Norway 2026
16/01/2026: The Oslo District Court sentenced Arfan Bhatti to 30 years in prison for complicity in the Oslo shootings on June 25, 2022 and attempting to plan several other terrorst attacks. The trial started on September 2, 2025. Bhatti pleaded not guilty and claimed that he sympathized with the Talibans not IS. However this statement was contradicted by messages he previously sent proclaiming his allegiance to IS instead. He also denied addressing "extreme topics" with Zaniar Matapour, the terrorist who was already sentenced to 30 years in prison back in March 2024 for committing the mass shooting. Bhatti has appealed the decision so the verdict and the conclusions of the trial are not final yet. (Source)
06/02/2026: Norwegian PST delivered Norway’s 2026 National Threat Assessment that portrays, in compliance with the Government initiative to launch the first National Security Strategy in May 2025 to stand firm against "the most serious security situation since World War II" a comprehensive overview of threats from State actors and non-State actors, with particular emphasis on terrorism, extremism, and the convergence between ideological violence, organised crime, and hostile foreign intelligence activity, especially in Russia and Iran cases. It is now openly acknowledged and stated by Norwegian authorities that Iran resorts to Swedish criminal networks based in Norway as proxy actors to carry out disruptive activities or sabotage through terrorism. It has already been confirmed in Sweden, Denmark and Finland that Iran is using criminal gangs to carry out terrorist attacks. The Foxtrot network in Sweden serves the Islamic Republic of Iran for this purpose.
The overall terrorism threat level in Norway for 2026 is still assessed as "moderate", corresponding to level three on the national terrorism threat scale. Although this does not indicate an imminent attack, the assessment stresses that the threat landscape has become more complex, fragmented, and unpredictable. Lone actors, weak organizational structures, and overlapping motivations make early detection more difficult, especially when extremist violence intersects with criminal networks or proxy operations linked to foreign States.
Islamism is identified as one of the two most serious sources of terrorist threat to Norway alongside Far-Right terrorism. The assessment concludes that "there is an even chance that Islamist extremists will attempt to carry out terrorist attacks in Norway in 2026". This judgment is closely tied to the broader European context, where Islamist terrorist activity has been at its highest level in several years. The ongoing conflict in Gaza and wider instability in the Middle East are considered major drivers of radicalization, with Israeli military operations acting as a persistent catalyst for mobilisation and violence-oriented narratives across Europe. The report explains that the threat primarily originates from sympathisers of IS and Al-Qaeda rather than from centrally directed operations. These organizations currently prioritise inspiring individuals to act independently in Western countries, including Norway, through propaganda, operational guidance, and incitement disseminated online. Although Norway is not consistently singled out in global Jihadist propaganda, it is viewed as part of the broader Western enemy, and for domestically radicalized Islamists, Norway itself is considered a legitimate and primary target. The assessment underlines that Islamist networks in Norway are generally informal and loosely structured. There are no openly visible, coherent extremist organizations operating either physically or digitally, but a small number of individuals maintain connections to European and international Islamist networks. These links could be exploited to facilitate attacks, provide support, or connect potential attackers with resources and guidance. The absence of formal structures increases unpredictability and complicates preventive efforts.
Online radicalization is highlighted as a central concern, particularly among minors and young adults. Digital platforms function as the main arena for exposure to extremist content, social reinforcement, and operational learning. The report notes that radicalization is often intertwined with personal vulnerability, including mental health issues, social marginalization, or life crises, and that fascination with violence can precede ideological commitment rather than result from it. This dynamic significantly raises the risk posed by self-radicalized individuals acting alone. The assessment also points to emerging complexities, including the potential involvement of individuals sympathetic to Hamas in terrorist activity in Europe, as well as the possible use of proxy actors by Iran against Israeli and Jewish targets. These developments blur traditional distinctions between Jihadist terrorism, State-sponsored violence, and transnational repression, further complicating threat detection and attribution.
