Iranian Intelligence Ordered a Hit in England, but Never Had to Send a Single Agent

There is a courtroom in London right now where the prosecution is trying to explain a problem that should worry you a great deal more than the defendant—even though what the crime committed couldn’t be more serious.

The defendant is Johannes Natland, a nineteen-year-old Norwegian. Police pulled him out of a hotel room in Huddersfield in March of last year with two firearms and ammunition he had no earthly reason to own. He had told friends back in Norway what he was going to England to do. The prosecutor at the Old Bailey put it plainly: Natland had agreed, in exchange for money, to travel to Britain and carry out a hit.

Hiring a hitman isn’t new, but this is a different kind of mercenary action. Natland did not wake up one morning hating a stranger in England. He answered what amounted to a gig, like DoorDash for executive action. The people who hired him were not Iranians. They were a Swedish drug-trafficking network. And the people who hired them — well, that’s where the British government’s tidy little prosecution runs into a wall that goes all the way back to Tehran.

Iran has stopped sending spies and started placing orders

For most of the history of statecraft, if a regime wanted someone dead in another country, it had to send its own people. Officers with training, with cover, with passports that — if anyone bothered to pull the thread — led home. That’s expensive, it’s slow, and it’s the single biggest reason intelligence services get caught: the trail has their fingerprints on it.

Iran appears to have solved that problem the way a tech company solves any labor problem. It outsourced.

The network that recruited Natland is called Foxtrot. It is, in its day job, the dominant narcotics distributor in Sweden, run by a fugitive named Rawa Majid who goes by “the Kurdish Fox.” And according to that same paperwork, Majid fled to Iran in September of 2023 and was promptly recruited by Iran’s Ministry of Intelligence. A drug lord became a contractor for a nation-state. The product line expanded from cocaine to violence-as-a-service.

They have an impressive track record already. Foxtrot orchestrated the attack on the Israeli embassy in Stockholm in January 2024. That October, Foxtrot-recruited teenagers threw hand grenades at the Israeli compound in Copenhagen — a Danish court handed two of them twelve-year terror sentences. By June 2025, the U.S. embassy in Sweden was openly warning American citizens that Iran might use Foxtrot to hit U.S. interests.

Making attribution that much harder

Count the layers between the regime and the body in that Huddersfield hotel.

The Iranian state places a request. A Swedish criminal network takes the contract. The network puts the job out to its recruitment pipeline. A nineteen-year-old Norwegian shows up with a gun. Four handoffs, and at every single one the chain of command gets murkier, the deniability gets thicker, and the forensic trail gets colder. Plus it crosses back and forth across criminal and counterintelligence lines, making investigation of the latter that much more difficult.

When this gets rolled up — and this one did — what do you have in custody? A teenager. A kid without a fully-formed prefrontal cortex. Not an officer. Not a diplomat you can expel. You have a kid who answered a message on his phone and probably couldn’t find Tehran on a map. The state that wanted the killing done is three layers away, insulated by exactly the kind of people the legal system was never built to trace upward.

This is the elegance of it, and I use that word the way you’d use it about a beautiful piece of malware. The system isn’t a bug. The disposability is the design. Who needs intelligence officers when you’ve got disaffected Minecraft players?

Recruiting the most vulnerable for the worst stuff imaginable

Here is the part that should make your stomach turn, and the part the algorithms would very much prefer I not say out loud, so I’ll say it here where I can.

Foxtrot doesn’t recruit hardened killers. It recruits children — and specifically the children nobody is guarding. The newly arrived immigrant families. The kids with autism. The ones with mental health struggles, the ones already on the margin, the ones who can be flattered and coached over social media into doing something they don’t fully understand. There’s a grim legal logic underneath it too: in Sweden, a child under fifteen can’t be held criminally responsible at all, and fifteen-to-eighteen usually means social services, not prison. So the network reaches for the people who are simultaneously the easiest to manipulate and the cheapest to lose.

A regime found a criminal network. The criminal network found a supply of disposable teenagers. And the connective tissue holding the whole arrangement together is a group chat. That’s the supply chain. And it works in many, many countries. If you’ve got children and internet, you’ve got a very big potential problem.

This is next generation proxy warfare

We’ve spent two decades talking about Iranian proxies as a Middle East phenomenon — Hezbollah, the Houthis, the militias in Iraq. Useful shorthand, but it lets people in London and Stockholm and, frankly, in American cities tell themselves this is somebody else’s neighborhood.

It isn’t. The same logic — find a local actor with its own motives, fund it, point it, and keep your own hands clean — works just as well when the local actor is a European drug gang and the target is a man in Yorkshire. The proxy doesn’t have to believe in anything. Foxtrot doesn’t care about Iran’s quarrels. It cares about money, and money is a language every regime speaks fluently.

To Treasury’s credit, somebody in Washington saw this clearly. OFAC designated Foxtrot and Majid in March 2025, naming them outright as a transnational criminal organization serving the Iranian regime. Worth being honest about the timeline, because I won’t pretend otherwise: Majid was recruited and the embassy attacks happened across 2023 and 2024, under the prior administration, and the formal designation landed early in the current one. The recognition of the threat has been a slower, more bipartisan, more cross-Atlantic affair than any one press release suggests. The machine was running for a while before anyone put a name on the paperwork.

Remember this story next time a politician tries to claim that Iran wasn’t a threat to the United States or our allies.

Whatever the Old Bailey decides about Johannes Natland, the verdict won’t touch the actual problem. Convict him, and Iran has lost a single interchangeable contractor it never met. The group chat is still open. The network still has Tehran’s number. And somewhere there is another kid, watched by no one, about to get a message that sounds like easy money.

That’s the thing about renting your violence instead of owning it. You never run out of inventory.

Keep thinking.

Eric Garland provides consulting through Competitive Futures, and keynote speaking through lovely agencies such as Executive Speakers.

First published on Game Theory Today (Substack), June 3, 2026.