Violence-as-a-Service: How Sweden’s Foxtrot Gang Uses Social Media to Recruit European Teenagers

Foxtrot first became known as one of Sweden's most violent criminal organisations, making its money through the drug trade while fighting bloody turf wars with rival gangs. Over time, however, its leadership found a safer and cheaper way to operate.

Instead of relying on trusted gang members, the organisation began treating violence like a service that could be contracted out. Recruiters searched for vulnerable teenagers online. Separate handlers arranged transport, hid weapons and passed on instructions. The person carrying out an attack often had no direct contact with those who planned it.

The result is a decentralised system that is much harder for investigators to dismantle. Arresting one participant rarely leads directly to the people making the decisions.

The technology involved is hardly sophisticated. Signal, Telegram, Discord and mainstream social media platforms provide enough tools to coordinate attacks across several countries without the organisers ever leaving home.

Teenagers at the Centre

What makes the model particularly effective is its reliance on young people.

Many recruits are not hardened criminals. They are teenagers struggling with addiction, isolation or unstable family situations. Others have spent time in children's homes or care institutions, making them easier targets for manipulation.

One of the most active recruiters, known online as "Generalen", had himself lived in a Norwegian children's home for three years. Investigators linked him to several plots across Scandinavia.

He recruited Atilla Azimov for the fatal shooting in Stockholm. He was also connected to the recruitment of a 17-year-old who killed Ahmed Zamzam in Lund and persuaded two other teenagers, aged 15 and 17, to attack the 14-year-old son of a Norwegian police officer.

That last operation never happened because the younger recruit contacted police instead. Generalen was later arrested and sentenced to 14 years in prison.

The pattern is difficult to ignore. Recruiters are often only a few years older than the people they target, making the relationship feel less like organised crime and more like an online peer network.

Ordered Online, Delivered Offline

The conviction of 19-year-old Norwegian Johannes Natland in London shows how these operations now work in practice.

Natland had developed drug problems and experienced psychosis before being drawn into online conversations with another teenager using the name UnknownHustler. Through that contact he was offered a contract to carry out a murder in England for 270,000 Norwegian kroner.

From there, almost everything happened remotely.

A senior Foxtrot operative using the alias Agent 47 arranged his one-way flight to Manchester and helped him secure an emergency passport. Once in Britain, another handler sent videos and maps showing where weapons had been buried in woodland near Huddersfield and where cash had been hidden close to a pedestrian tunnel.

Police arrested Natland in a hotel before he even learned who he had been sent to kill.

Perhaps that is the most striking feature of the operation. The person expected to commit the murder did not know the intended victim. The assignment was simply another task to complete, with instructions arriving one message at a time.

Disposable Recruits

Foxtrot's business model depends on a harsh calculation.

Investigators say the organisation rarely pays the teenagers it recruits.

Many are arrested before completing an attack or shortly afterwards. From the network's perspective, that is almost ideal. A failed recruit costs virtually nothing. Another teenager can always be found online.

The organisation avoids paying large sums while exposing only disposable intermediaries to criminal prosecution. Those sitting at the top remain insulated from both the crime scene and the financial risk.

For the recruits, the outcome is usually devastating. They face prison sentences that can last decades or even life, while the promised reward never arrives.

Murad Abdelkader's death also shows how dangerous this approach is for the wider public. Inexperienced teenagers make mistakes. Sometimes the wrong person dies.

Where Crime and State Interests Meet

The story becomes even more troubling because Foxtrot is no longer viewed solely as a criminal organisation.

After leaving Sweden under increasing legal pressure and internal disputes, its leader Rawa Majid eventually settled in Tehran following a period in Turkey.

According to Swedish investigators, Majid reached an arrangement with the Iranian authorities. In return for protection, Foxtrot agreed to use its network for attacks against Iranian dissidents, opposition journalists and Israeli interests in Europe. Investigators have linked this cooperation to, among other incidents, a grenade attack on the Israeli embassy in Copenhagen.

Britain sanctioned both Majid and the Foxtrot Network in April 2025.

For European security services, this changes the picture considerably. Criminal organisations have long worked across borders. What is newer is the possibility that hostile states can exploit those same networks instead of sending their own operatives.

The distinction between organised crime and national security is becoming increasingly blurred.

A Problem That Crosses Every Border

European law enforcement has adapted faster than it is often given credit for.

Europol created Operational Taskforce GRIMM, bringing together investigators from 11 countries, including Sweden, Germany, France, Spain, Norway, the Netherlands and the United Kingdom. In just 15 months, the taskforce carried out more than 280 arrests.

Among those detained were Ali Shehad Ahmed, identified as Agent 47 and arrested in Iraq while awaiting extradition to Sweden, and senior Foxtrot figure Mohamed "Moewgli" Mohdhi, arrested in Tunisia.

Yet the organisation's leader remains beyond Europe's reach.

As long as Rawa Majid continues to operate from Tehran, police can disrupt individual plots without removing the person investigators believe sits at the centre of the network.

That exposes a broader weakness. Police cooperation inside Europe has become much stronger, but extradition, jurisdiction and international politics still leave major gaps whenever criminal leaders find refuge outside European legal systems.

More Than a Law Enforcement Challenge

European governments are increasingly treating teenage recruitment as something that cannot be solved through arrests alone.