In conclusion, the document portrays Islamism as a persistent and adaptive threat to Norway in 2026. While the number of committed extremists remains limited, the combination of international crises, online radicalization, lone-actor dynamics, and external influence creates a sustained risk environment. The assessment emphasises that continued vigilance, intelligence cooperation, and early intervention are essential to mitigating the threat, even in the absence of clearly identifiable terrorist organisations operating on Norwegian soil. (Source)
26/02/2026: Norwegian PST announced that a 17-year-old boy was arrested in Rogaland and charged with violating section 131, third paragraph, of the Criminal Code by planning a terrorist attack on a NATO site at Jåttå in Stavanger in southwestern Norway. He allegedly planned to attack the NATO base using explosives and to stab a soldier at a military base. It is not known whether this was the NATO base at Jåttå.The supect was born and raised in Norway, but has allegedly been radicalized by Islamist narratives and expressed sympathy for IS. According to the local Muslim community, the boy did not display any sign of radicalization. It is also mentionned that he has also been seen with an IS flag at his school. He pleaded not guilty during his interrogation. (Source)
02/03/2026: Following the airstrikes on the Islamic Republic of Iran carried out by Israel and the United States of America on February 28, 2026 that resulted in the elimination of Supreme Leader Ali Khamenei with risks of further escalation, Norwegian PST stated that they now expect Iranian security and intelligence services to retaliate by conducting intelligence and influence operations through local proxies in Norway throughout 2026. (Source)
08/03/2026: The Oslo Police District is conducting an investigation regarding an improvised explosive device that was detonated outside the American Embassy in Oslo at 1 am. No casualties resulted from the blast but there are currently no suspects. However, police forces believe there are one or more perpetrators. They are now being searched for with dogs, drones and a helicopter. PST reasserted that their current terrorist threat assessment is not impacted by this event and that they are cooperating with the Oslo Police District. Whether the incident is linked to the ongoing conflict in Iran or not, cannot be confirmed although it is implied by police statements that there may be a connection between the explosion at the US embassy in Oslo and the security situation in the world. (Source)
On March 11, 2026, police forces arrested three suspects who are Norwegian citizens from Iraqi origins with their mother and charged them with terrorism. Whether they acted following radicalization in the context of the war in Iran or for a criminal network such as Foxtrot with Iran as a potential State client, is still under investigation. (Source)
21/03/2026: PST published the 2026 Threat Assessment for Pride and other LGBT+ Events. The report concludes that there are currently no indications of planned violent attacks against such events, although the overall terrorism threat level in Norway remains "moderate". The primary sources of potential terrorism are identified as Islamist and Far-Right extremists, both of whom include LGBTQ individuals in their ideological enemy images, even though other targets in the West are more frequently attacked. PST expects that Pride events, especially in the lead-up to June, will be subject to verbal and online threats, but emphasizes that most individuals making such threats lack genuine intent to carry out violence. Historically, only a small percentage of terrorist plots in Western countries have targeted LGBTQ-related venues or events, and none were recorded in 2025. The report highlights that radicalization can occur rapidly and unpredictably, making it difficult to identify individuals who may transition from rhetoric to action. The assessment also notes that attackers may shift targets if preferred ones are inaccessible, meaning that events with lower security could be more vulnerable. Factors such as media attention, proximity, and personal motivations can influence target selection. PST stresses the importance of public reporting of suspicious behavior and underlines its ongoing efforts, in cooperation with the police and other actors, to prevent and counter potential threats. (Source)
26/03/2026: Norwegian PST published their Threat assessment: Public Gatherings and Events in 2026, situating this analysis within the broader National Threat Assessment previously edited on February 6, 2026. It concludes that it is plausible that both Far-Right and Islamist extremists will attempt to carry out terrorist attacks during the year, with both milieus continuing to represent the primary sources of terrorist threat in Norway. These actors typically aim to maximize casualties and visibility, which makes public gatherings, events, and other crowded settings particularly attractive targets. The report identifies four principal categories of potential targets: organized events, religious holidays and commemorative dates, religious sites, and gatherings in confined or clearly delimited spaces. Drawing on data from Western countries between 2014 and 2025, it notes that 43 percent of all completed or foiled attacks by Far-Right and Islamist extremists were directed at such targets. Among these, gatherings in confined spaces such as transport hubs, educational institutions, nightlife venues, and shopping centers, were the most frequently targeted, accounting for 18% of attacks. Religious sites represented 12%, while organized events and religious or commemorative dates accounted for 8% and 5% respectively.
