The suspect, identified by Swedish media as Mohamed “Moewgli” Mohdhi, in his 30s, is alleged to be a significant figure within the Iranian-backed Foxtrot network, one of Sweden’s most powerful and violent criminal organisations.
Swedish authorities say he is closely linked to the group’s leadership and is wanted in connection with serious violent crimes, including alleged involvement in murder. His arrest is seen as a key development in efforts to dismantle the network’s international operations.
The operation was carried out by Tunisian authorities in close co-operation with Swedish law enforcement, with support from European partners, highlighting the increasingly global nature of organised crime investigations.
Officials stressed that modern criminal networks operate across borders, often using digital platforms and encrypted communication tools to co-ordinate activities from multiple countries.
The Foxtrot network emerged in the late 2010s and has since become one of the central actors in the country’s gang landscape. It is heavily involved in large-scale drug trafficking, weapons offences, extortion and targeted violence.
The group is led by Rawa Majid, who is internationally wanted and believed to direct parts of the network from abroad. Over time, Foxtrot has evolved into a decentralised structure, relying on flexible cells and external collaborators rather than a rigid hierarchy.
European law enforcement agencies, including Europol, have increasingly linked networks such as Foxtrot to a broader criminal model known as “violence-as-a-service” (VaaS). This system involves the outsourcing of violent acts to individuals recruited online and paid to carry out specific tasks such as intimidation, assaults, or killings.
Europol has warned that the model represents a major shift in organised crime, as it lowers the barrier to committing serious violence and allows criminal leaders to remain physically removed from the acts themselves.
Europol, through its co-ordination role and operational support, helps connect national investigations, analyse cross-border criminal patterns and facilitate intelligence sharing between European Union member states and international partners.
In cases involving networks such as Foxtrot, Europol supports joint investigation teams, identifies links between suspects across jurisdictions and helps map the digital infrastructure used for recruitment and co-ordination.
The recruitment process behind violence-as-a-service is typically structured into four roles: The instigator orders and finances the crime, often from abroad; the recruiter uses encrypted messaging apps, social media, or gaming platforms to identify and contact potential offenders; the enabler provides logistical and financial support, including weapons, transport and communication tools; and the perpetrator is usually a young and inexperienced individual who carries out the act, often without any previous ties to organised crime.
Authorities say young people are deliberately targeted through online spaces using coded language, memes and gamified tasks that create a false sense of reward, status, or belonging. In reality, they are drawn into serious criminal activity with severe legal consequences and long-term personal impact.
To respond to this growing threat, European law enforcement agencies have established Operational Taskforce (OTF) GRIMM, co-ordinated by the European Serious and Organised Crime Centre (ESOCC).
Launched in April 2025, the taskforce brings together authorities from 11 countries, including Sweden, France, Germany, Belgium, Denmark, the Netherlands, Norway, Spain, Iceland, Finland and the UK, with Europol playing a central co-ordination role.
OTF GRIMM focuses on disrupting violence-as-a-service networks by strengthening intelligence sharing, co-ordinating cross-border investigations and mapping recruitment and monetisation structures used by criminal groups. It also works alongside technology companies to detect and prevent online recruitment activities targeting vulnerable users.
According to investigators, the arrest in Tunisia represents a significant blow to the Foxtrot network and illustrates how co-ordinated European action, supported by Europol, is becoming increasingly essential in tackling modern, decentralised criminal organisations that operate across continents and through digital platforms.
