The Foxtrot Network has used social media and gamified tasking to recruit vulnerable teenagers across Europe to carry out murders and attacks since 2022, with investigators linking it to around 35 killings. Europol’s OTF GRIMM coordinates law-enforcement efforts across 11 countries and reports 280+ arrests, including alleged controller "Agent 47." The group's leader, Rawa Majid, is believed to be at large in Tehran, and rival gangs have adopted similar "violence-as-a-service" methods.
Young Guns For Hire: How Europe’s Crime Networks Recruit Teen Hitmen
Atilla Azimov posing with a gun three months before he killed Murad Abdelkader [Swedish Police]
In a Stockholm suburb on a winter night, a man dressed in black emerged from the darkness and opened fire at close range. The victim, 20-year-old student Murad Abdelkader, was shot repeatedly and finished with a final shot to the head. The shooter, 18-year-old Atilla Azimov, was later jailed for life — for a murder carried out on behalf of the criminal Foxtrot Network that targeted the wrong man.
Atilla Azimov, seen in CCTV images and after his arrest, was jailed for life for the mistaken killing [Swedish Police]
The Foxtrot Network has become notorious for a "violence-as-a-service" (VaaS) model: outsourcing shootings, bombings and other attacks to vulnerable teenagers in exchange for promises of payment. Since 2022 investigators attribute roughly 35 murders and a number of attacks on Israeli targets across Europe to the network, including incidents involving explosives and hand grenades.
Rawa Majid, the leader of Foxtrot, pictured with Ali Shehad Ahmed, who is believed to be part of the network [Swedish Police]
How the Recruitment Works
Europol’s Operational Taskforce (OTF) GRIMM — the unit set up to counter VaaS — says Foxtrot and copycat groups recruit on social media, grooming youth with gamified instructions that mirror video-game mechanics. Recruits are guided step-by-step through encrypted messaging apps, shown videos and maps to hidden weapons and cash stashes, and treated as disposable operatives who often never receive the promised payment.
Teenage hitman Johannes Natland posing with cash he had been given [Counter Terrorism Policing]
Case Study: The Natland Plot
One high-profile example is the case of Johannes Natland, an 18-year-old from Norway convicted in Britain of conspiracy to murder after being recruited to carry out a killing near Huddersfield. Natland was introduced online to an intermediary called "Generalen," passed on to an operative known as "Agent 47," and given directions to weapon and cash caches in woodland. He was arrested before he knew his intended victim.
Ali Shehad Ahmed was arrested in Iraq and Sweden has requested his extradition [Iraq National Intelligence Service]
"Calculated outsourcing of murder" — Andy Kraag, head of Europol's European Serious and Organised Crime Centre, has described the practice as a deliberate exploitation of vulnerable young people.
Leadership, Links and Law Enforcement Response
Foxtrot’s alleged leader, Rawa Majid, fled Sweden and Turkey and is believed to be based in Tehran. Swedish investigative reporting and police inquiries suggest some attacks may have been carried out at the behest of elements linked to the Iranian regime, though many incidents also stem from drug turf disputes and organised-crime rivalries. The UK sanctioned Foxtrot and Majid in April 2025.
Since the creation of OTF GRIMM, authorities across 11 countries — Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden and the UK — report more than 280 arrests. Key detainees include Ali Shehad Ahmed, accused of using the alias "Agent 47," who was arrested in Iraq and is subject to a Swedish extradition request, and Mohamed "Moewgli" Mohdhi, arrested in Tunisia.
Why Teenagers Are Targeted
Investigators say Foxtrot deliberately recruits younger and more vulnerable teenagers because they are less likely to consider long-term consequences and more willing to take extreme risks. Organisers appear indifferent to whether recruits are captured — when teenagers are arrested before payment, they cannot demand the money promised, and the network avoids financial exposure.
While the arrests have disrupted parts of Foxtrot’s network, rival groups such as the Dalen Network have already adopted similar VaaS methods. Law enforcement officials warn the threat remains active and transnational.
What to watch next: continued extradition proceedings for high-value suspects, the impact of sanctions on Foxtrot’s finances, and whether OTF GRIMM’s cross-border cooperation can curtail the spread of gamified recruitment tactics.
Help us improve.
