Norway 2026
16/01/2026: The Oslo District Court sentenced Arfan Bhatti to 30 years in prison for complicity in the Oslo shootings on June 25, 2022 and attempting to plan several other terrorst attacks. The trial started on September 2, 2025. Bhatti pleaded not guilty and claimed that he sympathized with the Talibans not IS. However this statement was contradicted by messages he previously sent proclaiming his allegiance to IS instead. He also denied addressing "extreme topics" with Zaniar Matapour, the terrorist who was already sentenced to 30 years in prison back in March 2024 for committing the mass shooting. Bhatti has appealed the decision so the verdict and the conclusions of the trial are not final yet. (Source)
06/02/2026: Norwegian PST delivered Norway’s 2026 National Threat Assessment that portrays, in compliance with the Government initiative to launch the first National Security Strategy in May 2025 to stand firm against "the most serious security situation since World War II" a comprehensive overview of threats from State actors and non-State actors, with particular emphasis on terrorism, extremism, and the convergence between ideological violence, organised crime, and hostile foreign intelligence activity, especially in Russia and Iran cases. It is now openly acknowledged and stated by Norwegian authorities that Iran resorts to Swedish criminal networks based in Norway as proxy actors to carry out disruptive activities or sabotage through terrorism. It has already been confirmed in Sweden, Denmark and Finland that Iran is using criminal gangs to carry out terrorist attacks. The Foxtrot network in Sweden serves the Islamic Republic of Iran for this purpose.
The overall terrorism threat level in Norway for 2026 is still assessed as "moderate", corresponding to level three on the national terrorism threat scale. Although this does not indicate an imminent attack, the assessment stresses that the threat landscape has become more complex, fragmented, and unpredictable. Lone actors, weak organizational structures, and overlapping motivations make early detection more difficult, especially when extremist violence intersects with criminal networks or proxy operations linked to foreign States.
Islamism is identified as one of the two most serious sources of terrorist threat to Norway alongside Far-Right terrorism. The assessment concludes that "there is an even chance that Islamist extremists will attempt to carry out terrorist attacks in Norway in 2026". This judgment is closely tied to the broader European context, where Islamist terrorist activity has been at its highest level in several years. The ongoing conflict in Gaza and wider instability in the Middle East are considered major drivers of radicalization, with Israeli military operations acting as a persistent catalyst for mobilisation and violence-oriented narratives across Europe. The report explains that the threat primarily originates from sympathisers of IS and Al-Qaeda rather than from centrally directed operations. These organizations currently prioritise inspiring individuals to act independently in Western countries, including Norway, through propaganda, operational guidance, and incitement disseminated online. Although Norway is not consistently singled out in global Jihadist propaganda, it is viewed as part of the broader Western enemy, and for domestically radicalized Islamists, Norway itself is considered a legitimate and primary target. The assessment underlines that Islamist networks in Norway are generally informal and loosely structured. There are no openly visible, coherent extremist organizations operating either physically or digitally, but a small number of individuals maintain connections to European and international Islamist networks. These links could be exploited to facilitate attacks, provide support, or connect potential attackers with resources and guidance. The absence of formal structures increases unpredictability and complicates preventive efforts.
Online radicalization is highlighted as a central concern, particularly among minors and young adults. Digital platforms function as the main arena for exposure to extremist content, social reinforcement, and operational learning. The report notes that radicalization is often intertwined with personal vulnerability, including mental health issues, social marginalization, or life crises, and that fascination with violence can precede ideological commitment rather than result from it. This dynamic significantly raises the risk posed by self-radicalized individuals acting alone. The assessment also points to emerging complexities, including the potential involvement of individuals sympathetic to Hamas in terrorist activity in Europe, as well as the possible use of proxy actors by Iran against Israeli and Jewish targets. These developments blur traditional distinctions between Jihadist terrorism, State-sponsored violence, and transnational repression, further complicating threat detection and attribution.
