Iran-Linked Crime Network Recruits European Teens as Hitmen for Cash

An 18-year-old walked up behind a 20-year-old McDonald's worker in a Stockholm suburb one night last February and shot him in the head. The victim, Murad Abdelkader, wasn't even the intended target. The shooter, Atilla Azimov, had the wrong man. He did it anyway, because he was getting paid.

Azimov was working for the Foxtrot Network, a Swedish organized crime group with ties to the Iranian regime, according to the BBC. Since 2022 the network is believed responsible for about 35 murders and a string of attacks and attempted attacks on Israeli targets across Europe, including two incidents involving explosives and hand grenades.

This isn't a one-off. It's a business model. Europol has stood up a task force, Operational Taskforce GRIMM, specifically to deal with what officials call violence-as-a-service, or VaaS. Eleven countries are now involved: Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden, and the UK.

How the recruiting works

According to OTF GRIMM, the network finds its shooters on social media and hands out instructions in a "gamified" format that mimics video games. Andy Kraag, who heads Europol's European Serious and Organised Crime Centre, called it "the calculated outsourcing of murder" to vulnerable young people.

These aren't hardened career criminals. They're teenagers, recruited online, given a target and a payday, and told to treat it like a mission in a game. The gang rarely even has to pay them, because most get caught before or after the job, according to the BBC.

Johannes Natland is the latest example. The Norwegian teenager was convicted of conspiracy to murder by a jury at the Old Bailey in London this week, tied to a planned killing in West Yorkshire. He was 18 at the time of his arrest in March 2025.

The Tehran connection

The man running Foxtrot, Rawa Majid, fled Sweden years ago, then relocated from Turkey to Tehran. Swedish investigative journalist Diamant Salihu, who has spent three years reporting on Foxtrot's Iranian links for public broadcaster SVT, says Majid didn't just find refuge in Iran. He says Majid struck a deal to stay there.

"The regime is ordering the leader of the Foxtrot Network to instigate his network to commit attacks against the Iranian regime's enemies," Salihu told the BBC. "It can be dissidents, journalists that are in the opposition against the regime, and it can also be Israeli targets."

Salihu says the arrangement began after Majid fled to Tehran in October 2023: "He had to make a deal to be able to live freely in Iran, under condition that he and his network work for the regime."

Police believe some Foxtrot attacks, including a hand grenade thrown at the Israeli embassy in Copenhagen, were carried out on the regime's behalf. Others, investigators say, are just ordinary turf-war violence tied to Foxtrot's drug trafficking business, unrelated to Tehran. Not every Foxtrot killing is a state-directed hit. Some of this is garden-variety gang warfare that happens to run through the same network Iran has apparently co-opted for its own purposes. Untangling which attacks were ordered from Tehran and which were drug-money disputes is difficult, and the reporting here doesn't claim certainty on every case.

The UK government sanctioned both the Foxtrot Network and Majid in April 2025, one month after Natland's arrest.

What's actually proven, and what isn't

The BBC's reporting, built substantially on Salihu's three years of investigation, lays out a clear pattern: teenage recruits, gamified instructions, a fugitive leader operating from Iranian soil, and a documented sanctions response from at least one Western government. What remains an open question is the exact command structure. Salihu's sourcing points to a direct arrangement between the regime and Majid, but the specific mechanics of how orders get relayed and confirmed from Tehran down to an 18-year-old with a gun in Stockholm aren't detailed in the available reporting.

It's the same gap that makes VaaS networks so hard to prosecute at the top. Police can catch the teenager who pulled the trigger. Tying that trigger-pull directly to a foreign government, in a way that holds up as a formal state-sponsorship finding rather than a police assessment, is a much higher bar.

For now, the concrete consequence is on the books: UK sanctions against Majid and the network since April 2025, a murder conspiracy conviction against Natland this week at the Old Bailey, and an 11-country Europol task force actively working the case. Whether any Western government moves beyond sanctions to a formal accusation of Iranian state sponsorship for a specific attack, such as the Copenhagen embassy grenade incident, is the next thing to watch.