The analysis emphasizes that both extremist ideologies construct broad enemy images. Far-Right extremists typically target individuals and groups perceived as threats to “white culture”, including Muslims, Jews, minorities, political figures, LGBTQ+ individuals, and media actors, and are most likely to act alone, often through mass-casualty attacks or targeted assassinations. Islamists, by contrast, often regard all Western civilians as legitimate targets, which leads to a prevalence of indiscriminate attacks against civilians in public spaces. In both cases, Jewish and Israeli targets are highlighted as particularly at risk, especially in light of geopolitical developments since 2023 in the Gaza strip and escalating tensions involving Iran in 2026. The report further underlines that pre-announced events and gatherings present heightened vulnerability due to their predictability and concentration of people. Even when primary targets are secured, attackers may shift to alternative nearby targets, a phenomenon described as target displacement. Although attacks on events and holidays represent a smaller share of overall activity, past incidents in Norway, such as the 2011 Utøya attack and the 2022 Oslo Pride shooting, demonstrate that such scenarios remain plausible.
In addition to terrorism, the document highlights a significant intelligence threat posed by State actors, particularly Russia and China, with Iran also playing an active role. Events that bring together political, economic, or technological elites are considered especially attractive for espionage, influence operations, and surveillance. These activities may target dissidents, refugees, journalists, and academics, particularly those critical of foreign regimes. The report also notes instances of transnational repression, including intimidation of participants at conferences and monitoring of opposition figures. (Source)
27/03/2026: Considering the general development of the conflict in Iran and the attacks carried out in Europe, Norwegian PST reasserts that their terrorist threat assessment in Norway remains unchanged yet acknowledges that there is still an elevated threat to American, Israeli and Jewish targets. As such, PST has published an updated threat assessment regarding the blast at the US embassy in Oslo on March 8, 2026 which states that the probability that proxy actors could be used by Iranian services to carry out attacks in Norway has now been increased from "possible" to "probable". PST has previously assessed that the US embassy in Oslo is among the current targets for Iranian agents or proxies operating on Iran's behalf. (Source)
09/04/2026: Despite the ceasefire between the United States and the Islamic Republic of Iran, PST now considers it "likely" that Iranian services will exploit opportunities to carry out attacks in Norway using proxy actors directed at American, Jewish and Israeli targets. However this new statement does not impact the overall assessment of the terrorist threat in Norway previously deemed by PST to be "moderate" in February 2026. (Source)
20/05/2026: Norwegian PST has expressed concern over the rise of violent extremist online communities, particularly due to their increasing ability to recruit minors. This trend, observed over several years and intensifying since 2024, is especially alarming because vulnerable children and adolescents are targeted through manipulative tactics such as grooming, “lovebombing”, threats, sexual extortion, psychological coercion, and violent initiation rituals, with some groups requiring acts of violence as a condition for membership. Authorities consider these networks a security concern when violence is motivated by political, religious, or ideological objectives aimed at provoking chaos and societal collapse. However, ideological elements are often secondary to an overarching fascination with extreme violence. The phenomenon is transnational, with Norwegian individuals connected to international extremist networks, and authorities suspect that the true scale of the issue may be underreported. Although much of the activity within these communities consists of criminal behavior outside PST’s counter-terrorism mandate such as sexual exploitation, animal abuse, and vandalism, the agency is concerned that these networks may serve as gateways to radicalization and politically motivated violence. The contemporary extremist landscape demonstrates that ideology is no longer the sole or initial driver of radicalization; a fascination with violence and non-ideological forms of deviance can precede exposure to extremist beliefs and facilitate a rapid radicalization process once individuals enter ideologically motivated extremist circles.
These violent online communities, often categorized under terms such as “The Com” and “nihilistic violent extremism” (NVE), include groups such as 764, the Murder Maniac Cult (MKU), No Lives Matter (NLM), and the Order of Nine Angles (O9A). Their content combines elements of violent nihilism, misanthropy, Satanism, sadism, Far-Right extremism, particularly accelerationism, and other extremist ideologies, frequently accompanied by graphic and sexualized forms of violence. In response, PST addresses the phenomenon through preventive measures within its counter-terrorism framework. (Source)
This worrying trend has already been highlighted by all Nordic countries. A more in-depth analysis of minors involved in Islamism, Far-Right extremism, and the 764 network is available in The Nordic Counter Terrorism Network Database: 2025 Report, published in the December 2025 issue of the NCTN-IACSP Journal.
28/05/2026: Norwegian PST stated that two Norwegian citizens of Palestinian background were arrested in the Bergen area and remanded in custody on suspicion of participating in the transfer of firearms and ammunition to Hamas in another Western European country during the previous summer. Norwegian authorities assess that the weapons were intended for use in a planned terrorist attack against Jewish and Israeli targets in Western Europe, although they have not disclosed the country concerned. Despite the seriousness of the allegations, PST has stated that the overall terrorist threat level in Norway remains unchanged. The defendants deny the allegations, and their legal representatives have challenged the sufficiency of the evidence presented by the prosecution. Nevertheless, the court authorized on May 29, 2026 four weeks of pre-trial detention, including two weeks of solitary confinement, reflecting the seriousness with which Norwegian authorities view the case and the potential security implications of alleged Hamas-linked activities in Europe.
