits are often guided through assignments in a way that resembles video games.

Maps, videos and sequential instructions are sent to teenagers as they move towards their objectives, creating what investigators describe as a “gamified” experience.

Andy Kraag, head of Europol’s European Serious and Organised Crime Centre, summarised the approach by describing it as the “calculated outsourcing of murder” to vulnerable young people.

Investigators also believe many teenage recruits are deliberately selected because they are more willing to accept dangerous assignments without fully considering the consequences if they are arrested.

Salihu, whose reporting has followed the network’s development for several years, believes this is an intentional policy rather than a coincidence. “It has been a deliberate policy to recruit younger and younger teenagers because they don’t think about the consequences of getting caught, and they are more willing to take the risks.”

Teenagers are also allegedly promised significant payments before carrying out attacks, but in many cases those payments are never made because the recruits are arrested before they can collect the money.

According to Salihu, that outcome appears to suit the organisation. “They don’t care at all if the teenagers get caught. Because when they get caught, they cannot ask for money that they have been offered, and we see no examples of money being paid to these young killers,” he said.

The Stockholm killing that exposed the network’s methods

One of the investigations that brought international attention to the Foxtrot Network began on a winter evening in a Stockholm suburb. Murad Abdelkader, a 20-year-old student, was returning home after finishing a shift at McDonald’s when he was approached by a gunman dressed in black.

Investigators say the attacker repeatedly fired at Abdelkader before delivering a final shot as the victim lay on the ground. The killing shocked Sweden not only because of its brutality but because investigators soon concluded that Abdelkader had not been the intended target.

Police identified the gunman as 18-year-old Atilla Azimov. Authorities later determined that Azimov had accepted the assignment for money after being recruited by the Foxtrot Network.

However, investigators concluded that the victim had been mistaken for someone else. Azimov was convicted and sentenced to life imprisonment.

For investigators, the case demonstrated several recurring features that would later emerge in other Foxtrot-linked investigations. The alleged hitman was a teenager.

The murder had reportedly been carried out for financial gain rather than any personal motive. The recruit had allegedly been drawn into the assignment through the network’s system of online recruitment.

And despite carrying out the killing, authorities say he never received the money that had been promised because he was arrested soon afterwards.

Police also believe Azimov was not acting in isolation. Investigators say another teenager using the online alias “Generalen” had played a key role in recruiting him.

That same individual would later become they key to another international murder investigation stretching from Norway to the United Kingdom.

Authorities believe “Generalen” was only 16 years old at the time he recruited Azimov. According to investigators, he had spent the previous three years living in a children’s home before becoming involved in the Foxtrot Network’s operations.

Police now believe he recruited multiple teenage hitmen on behalf of the organisation, illustrating how adolescents were not only being used to carry out murders but were also allegedly being entrusted with recruiting other minors into the network.

The British murder plot

The British case centred on Johannes Natland, a Norwegian teenager who was convicted by a jury at London’s Old Bailey of conspiracy to commit murder after investigators concluded he had travelled to England to carry out a killing on behalf of the Foxtrot Network, reported BBC.

Natland, now 19, was arrested in March last year inside a hotel room in Huddersfield, northern England, where police recovered two firearms and ammunition before the planned attack could take place.

According to British prosecutors, Natland’s recruitment began with a simple online message offering a lucrative contract. The message read, “Killing in England 270k.”

Investigators said the amount referred to 270,000 Norwegian kroner — roughly £21,000 — for carrying out a murder in Britain.

The message was first relayed to Natland by another teenager who used the online handle “UnknownHustler”. According to investigators, UnknownHustler had received the offer from a separate teenage recruiter known online as “Generalen”.

Once Natland agreed to undertake the assignment, investigators say he was passed to another figure operating under the online identity “Agent 47”, a name borrowed from the popular Hitman video game franchise.

British prosecutor Alistair Richardson later told jurors that someone using the name “Agent 47” had organised the hiring of an assassin with €25,000 ($28,500) “in the pot” to pay for it.

Swedish investigators believe the individual behind that online alias is Ali Shehad Ahmed, a close associate of Foxtrot leader Rawa Majid. Authorities allege Agent 47 became Natland’s principal handler throughout the operation.

Police believe he arranged Natland’s one-way flight to Manchester Airport and even assisted him in securing an emergency passport so the journey could proceed without delay.

Throughout the trip, communication allegedly took place through the encrypted messaging application Signal.

Investigators say Natland received continuous guidance at every stage before being transferred to another Foxtrot operative known only by the username “1”, whose role focused on logistics.

Instead of meeting Natland in person, “1” allegedly supplied digital maps, videos and location instructions. Police say those materials directed Natland to woodland near Huddersfield where firearms had been hidden.

Additional videos allegedly showed him how to recover cash concealed in vegetation near a pedestrian tunnel. Investigators believe every movement was planned remotely, allowing senior organisers to stay far from the crime scene while directing events through encrypted communications.

Once Natland had checked into his hotel with the weapons, investigators say Agent 47 sent him another message. “We have much to do tomorrow.”

That tomorrow never arrived. British counterterrorism officers arrested Natland before the planned attack could be carried out.

Investigators later revealed that he had not yet been informed who his intended victim was.

Europol’s response and the international hunt for Foxtrot’s members

Europol established Operational Taskforce (OTF) GRIMM specifically to address the growing phenomenon.

The task force currently brings together investigators from Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden and the United Kingdom — all countries affected by the spread of violence-as-a-service.

According to Europol, organised crime groups increasingly recruit teenagers through social media before directing them remotely through encrypted communications.

Investigators say these methods have enabled criminal organisations to operate across borders with unprecedented flexibility.

Andy Kraag, head of Europol’s European Serious and Organised Crime Centre, described the phenomenon as the “calculated outsourcing of murder” to vulnerable young people.

Within the first 15 months of OTF GRIMM’s operations, authorities arrested more than 280 suspects connected to the broader violence-as-a-service model.

Among the most significant arrests was that of Ali Shehad Ahmed, whom Swedish police believe is the individual behind the online identity “Agent 47”. Ahmed was detained in Sulaymaniyah in Iraq’s Kurdish region.

Sweden has since requested his extradition to face proceedings linked to the Foxtrot investigation.

Another important breakthrough came in May when authorities arrested Mohamed “Moewgli” Mohdhi, a former rapper whom Swedish police describe as a “central actor” within the Foxtrot Network.

Swedish Deputy National Police Commissioner Stefan Hector said investigators were “constantly expanding our co-operation with other countries” and demonstrating to organised crime groups that “they cannot feel safe anywhere in the world”.

Despite those developments, investigators acknowledge that the network’s alleged leader remains beyond their reach.

Police believe Rawa Majid continues to reside in Tehran. According to Salihu, his influence has not diminished.

“He’s still active,” Salihu said. “And as long as this network is active we will still continue, I fear, to see attacks on the enemies of the Iranian regime.”

A model spreading beyond Sweden

Police say other organised crime groups have already begun adopting the same methods. Among them is Foxtrot’s rival, the Dalen Network, which investigators say has also started recruiting vulnerable teenagers to carry out murders using the violence-as-a-service model.

What began in Sweden has gradually expanded across Scandinavia and northern Europe before reaching Britain, illustrating how rapidly the method can spread once established.

Investigators believe social media recruitment, encrypted communication platforms and remote operational control have fundamentally altered how organised crime can recruit and deploy violence across international borders.

While dozens of suspects have been arrested and international cooperation has heated up, investigators acknowledge that key figures — including Rawa Majid — remain outside their reach.

Also Watch:

With inputs from agencies