Teenage Hitmen as Weapons: The FOXTROT Network’s European Reign

Sat Oct 03 2026 11:56:52 GMT+0000 (Coordinated Universal Time)

In Europe, young killers are being paid to carry out murder—an alarming trend propelled by the FOXTROT Network and state-linked actors.

The FOXTROT Network, a pan‑European crime syndicate tied to the Iranian regime, recruits teenagers as violent contractors, offering cash for one‑off hits. A 19‑year‑old gunman in Stockholm, Atilla Azimov, mistakenly killed a 20‑year‑old McDonald’s employee, showcasing the lethal consequences of such dealings. In the UK, 18‑year‑old Johannes Natland was chauffeured to a hotel in Huddersfield with weapons and cash, only to be arrested the next day. Europol’s task force OTF GRIMM has made over 280 arrests, but the network’s leaders remain in Iran, continuing to orchestrate attacks and eating into other groups’ operations.

Teenage Hitmen as Weapons: The FOXTROT Network’s European Reign

A narrow, soot‑black hoodie and a black balaclava can now carry a more sinister purpose. In a Stockholm suburb, a teenager armed with a handgun fired at a 20‑year‑old McDonald’s employee, killing him in seconds. The gunman, 18, was later identified as Atilla Azimov, who claimed he had been hired to do a job for cash. He had previously killed the wrong man in February, blurring the line between criminality and a policy‑driven murder method.

The motive behind these killings lies in a crime syndicate known as the FOXTROT Network. The group, headquartered in Sweden but now operating from Tehran, is allegedly backed by the Iranian regime and offers “violence as a service” (VaaS) to its recruits. Parents, family, schools, and even friends find themselves suddenly thrust into a business of murder—paying teenagers to be hitmen.

The syncronised approach shows how the FOXTROT Network recruits through social media, handing out instructions in a “gamified” online interface. Messages and imagery appear as if they were part of a video game, telling a 16‑year‑old “unknown” handler in Norway to pick a target, load a gun, and drive to a agreed hotel. The preparation culminates with the teenage hitman arriving in a hotel with a weapon and a “memory” of cash hidden in a foot tunnel, precisely the instructions used for Johanneast Naland’s Huddersfield case.

Johannes Natland, an 18‑year‑old Norwegian formerly raised in a children’s home, was offered a hit for 270,000 Norwegian krone (about 21,000 GBP). The hit was logged as “Killing in England 270k” by a teenager using the handle “UnknownHustler” and delivered to Natland after a VPN‑centric, hostage‑driven supply chain of online journalists. A ticket, an emergency passport, instructions on where to find hidden firearms, and a map to the hotel—all were delivered via Signal, the encrypted messaging app.

The consequence? Natland was arrested the next morning, still unaware of his intended target, but the prime suspect’s attempts to co‑ordinate with a wider network made him a case of high priority. The alleged attack was “planned” but never executed, raising questions of whether it was a criminal or political hit orchestrated for Iranian hegemony.

In total, since 2022 FOXTROT has been implicated in about 35 murders and several attempts at terrorist attacks against Israeli targets across Europe. Prosecutors say the network deliberately chooses “younger and younger” recruits because they give up less on their safety and are less likely to carry pleas for due process. The organisation has previously faced arrests, but its leadership remains safe in Tehran, equipping messages to allies from afar.

A coordinated European response is being led by Europol’s OTF GRIMM. In the past 15 months more than 280 arrests have been made, and figures include the likely “Agent 47” in the 1‑Murdock riddle. Some key figures, such as the presumed network valet—Ali Shehad Ahmed—have been extradited or are awaiting extradition, yet the chief, Rawa Majid, remains elusive in Iran. Policy makers on mainland Europe keep the warning about imminent threats in the balance: other criminal groups are now using the FOXTROT template, and thus the danger persists.

The unsettling picture that is emerging underlines why observing the everyday lives of vulnerable youngsters must be done through an extended social lens. If the networks of terror are successful in recruiting from places as far as Southern Sweden and are open to using “hit‑gathering” platforms, the prime answer will be thorough preventative policing and youth‑centered intervention programs run openly by the community.