On a frigid February night last year in a quiet Stockholm suburb, a figure cloacked in all black emerged from the darkness. Armed with a loaded handgun, he tracked 20-year-old Murad Abdelkader, a university student heading home after a late shift at a local McDonald’s. The gunman, 18-year-old Atilla Azimov, opened fire repeatedly as he closed in on his target, delivering a final execution-style shot to Abdelkader’s head as the young man lay defenseless on the ground. What made the tragedy even more senseless: Azimov had killed the wrong man.
Azimov was not acting on his own. He had been hired to carry out the killing for a fee by the Foxtrot Network, a ruthless transnational organized crime syndicate with deep ties to the Iranian regime that has gained infamy for its brutal ‘violence-as-a-service’ (VaaS) business model. Since 2002, law enforcement estimates the network has been behind approximately 35 murders across Europe, plus multiple planned and executed attacks against Israeli targets, including two incidents involving explosives and hand grenades.
The network’s core operating strategy is cynical and calculated: it recruits vulnerable, impressionable teenagers to carry out contracted hits for large promised payouts, yet almost never follows through on payment, as most of the young hired killers are arrested before they can collect. The recent conviction of Norwegian teenager Johannes Natland on conspiracy to murder charges by a London jury at the Old Bailey this week lays bare exactly how this exploitative system works.
According to OTF GRIMM, a specialized Europol task force created to counter the spread of VaaS across the continent, Foxtrot recruits teen hitmen entirely through social media, and structures instructions in a gamified format that mimics the progression of popular video games. Andy Kraag, head of Europol’s European Serious and Organised Crime Centre, describes the model as ‘the calculated outsourcing of murder’ that preys on young people facing instability or vulnerability. Currently, 11 European nations impacted by the VaaS phenomenon participate in the task force: Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden, and the United Kingdom.
Foxtrot’s leader, Rawa Majid, first fled Sweden, then left his subsequent operating base in Turkey, and now operates freely from Tehran, the capital of Iran. Investigations by Swedish investigative journalist Diamant Salihu, who has spent three years probing Foxtrot’s connections to the Iranian government, reveal that the network began working on behalf of the regime after Majid fled to Iran in October 2023. In exchange for safe haven and the ability to live without restriction in Iran, Majid agreed to carry out attacks on the regime’s behalf, targeting dissidents, opposition journalists, and Israeli interests. Some of the network’s attacks are still tied to domestic European drug turf wars, but a growing share align with Iran’s geopolitical goals. The UK government sanctioned both Foxtrot Network and Majid in April 2025.
The Natland case offers a step-by-step look at how the network grooms and deploys young recruits. Natland, the 18-year-old son of two Norwegian journalists from Stavanger, grew up in a comfortable home but struggled with substance abuse and psychosis, spending time in rehab and a youth children’s home. It was there he met another teen who went by the online alias UnknownHustler, who first showed him a recruitment post: ‘Killing in England 270k’ – equal to roughly £21,000 (270,000 Norwegian kroner). The post originated from a 16-year-old recruiter operating under the name Generalen, who had lived in a children’s home for three years, and he formally brought Natland into the plot.
Natland was then passed up the chain to a senior Foxtrot member with the username Agent 47, a reference to the protagonist of the popular Hitman video game franchise. Swedish authorities have identified Ali Shehad Ahmed, a close associate of Majid who often appears in photos alongside the network leader, as Agent 47. Agent 47 booked Natland a one-way ticket to Manchester Airport, helped him secure an emergency passport, and guided him through every step of his journey via the encrypted messaging app Signal before handing him off to a logistics coordinator known only as ‘1’.
Treating Natland like a player in a video game, ‘1’ sent him custom maps and pre-recorded videos marking the location of hidden guns in woodland outside Huddersfield, West Yorkshire, followed by another clip showing where a hidden cache of cash was stashed near a pedestrian foot tunnel. After Natland checked into a local hotel and retrieved the weapons, Agent 47 messaged him to confirm the hit would move forward the next day. But law enforcement was already one step ahead: Natland was arrested the next morning before he even received the identity of his target. British counterterrorism investigators are still working to determine if the planned hit was part of a criminal turf dispute or a political assassination ordered by the Iranian regime.
Generalen, the teen recruiter who brought Natland into the plot, was far more active than just this one planned attack. He was also responsible for recruiting at least two other teen killers who carried out murders in Sweden: Atilla Azimov, the man who mistakenly killed Abdelkader and is now serving a life sentence, and a 17-year-old who shot dead Ahmed Zamzam in Lund, southern Sweden, three and a half weeks before the Huddersfield plot was disrupted. As with almost all of Foxtrot’s recruits, neither killer ever received their promised payment – both were arrested before they could collect, a deliberate feature of the network’s business model, according to Salihu.
‘They don’t care at all if the teenagers get caught. Because when they get caught, they cannot ask for money that they have been offered, and we see no examples of money being paid to these young killers,’ Salihu explained. ‘It has been a deliberate policy to recruit younger and younger teenagers because they don’t think about the consequences of getting caught, and they are more willing to take the risks.’
Generalen was ultimately caught when he plotted to kill the 14-year-old son of a Norwegian police officer. He recruited a 15-year-old and a 17-year-old to carry out the knife attack, but the 15-year-old tipped off police. When Generalen was arrested, investigators discovered details of the Huddersfield plot on his phone, allowing British authorities to arrest Natland before any violence occurred. Generalen was convicted in May and is currently serving a 14-year prison sentence.
In the 15 months since OTF GRIMM launched, the task force has notched a series of key wins, with more than 280 arrests of suspects across the network, including several high-level leaders. One of the most significant arrests was that of Ali Shehad Ahmed, the suspected Agent 47, who was detained by Iraqi authorities in the Kurdish city of Sulaymaniyah. Sweden has formally requested his extradition to face charges for his role in the network. In May 2026, another key Foxtrot figure, former rapper Mohamed ‘Moewgli’ Mohdhi, was arrested in Tunisia.
Despite these successes, Foxtrot’s leader Rawa Majid remains beyond the reach of law enforcement, operating openly from Tehran. ‘He’s still active,’ Salihu warned. ‘And as long as this network is active we will still continue, I fear, to see attacks on the enemies of the Iranian regime.’
While law enforcement continues to dismantle key parts of the network, it remains unclear how deeply the organization’s ability to operate has been degraded. Compounding the threat is the fact that rival criminal groups, including the Dalen Network, Foxtrot’s main competitor, have already adopted the same VaaS model of exploiting vulnerable teens for hits. The model first emerged in Sweden, spread rapidly across Scandinavia and northern Europe, and reached the United Kingdom by 2025, as the Natland case demonstrates – meaning the risk of further violence remains very real for countries across the continent.
