The Foxtrot Network recruits teens via social media to conduct murders and attacks in Europe on behalf of criminal and Iranian regime interests using a gamified 'violence-as-a-service' model, posing a cross-border security threat.

Terrorism & Criminal Proxy TacticsTerrorismUnknown

Aggressor

Summary

The Foxtrot Network is an organized crime group operating across Europe that recruits vulnerable teenagers through social media to carry out violent attacks and murders for cash, employing a 'violence-as-a-service' (VaaS) model. The network has been linked to about 35 murders and multiple attacks on Israeli targets, including grenade attacks, with some operations believed directed by the Iranian regime. The network's leader, Rawa Majid, fled Sweden and Turkey, now operates out of Tehran under a deal with Iran to conduct attacks against regime enemies, including dissidents and Israelis. The group uses a 'gamified' recruitment and operational approach, guiding teenage hitmen like Johannes Natland and Atilla Azimov through missions via encrypted messaging and hidden weapon caches. Europol's OTF GRIMM taskforce involving 11 countries has made over 280 arrests disrupting Foxtrot and affiliated VaaS groups, but the method has rapidly spread to rival networks in northern Europe and the UK, sustaining the threat.

Classification

Confidence: High

The signal documents a coordinated, transnational criminal-terror network using hybrid methods including proxy teenage assassins and ties to a foreign regime orchestrating attacks on political and ethnic targets in Europe, evidencing hostilities beyond conventional crime.

Source URL

https://bbc.co.uk/news/articles/czrjyevmv61o

Open source

Provenance

Publisher: extension
Submitted: Aug 3, 2026, 13:21 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jan 1, 2022, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "f83fa86c-7491-481a-9a82-60edd17dc822",
  "url": "https://bbc.co.uk/news/articles/czrjyevmv61o",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Terrorism",
  "incident_type": "Unknown",
  "country": "Sweden",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Foxtrot Network",
    "Violence-as-a-Service",
    "Iranian regime",
    "teenage hitmen",
    "Europol OTF GRIMM",
    "Rawa Majid",
    "Johannes Natland",
    "Atilla Azimov",
    "Ali Shehad Ahmed",
    "cross-border organized crime",
    "gamified recruitment",
    "Iran",
    "Sweden",
    "United Kingdom"
  ],
  "nodes": [],
  "countries": [
    "Sweden",
    "United Kingdom",
    "Iran"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "The Foxtrot Network is an organized crime group operating across Europe that recruits vulnerable teenagers through social media to carry out violent attacks and murders for cash, employing a 'violence-as-a-service' (VaaS) model. The network has been linked to about 35 murders and multiple attacks on Israeli targets, including grenade attacks, with some operations believed directed by the Iranian regime. The network's leader, Rawa Majid, fled Sweden and Turkey, now operates out of Tehran under a deal with Iran to conduct attacks against regime enemies, including dissidents and Israelis. The group uses a 'gamified' recruitment and operational approach, guiding teenage hitmen like Johannes Natland and Atilla Azimov through missions via encrypted messaging and hidden weapon caches. Europol's OTF GRIMM taskforce involving 11 countries has made over 280 arrests disrupting Foxtrot and affiliated VaaS groups, but the method has rapidly spread to rival networks in northern Europe and the UK, sustaining the threat.",
  "summary_short": "The Foxtrot Network recruits teens via social media to conduct murders and attacks in Europe on behalf of criminal and Iranian regime interests using a gamified 'violence-as-a-service' model, posing a cross-border security threat.",
  "summary_extended": null,
  "actor_primary": "Foxtrot Network",
  "target_primary": null,
  "location_text": "Stockholm suburb, Huddersfield, Lund, Tehran",
  "location_region": null,
  "location_coordinates_lat": 59.3293,
  "location_coordinates_lon": 18.0686,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The signal documents a coordinated, transnational criminal-terror network using hybrid methods including proxy teenage assassins and ties to a foreign regime orchestrating attacks on political and ethnic targets in Europe, evidencing hostilities beyond conventional crime.",
  "event_time_utc": "2022-01-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-08-03T13:21:01.080Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Jan 1, 2022, 00:00 UTC

Event time confidence

pm24h

Location

Stockholm suburb, Huddersfield, Lund, Tehran

Primary actor

Foxtrot Network

Country

Sweden

Countries

Sweden, United Kingdom, Iran

Tags

Foxtrot Network, Violence-as-a-Service, Iranian regime, teenage hitmen, Europol OTF GRIMM, Rawa Majid, Johannes Natland, Atilla Azimov, Ali Shehad Ahmed, cross-border organized crime, gamified recruitment, Iran, Sweden, United Kingdom

Loading signal...

{ "id": "f83fa86c-7491-481a-9a82-60edd17dc822", "url": "https://bbc.co.uk/news/articles/czrjyevmv61o", "source": "extension", "status": "approved", "category": "Terrorism & Criminal Proxy Tactics", "subcategory": "Terrorism", "incident_type": "Unknown", "country": "Sweden", "source_reliability": "C", "info_credibility": "3", "tags": [ "Foxtrot Network", "Violence-as-a-Service", "Iranian regime", "teenage hitmen", "Europol OTF GRIMM", "Rawa Majid", "Johannes Natland", "Atilla Azimov", "Ali Shehad Ahmed", "cross-border organized crime", "gamified recruitment", "Iran", "Sweden", "United Kingdom" ], "nodes": [], "countries": [ "Sweden", "United Kingdom", "Iran" ], "where_text": "Land", "headline": null, "description": "The Foxtrot Network is an organized crime group operating across Europe that recruits vulnerable teenagers through social media to carry out violent attacks and murders for cash, employing a 'violence-as-a-service' (VaaS) model. The network has been linked to about 35 murders and multiple attacks on Israeli targets, including grenade attacks, with some operations believed directed by the Iranian regime. The network's leader, Rawa Majid, fled Sweden and Turkey, now operates out of Tehran under a deal with Iran to conduct attacks against regime enemies, including dissidents and Israelis. The group uses a 'gamified' recruitment and operational approach, guiding teenage hitmen like Johannes Natland and Atilla Azimov through missions via encrypted messaging and hidden weapon caches. Europol's OTF GRIMM taskforce involving 11 countries has made over 280 arrests disrupting Foxtrot and affiliated VaaS groups, but the method has rapidly spread to rival networks in northern Europe and the UK, sustaining the threat.", "summary_short": "The Foxtrot Network recruits teens via social media to conduct murders and attacks in Europe on behalf of criminal and Iranian regime interests using a gamified 'violence-as-a-service' model, posing a cross-border security threat.", "summary_extended": null, "actor_primary": "Foxtrot Network", "target_primary": null, "location_text": "Stockholm suburb, Huddersfield, Lund, Tehran", "location_region": null, "location_coordinates_lat": 59.3293, "location_coordinates_lon": 18.0686, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The signal documents a coordinated, transnational criminal-terror network using hybrid methods including proxy teenage assassins and ties to a foreign regime orchestrating attacks on political and ethnic targets in Europe, evidencing hostilities beyond conventional crime.", "event_time_utc": "2022-01-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-08-03T13:21:01.080Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }