The arrest of a 19-year-old Norwegian in a hotel room in northern England has cast fresh light on a growing security concern across Europe: the convergence of organized crime, proxy warfare, and international terrorism. According to an assessment by The Soufan Center, the case illustrates how Iran-linked networks are increasingly relying on criminal groups and unaffiliated individuals to conduct operations far removed from traditional state-sponsored attacks.
On March 19, British authorities arrested Norwegian national Johannes Natland in West Yorkshire on allegations that he was preparing to assassinate a target in the United Kingdom. Investigators said Natland had been recruited by the Swedish criminal organization known as Foxtrot and had allegedly agreed to carry out a murder-for-hire operation in exchange for more than $28,000.
While authorities have not publicly identified the intended target, prosecutors outlined evidence that included communications between Natland and a Foxtrot operative known as “Agent 47,” discussions about payment, and plans involving firearms and ammunition. The case quickly drew attention not only because of the alleged assassination plot itself, but because of the organization behind it.
Foxtrot, once known primarily as a Swedish criminal syndicate involved in gang violence, drug trafficking, and arms smuggling, has increasingly been linked to operations targeting Israeli, Jewish, and Western interests across Europe. The Soufan Center’s assessment argues that the group has become part of a broader trend in which Iran and Iran-aligned actors outsource attacks to local gangs, criminal networks, and individuals with little direct connection to geopolitical conflicts.
The tactic reflects an evolving security environment in which state-linked actors seek to create additional layers of separation between themselves and violent operations. By relying on intermediaries, investigators say, sponsors can complicate attribution, reduce direct exposure, and make it more difficult for intelligence agencies to identify the individuals ultimately responsible for planning attacks.
The Natland case also highlights another increasingly common feature of such operations: the recruitment of young people through online platforms. According to prosecutors cited in the assessment, Foxtrot has a history of targeting teenagers and young adults, particularly individuals who may be socially isolated or vulnerable. Recruitment efforts have reportedly extended to social media platforms and online gaming communities, where potential operatives can be contacted with relative anonymity.
Analysts have suggested that the use of younger recruits offers practical advantages for criminal organizations. Younger perpetrators may attract less attention from authorities, while legal systems often treat juvenile offenders differently than adults. The practice has become a recurring feature of several investigations involving Foxtrot-linked operations across Europe.
The criminal network’s origins date back to 2010, when it emerged as a gang operating primarily in Sweden and neighboring countries. It was founded by Rawa Majid, an Iranian-born Kurdish-Swede who later became one of Sweden’s most wanted fugitives. After leaving Sweden in 2018, Majid reportedly spent time in Türkiye and Iraqi Kurdistan before relocating to Iran in 2023.
Over time, investigators say, Foxtrot’s activities evolved beyond traditional organized crime. Intelligence assessments cited by The Soufan Center indicate that the group established links with Iran’s Ministry of Intelligence and Security and increasingly aligned itself with Tehran’s efforts to target perceived adversaries in Europe.
Several incidents over the past two years have drawn scrutiny to those alleged connections. In January 2024, authorities disrupted a plot involving explosives placed at the entrance of the Israeli Embassy in Stockholm before they could detonate. Later that year, two Danish teenagers launched hand grenades at the Israeli Embassy in Copenhagen, although the explosives struck a nearby residential terrace instead. Investigators said the youths had coordinated with Foxtrot and were motivated primarily by financial reward rather than political ideology.
Another incident occurred on March 8, 2026, when an improvised explosive device damaged the entrance of the U.S. Embassy in Oslo. No casualties were reported, and the investigation remains ongoing. While authorities have not publicly assigned responsibility, limited evidence cited in the assessment has pointed toward possible Foxtrot involvement.
The growing number of allegations linking the syndicate to Iran-backed activities has prompted responses from Western governments. In March 2025, the United States imposed sanctions on both Foxtrot and Majid. U.S. officials cited the group’s alignment with Iranian objectives and Majid’s reported contacts with Iranian political leadership. The United Kingdom followed with its own sanctions package in April 2026 amid what authorities described as a rise in Iran-linked plots on British soil.
The Soufan Center’s assessment places Foxtrot within a broader pattern of attacks and planned operations linked to Iran and its regional allies. Unlike previous decades, when organizations such as Hezbollah frequently conducted operations through dedicated operatives and established networks, recent plots have increasingly relied on criminal intermediaries, freelance actors, and individuals recruited specifically for single missions.
Researchers have described this model as a form of “violence-as-a-service,” borrowing from the structure of modern gig-economy platforms. Under this approach, criminal groups and unaffiliated individuals can be contracted to conduct surveillance, transport weapons, carry out attacks, or recruit additional participants, often without sharing the ideological motivations of those directing the operation.
The assessment cites a series of incidents that authorities have investigated since tensions escalated between Iran, Israel, and the United States. These include attacks against Jewish institutions, places of worship, and diplomatic facilities in several European countries. Investigators have also examined alleged plots targeting communities in North America.
One case involved Mohammad Baqer Saad Dawood al-Saadi, a figure linked to the Iran-aligned Iraqi militia Kataib Hezbollah. U.S. authorities arrested al-Saadi in May after alleging that he directed plots against synagogues and Jewish sites in the United States, Canada, and Europe while outsourcing operations to criminal networks and individual actors. According to investigators, al-Saadi operated through a front organization known as Harakat Ashab al-Yamin al-Islamiya, or HAYI, which has been linked to attacks involving firebombs, improvised explosive devices, and acts of sabotage targeting civilian infrastructure across Europe.
In the United Kingdom, authorities have also reported arrests involving Iranian nationals accused of conducting surveillance on Jewish sites. Other investigations have examined incidents including arson attacks and assaults targeting members of Jewish communities.
Against this backdrop, security officials are increasingly focused on how state actors, organized crime groups, and proxy organizations are becoming interconnected. The boundaries separating terrorism, criminal enterprise, intelligence operations, and geopolitical conflict have become less distinct as networks adapt to changing operational pressures.
According to The Soufan Center, the rise of groups such as Foxtrot demonstrates how contemporary security threats increasingly rely on layered structures that combine criminal actors, proxy organizations, and locally recruited individuals. As investigations continue across multiple countries, authorities are confronting a threat environment in which responsibility can be obscured through a chain of intermediaries, making prevention, attribution, and prosecution significantly more complex.
