In a Stockholm suburb a man dressed in black appeared out of the winter night. Carrying a handgun, he approached 20-year-old Murad Abdelkader, a student on his way back from a shift at McDonald's.

The gunman opened fire, shooting again and again as he approached his target. He fired the last shot into his victim's head as he lay helpless on the ground.

The killer was 18-year-old Atilla Azimov. On that February night last year, he had killed the wrong man.

He had done it for money - hired by the Foxtrot Network, an organised crime group with links to the Iranian regime which has become notorious for its violence-as-a-service (VaaS) tactics.

Since 2022, the Foxtrot Network is thought to have been responsible for about 35 murders as well as a number of attacks and attempted attacks on Israeli targets in Europe including two involving explosives and hand grenades.

The gang recruits teenagers to carry out the attacks for cash, but it almost never has to pay out as they often get caught.

Like Johannes Natland, a Norwegian teenager who was convicted of conspiracy to murder by a jury at the Old Bailey in London on Wednesday for a planned killing in West Yorkshire.

According to Operational Taskforce (OTF) GRIMM, the Europol group set up to tackle the problem, the teenage hitmen are recruited on social media, and are given their instructions in a "gamified" way, imitating how computer games work.

Andy Kraag, the head of Europol's European Serious and Organised Crime Centre, calls it the "calculated outsourcing of murder" to vulnerable young people.

OTF GRIMM currently involves 11 countries affected by the VaaS phenomenon - Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden, and the United Kingdom.

The leader of the Foxtrot Network, Rawa Majid, has fled Sweden and his later operating base in Turkey, and is now based in the Iranian capital Tehran. Police believe some of the VaaS attacks have been carried out for the Iranian regime, including a hand grenade attack on the Israeli embassy in Copenhagen, though other attacks are part of Foxtrot's drugs turf wars.

Diamant Salihu, an investigative journalist for the Swedish broadcaster SVT, has been researching Foxtrot and its Iranian links for three years.

"The regime is ordering the leader of the Foxtrot Network to instigate his network to commit attacks against the Iranian regime's enemies," he said.

"It can be dissidents, journalists that are in the opposition against the regime, and it can also be Israeli targets."

The links to the Iranian regime started after October 2023 when Majid fled to Tehran, Salihu said.

"He had to make a deal to be able to live freely in Iran, under condition that he and his network work for the regime."

The Foxtrot Network and Majid were sanctioned by the UK government in April 2025.

That was the month after the arrest of Natland, who was 18 at the time. He had flown in to carry out a hit on behalf of Foxtrot somewhere near Huddersfield.

The Natland case illustrates how the VaaS system works.

Natland is the son of two journalists in Stavanger and had a comfortable upbringing, but he drifted into drugs and developed psychosis, ending up spending time in rehab and a short period in a children's home. There he met another teenager who used the online handle UnknownHustler.

It was UnknownHustler who first sent Natland the online request for someone to carry out a hit in the UK - "Killing in England 270k" (270,000 Norwegian kroner is about £21,000). It had come from another teenager with the handle Generalen. Generalen - who was 16 at the time and had spent the last three years living in a children's home - subsequently recruited Natland for the hit.

Natland was then passed on to a Foxtrot member with the online username Agent 47, which is borrowed from the Hitman game franchise. Swedish police have accused Ali Shehad Ahmed, who is close to the Foxtrot leader Majid, of being Agent 47.

Agent 47 booked Natland's one way ticket to Manchester Airport, and helped him through the process of getting an emergency passport. Using the messaging app Signal, he guided Natland at every stage of his journey before handing him on to a logistics man with the username "1".

Treating Natland a bit like a character in a computer game, "1" sent him a map and videos showing him where to find the guns hidden in woodland in Huddersfield, and then another video showing him how to access a stash of cash hidden in the undergrowth near a foot tunnel.

Once Natland was installed in his Huddersfield hotel with the weapons, Agent 47 messaged him again: "We have much to do tomorrow."

Natland was arrested the next morning. He had not yet been told who he was to kill, and counterterrorism detectives are still trying to work out whether it was to be a criminal hit or a political one carried out for Iran.

The teenager who recruited Natland - Generalen - was prolific. As well as hiring Natland as a hitman he had also recruited at least two people who carried out murders in Sweden. They were Azimov, who is serving a life sentence for killing the wrong man, and a 17-year-old who shot dead Ahmed Zamzam in Lund, south Sweden, three and a half weeks earlier.

Neither of the killers got paid, because they were both caught. Salihu said this was part of how Foxtrot worked.

"They don't care at all if the teenagers get caught. Because when they get caught, they cannot ask for money that they have been offered, and we see no examples of money being paid to these young killers," he said.

"It has been a deliberate policy to recruit younger and younger teenagers because they don't think about the consequences of getting caught, and they are more willing to take the risks."

Generalen was eventually stopped because he was trying to arrange the murder of the 14-year-old son of a Norwegian police officer. He recruited a 15-year-old and a 17-year-old to carry out the knife attack, but the 15-year-old told the police. When Generalen was arrested detectives found details of the Huddersfield murder plot on his phone that led to British police arresting Natland just in time.

Generalen was convicted in May and is serving a 14-year-prison sentence.

OTF GRIMM has had some successes in the 15 months since it was set up. Police have made more than 280 arrests including a few key suspects.

One of the most important arrests was that of Ahmed, who is thought to be Agent 47.

He was detained in the Kurdish city of Sulaymaniyah in Iraq, and is currently subject to an extradition request to Sweden.

The Swedish deputy national police commissioner Stefan Hector said they were "constantly expanding our co-operation with other countries" and showing organised criminals "they cannot feel safe anywhere in the world".

In May, Mohamed "Moewgli" Mohdhi, a former rapper described by Swedish police as a "central actor" in Foxtrot, was arrested in Tunisia.

But Majid himself remains out of reach in Iran.

"He's still active," Salihu said. "And as long as this network is active we will still continue, I fear, to see attacks on the enemies of the Iranian regime."

It is not yet clear the extent to which the arrests have degraded Foxtrot's ability to operate, but other groups - including Foxtrot's rivals the Dalen Network - have already adopted the VaaS method of recruiting vulnerable teenagers for murders, so the danger is still very present.

It spread quickly from Sweden across Scandinavia and northern Europe and, as the Natland case shows, reached the UK last year. (BBC)

Update news