Foxtrot and the Islamic Republic: Converting Criminal Networks into Tools of Deadly Operations

A Norwegian teenager attempted to carry out a contract killing in Britain for €25,000, entering the execution phase with two firearms and ammunition, only to be arrested before the murder could occur. The court convicted him of conspiracy to commit murder. This case once again highlights concerns about the use of criminal networks and hired operatives in operations linked to the Islamic Republic—a pattern that can delegate violence to individuals willing to take a life for money.

“Johannes Kongshøy Natelund,” a 19-year-old Norwegian citizen and former football player, was convicted of conspiracy to commit murder following a retrial at the Old Bailey in London. According to court reports, he had agreed in March 2025 to kill an individual in Britain in exchange for €25,000—an individual whose identity has not been disclosed to the public.

This case is not merely the story of a young man drawn into a criminal plot for money. More troublingly, it involves a transnational network that, according to court proceedings and British authorities’ reports, played a role in recruiting young individuals to carry out violence and is believed to be connected to the Iranian government.

Natelund entered Britain on March 17, 2025, and after arriving in Manchester, traveled to Huddersfield in West Yorkshire. According to evidence presented at trial, he was directed to a location where weapons were stored and gained access to two firearms, ammunition, and approximately two thousand pounds in cash.

British armed police arrested Natelund on March 19, just two days after he entered the country, at a hotel. The weapons and ammunition discovered, along with phone messages and other evidence presented at court, formed part of the case against him.

Natelund claimed he did not intend to carry out the killing and even said he had considered shooting himself in the foot to escape the mission. However, the jury, following the retrial, rejected his defense and found him guilty of conspiracy to commit murder.

According to published reports, sentencing was scheduled for Friday, October 16, 2024 (Mehr 24 on the Persian calendar).

According to court reports, Natelund was recruited through the Swedish criminal network “Foxtrot.” In this scheme, an individual using the alias “General” played a role in his recruitment, while an English-speaking person using the alias “Officer 47” coordinated operations. At the time reports were published, the true identity of the person known as “Officer 47” had not been definitively established.

The case demonstrates that recruitment, coordination, payment, and weapon transfer occurred through a chain of intermediaries—a method that can increase the distance between those who organize operations and those who execute them, making it difficult to identify the original commanders.

Concerns about the use of teenagers and young people in violent crimes are also serious. Reports about the Foxtrot network indicate that the group employs very young individuals for criminal activities, including drug trafficking and violence. In this very case, a teenager who played a role in recruiting Natelund had previously been convicted in Norway.

In such a pattern, the operative may be drawn in by promises of money, notoriety, or threats, while the original planners remain hidden behind aliases and a network of intermediaries. The result can be operations that endanger victims whose very identities remain unclear to the public.

British authorities and prosecutors in the case have linked the Foxtrot network to criminal activities associated with the Islamic Republic. The British government has also sanctioned this network. According to official reports, the group has been linked to carrying out activities on behalf of the Iranian government, including violent acts against Jewish and Israeli targets in Europe.

This connection raises an issue beyond typical organized crime: the possibility that a government exploits criminal networks to execute operations beyond its borders without its official agents directly present at the scene.

For journalistic accuracy, however, a distinction must be made between Natelund’s definitive conviction and attributions of the Foxtrot network’s connections to the Islamic Republic. Natelund’s conviction in British court is established; however, the precise extent of the role of specific officials or institutions of the Islamic Republic in orchestrating this plot should be stated based on evidence and official findings, not merely on reported connections between the network and the Iranian government.

If a government exploits criminal networks to threaten, intimidate, or eliminate opponents and targets, we face a pattern that not only endangers the lives of intended victims but also threatens the public security of host nations. Using criminal intermediaries does not eliminate the potential responsibility of commanders but rather increases the necessity for investigation into the chain of command and sources of funding.

The Natelund case does not exist in isolation. In recent years, British security authorities have warned about alleged Iranian efforts to employ proxy agents and criminal networks. Britain’s Counter Terrorism Police have stated that since 2025, they have disrupted or stopped several schemes linked to Iran involving threats, kidnapping, and violent conspiracies.

In April 2026, British broadcaster LBC reported in an investigation that a journalist who had secretly been contacted through a Telegram account was offered payment by someone claiming to be connected to Iranian intelligence to carry out a sabotage operation in London. The journalist was asked to set fire to images of Donald Trump and Benjamin Netanyahu on one of London’s streets and send a video of it—an action that, according to the messages received, was meant to serve as a prelude to receiving subsequent assignments.

LBC stated it had provided the full conversations to Counter Terrorism Police. Of course, the mere claim that the Telegram account was connected to Iranian intelligence does not in itself prove the true identity of those operating it; however, such a report demonstrates how promises of money and seemingly small assignments can be used to gauge individuals’ willingness and draw them into more dangerous activities.

In the Natelund case, what was examined in court went far beyond a simple offer: international travel, weapon acquisition, cash payments, and coordination for murder. Placing this case alongside security warnings and investigative reports about recruitment through social media highlights the necessity of seriously examining methods of recruitment and deployment of proxy agents.

One of the most significant ambiguities of the case is who the intended murder victim was supposed to be. His identity is not clear in published information, and this very question raises concerns about the ultimate target of the operation and the possibility of similar schemes.

Despite Natelund’s conviction, investigations into other individuals connected to this case continue. Identifying those who provided money, weapons, and instructions could be important for clarifying the actual scope of the network and preventing repetition of such schemes.

This case serves as a serious warning about the danger of criminal networks being converted into instruments of transnational violent operations. If a criminal network’s connection to a government is documentarily established, accountability must not remain limited to an operative arrested at the final link in the chain. Justice requires identifying and pursuing all those who played a role in designing, financing, and directing such operations. Until the identity of the target and the full role of the organizers are clarified, the Natelund case represents not merely the thwarting of a failed murder plot, but a reminder of the danger posed by networks that, for money and relying on hidden intermediaries, can bring violence to the streets of Europe.