The EU's roadmap against drug trafficking and its planned Action Plan on protecting children from crime seek to strengthen legal protections, make the recruitment of minors an aggravating offence and place greater responsibility on online platforms through the Digital Services Act.

Several countries are also experimenting with prevention programmes. Ireland's Greentown Project focuses on breaking young people's ties to criminal groups through community and family intervention. Sweden combines police officers with social workers in high-risk neighbourhoods, while Italy's Free to Choose initiative offers young people practical routes out of organised crime.

Those efforts recognise a difficult reality.

The teenager arrested with a gun is often the final link in a much longer chain. Recruitment may begin months earlier in an online chat, continue through encrypted messaging apps and end with directions to a buried weapon sent by someone whose real name they never learn.

That is why the Foxtrot investigations matter beyond Sweden. They reveal a model in which organised crime has borrowed the speed, flexibility and anonymity of the digital economy, while hostile state interests have found an existing network capable of operating inside European borders without ever needing to build one themselves.

Europe Is Trying to Catch Up

The scale of the response shows that European authorities understand the threat is no longer confined to a handful of gang conflicts in Sweden.

Europol created Operational Taskforce GRIMM to coordinate investigations across 11 countries: Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Spain, Sweden and the United Kingdom. In its first 15 months, the taskforce recorded more than 280 arrests linked to the growing Violence-as-a-Service model.

Some of the network's most important figures have already been detained.

Ali Shehad Ahmed, identified by Swedish investigators as the Foxtrot operative known as Agent 47, was arrested in Sulaymaniyah, Iraq, and is awaiting extradition to Sweden. Another senior member of the organisation, Mohamed "Moewgli" Mohdhi, was arrested in Tunisia in May 2026.

The arrests disrupted parts of the network, but they also exposed its resilience. Removing individual coordinators does not necessarily stop the system. New recruiters can appear online within days, while handlers continue directing operations from different jurisdictions.

The biggest obstacle remains the organisation's leadership.

Rawa Majid continues to live in Tehran, beyond the reach of European investigators. As long as he remains protected there, police can dismantle individual cells without removing the person they believe oversees the wider operation.

That creates a familiar dilemma for European security services. They can respond quickly to attacks inside Europe, yet they have far fewer options once those directing the violence are operating from countries where extradition is effectively impossible.

The Law Is Playing Catch-Up

Violence-as-a-Service has exposed weaknesses that go beyond policing.

Most European legal systems were designed to deal with criminal groups that had identifiable leaders, fixed territories and relatively clear chains of command. Foxtrot's model deliberately avoids all three.

Planning may take place in one country, recruitment in another, logistics in a third and the attack itself somewhere else entirely. Every participant knows only a small part of the operation. If one person is arrested, investigators often hit a dead end rather than uncovering the full network.

The growing use of minors makes prosecutions even more complicated.

Teenagers recruited online are often both offenders and victims. They may have travelled across borders carrying weapons and intending to commit murder, yet they have also been manipulated by adults who exploit their age, vulnerability and financial circumstances.

That legal ambiguity is forcing governments to rethink how organised crime involving children should be prosecuted.

Can Digital Platforms Be Held Responsible?

The investigations have also renewed questions about the role of technology companies.

Foxtrot did not build a sophisticated communications network of its own. Instead, recruiters used services already embedded in the daily lives of millions of young Europeans. Initial contact could begin on mainstream social media, continue through gaming communities such as Discord and eventually move onto encrypted messaging platforms like Signal.

Each stage of the process reduced the distance between recruiter and recruit without requiring a single face-to-face meeting.

European policymakers increasingly argue that preventing recruitment cannot depend solely on criminal investigations after an attack has already been planned.

The Digital Services Act is expected to play a larger role in that debate. Together with the EU Roadmap against drug trafficking and the planned Action Plan on protecting children from crime, it reflects a broader shift towards treating online recruitment for serious violence as more than a policing issue. The objective is to strengthen obligations on digital platforms, harmonise legal approaches across member states and make the recruitment of children for organised crime a more serious criminal offence.

Whether those measures can keep pace with networks that constantly adapt remains an open question.

Breaking the Recruitment Pipeline

Several countries have concluded that arrests alone will never be enough.

Ireland's Greentown Project focuses on reducing children's exposure to criminal networks by working with families, local communities and law enforcement before organised groups establish lasting influence.

Sweden has expanded cooperation between police officers and social workers in neighbourhoods and schools considered most vulnerable to gang recruitment. Italy's Free to Choose programme offers young people practical and legal opportunities to leave organised crime behind before they become permanently tied to it.

These initiatives differ in design, but they are based on the same assumption: stopping recruitment is often more effective than responding after a teenager has already accepted a contract.

The Foxtrot investigations suggest why that matters.

By the time police recover a hidden weapon or arrest a suspect in a hotel room, the recruitment process has usually been underway for weeks or months. Relationships have already been built online. Trust has already been established. The recruit may never have met a single organiser in person, yet the instructions feel routine enough to follow without question.

That may be the most significant change revealed by the investigations. Europe's security challenge is no longer defined only by gangs controlling neighbourhoods or drug routes. It is increasingly shaped by networks that exist primarily online, cross borders effortlessly and recruit young people faster than national institutions can identify them.