Iran's affordable terror-for-hire network built to outlast the war

When teenager Atilla Azimov murdered a man in Stockholm in February, he did not know he was carrying out the killing in support of Iran. He had done it for a few hundred dollars, offered by a group tied to Iran’s Islamic Revolutionary Guard Corps.

His victim, 20-year-old Murad Abdelkader, turned out to be the wrong man, and Azimov is serving a life sentence in prison. Still, analysts and security experts argue that the incident, and others like it, reveal the true intentions behind Iran’s terrorist proxy networks in Europe.

The Stockholm murder was carried out in part by the Foxtrot Network, a Swedish organized crime syndicate that evolved from a major drug trafficking operation into a terrorist proxy for Iran.

Foxtrot and similar groups focus on symbolic targets — public opponents of Tehran, critical journalists — rather than major security sites.

“They understand that if they do something like hit an FBI building or something like that, there’s going to be a cost for that. … They don’t want to create a situation where we feel we have to hit them hard again,” said Matthew Levitt, director of the Jeanette and Eli Reinhard Program on Counterterrorism and Intelligence at the Washington Institute for Near East Policy.

“When they try and kill an Iranian dissident, when they try and kill someone who’s too pro-Israel, from their perspective, that’s defending the revolution,” he said in an interview with NewsNGR.

It starts in Iran. Analysts say Tehran identifies individuals in Europe, often criminals fleeing justice, who are offered refuge in Iran.

The regime’s protection comes with a price.

Those targeted are asked to use their connections to facilitate smuggling or terrorist operations.

In one example, a former member of the German Hells Angels, Ramin Yektaparast, fled to Iran in 2021 to avoid conviction in his home country. Law enforcement and intelligence agencies in Europe now say they believe Yektaparast helped the IRGC orchestrate a terrorist attack against a synagogue in Germany the following year.

Rawa Majid, Foxtrot’s ringleader, followed a similar path. He fled Sweden for Turkey years earlier, before relocating to Iran, where he was recruited by Iranian intelligence.

Since 2022, the network he leads has been linked to roughly 35 murders and a string of attacks and attempted attacks on pro-Israel and Jewish targets across Europe, according to police and open-source reporting.

Once that relationship is set, the fugitive taps both his existing network and IRGC funding. In Foxtrot’s case, operators in Scandinavia have publicized contract hit jobs via Telegram, often targeting disaffected, troubled teenagers with promises of payment for easy work.

After a job is accepted, another operator — who may or may not be ideologically motivated — provides further details on the operation, supplies equipment and, eventually, payment.

Whether the operation succeeds in neutralizing a dissident voice often does not matter, experts say. The attacks themselves have a delegitimizing effect on Western governments, as citizens grow fearful that IRGC-linked agents could strike at any time.

“When you have a string of these in a row, it feels ubiquitous. … It leaves citizens and populations thinking that their governments are unable to control what’s happening,” said Colin Clarke, executive director of the Soufan Center. “It also has to be disturbing for Western intelligence services to realize that the Iranians can reach out to individuals on Western soil without these agencies knowing about it.”

Although these attacks are relatively low-stakes compared with the operations of better-funded Iran-backed groups such as Hezbollah or the Houthis, the European proxy networks are an essential piece of Iran’s broader campaign and could prove useful even after the Iran war ends.

Because these organizations survive on drug smuggling and arms trafficking, Iran would not need to rebuild the apparatus once peace returns to the Middle East.

“Networks are still there,” said Moustafa Ayad, executive director for Africa, the Middle East and Asia at the Institute for Strategic Dialogue. “The ability to have linkages into those networks is key for state and non-state actors, if there’s an ideological bent involved in which they want to cause harm.”