In conclusion, the document portrays Islamism as a persistent and adaptive threat to Norway in 2026. While the number of committed extremists remains limited, the combination of international crises, online radicalization, lone-actor dynamics, and external influence creates a sustained risk environment. The assessment emphasises that continued vigilance, intelligence cooperation, and early intervention are essential to mitigating the threat, even in the absence of clearly identifiable terrorist organisations operating on Norwegian soil. (Source)
26/02/2026: Norwegian PST announced that a 17-year-old boy was arrested in Rogaland and charged with violating section 131, third paragraph, of the Criminal Code by planning a terrorist attack on a NATO site at Jåttå in Stavanger in southwestern Norway. The supect was born and raised in Norway, but has allegedly been radicalized by Islamist narratives and expressed sympathy for IS. It is also mentionned that he has also been seen with an IS flag at his school. He pleaded not guilty during his interrogation. (Source)
02/03/2026: Following the airstrikes on the Islamic Republic of Iran carried out by Israel and the United States of America on February 28, 2026 that resulted in the elimination of Supreme Leader Ali Khamenei with risks of further escalation, Norwegian PST stated that they now expect Iranian security and intelligence services to retaliate by conducting intelligence and influence operations through local proxies in Norway throughout 2026. (Source)
08/03/2026: The Oslo Police District is conducting an investigation regarding an improvised explosive device that was detonated outside the American Embassy in Oslo at 1 am. No casualties resulted from the blast but there are currently no suspects. However, police forces believe there are one or more perpetrators. They are now being searched for with dogs, drones and a helicopter. PST reasserted that their current terrorist threat assessment is not impacted by this event and that they are cooperating with the Oslo Police District. Whether the incident is linked to the ongoing conflict in Iran or not, cannot be confirmed although it is implied by police statements that there may be a connection between the explosion at the US embassy in Oslo and the security situation in the world. (Source)
On March 11, 2026, police forces arrested three suspects who are Norwegian citizens from Iraqi origins with their mother and charged them with terrorism. Whether they acted following radicalization in the context of the war in Iran or for a criminal network such as Foxtrot with Iran as a potential State client, is still under investigation. (Source)
26/03/2026: Norwegian PST published their Threat assessment: Public Gatherings and Events in 2026, situating this analysis within the broader National Threat Assessment previously edited on February 6, 2026. It concludes that it is plausible that both Far-Right and Islamist extremists will attempt to carry out terrorist attacks during the year, with both milieus continuing to represent the primary sources of terrorist threat in Norway. These actors typically aim to maximize casualties and visibility, which makes public gatherings, events, and other crowded settings particularly attractive targets. The report identifies four principal categories of potential targets: organized events, religious holidays and commemorative dates, religious sites, and gatherings in confined or clearly delimited spaces. Drawing on data from Western countries between 2014 and 2025, it notes that 43 percent of all completed or foiled attacks by Far-Right and Islamist extremists were directed at such targets. Among these, gatherings in confined spaces such as transport hubs, educational institutions, nightlife venues, and shopping centers, were the most frequently targeted, accounting for 18% of attacks. Religious sites represented 12%, while organized events and religious or commemorative dates accounted for 8% and 5% respectively.
The analysis emphasizes that both extremist ideologies construct broad enemy images. Far-Right extremists typically target individuals and groups perceived as threats to “white culture”, including Muslims, Jews, minorities, political figures, LGBTQ+ individuals, and media actors, and are most likely to act alone, often through mass-casualty attacks or targeted assassinations. Islamists, by contrast, often regard all Western civilians as legitimate targets, which leads to a prevalence of indiscriminate attacks against civilians in public spaces. In both cases, Jewish and Israeli targets are highlighted as particularly at risk, especially in light of geopolitical developments since 2023 in the Gaza strip and escalating tensions involving Iran in 2026. The report further underlines that pre-announced events and gatherings present heightened vulnerability due to their predictability and concentration of people. Even when primary targets are secured, attackers may shift to alternative nearby targets, a phenomenon described as target displacement. Although attacks on events and holidays represent a smaller share of overall activity, past incidents in Norway, such as the 2011 Utøya attack and the 2022 Oslo Pride shooting, demonstrate that such scenarios remain plausible.
In addition to terrorism, the document highlights a significant intelligence threat posed by State actors, particularly Russia and China, with Iran also playing an active role. Events that bring together political, economic, or technological elites are considered especially attractive for espionage, influence operations, and surveillance. These activities may target dissidents, refugees, journalists, and academics, particularly those critical of foreign regimes. The report also notes instances of transnational repression, including intimidation of participants at conferences and monitoring of opposition figures. (Source)
27/03/2026: Considering the general development of the conflict in Iran and the attacks carried out in Europe, Norwegian PST reasserts that their terrorist threat assessment in Norway remains unchanged yet acknowledges that there is still an elevated threat to American, Israeli and Jewish targets. As such, PST has published an updated threat assessment regarding the blast at the US embassy in Oslo on March 8, 2026 which states that the probability that proxy actors could be used by Iranian services to carry out attacks in Norway has now been increased from "possible" to "probable". PST has previously assessed that the US embassy in Oslo is among the current targets for Iranian agents or proxies operating on Iran's behalf. (Source)