The investigation forms part of a broader European counterterrorism effort targeting suspected Hamas logistical networks. Norwegian authorities allege that the two suspects belonged to a Hamas-affiliated network with branches in several European countries, including Norway. The case follows a series of arrests across Europe, particularly in Germany, where multiple individuals have been detained since late 2025 on suspicion of supporting Hamas through weapons procurement and delivery activities. These developments suggest that European security services are increasingly focused not only on the risk of direct attacks but also on the clandestine infrastructure that may facilitate terrorist operations on behalf of Hamas within Europe. (Source)
18/06/2026: PST published the 2026 Threat Assessment for Pride and other LGBT+ Events concluding that there are currently no indications of planned violent attacks against Pride events or other LGBTQ+ gatherings in Norway in 2026, despite maintaining the national terrorist threat level at "moderate". While LGBTQ+ individuals remain part of the ideological enemy narratives of both Islamist and Far-Right extremists, historical evidence shows that such targets are attacked far less frequently than other categories of targets in Western countries.
The report anticipates an increase in online and verbal threats, particularly in the period preceding Pride Month, but concludes that the vast majority of those issuing threats lack genuine intent to commit violence. It also notes that potential attackers may select targets based on accessibility, symbolic value, media attention, and personal circumstances, with the possibility of target substitution if primary objectives are perceived as difficult to attack. PST emphasizes the importance of continued vigilance, public reporting of suspicious activities, and close cooperation between security services, law enforcement agencies, and event organizers to ensure an appropriate security posture. (Source)
24/06/2026: PST published the 2026 National Risk Assessment on Terrorist Financing that assesses the evolving risks of terrorist financing affecting Norway in light of both domestic and international developments. Drawing on the Financial Action Task Force (FATF) risk assessment framework, the report evaluates terrorist financing through the interconnected dimensions of threat, vulnerability, and consequence. It emphasizes that disrupting financial flows is a fundamental component of counterterrorism policy, as limiting access to financial resources can significantly reduce the operational capacity of terrorist organizations. The assessment highlights that terrorist financing is inherently transnational and increasingly exploits global financial infrastructures, making international cooperation indispensable. While the report primarily focuses on Norway, it recognizes that financing networks transcend national borders and that developments abroad directly influence the domestic threat environment.
The report argues that the contemporary security environment is characterized by heightened geopolitical instability, armed conflicts, and the erosion of international norms. Ongoing crises, particularly in the Middle East and Africa, have created opportunities for terrorist organizations to expand their recruitment, fundraising, and operational capabilities. Weak governance, State fragility, proxy conflicts, and competition over natural resources provide favorable conditions for extremist groups to secure financial resources and broaden their influence. These dynamics also facilitate transnational fundraising activities that may indirectly affect Norway. The assessment identifies multiple indicators and emerging trends that increase the risk of terrorist financing. Digital financial technologies, including cryptocurrencies and other virtual assets, are becoming increasingly relevant because they enable rapid cross-border transfers, greater anonymity, and more complex financial transactions. At the same time, terrorist actors continue to exploit conventional banking systems, informal value transfer mechanisms, cash transactions, and charitable organizations. The report stresses that terrorist financiers display considerable adaptability by combining traditional and innovative financial methods in response to regulatory measures and law enforcement efforts. PST also examines the role of online platforms and digital communication technologies in facilitating fundraising, recruitment, and financial support. Social media, encrypted messaging applications, and crowdfunding mechanisms enable terrorist organizations and their supporters to solicit donations from geographically dispersed sympathizers while complicating financial monitoring and investigative efforts. The increasing digitalization of financial services therefore expands both the opportunities available to terrorist financiers and the challenges facing authorities.
Overall, the assessment concludes that Norway faces a significant, though manageable, risk of terrorist financing. Although the volume of terrorist financing linked to Norway remains relatively limited, the country is exposed through global financial networks, international migration, charitable activities, and digital financial technologies. The report therefore recommends sustained cooperation among intelligence services, law enforcement agencies, financial institutions, supervisory authorities, and international partners to strengthen detection capabilities, improve information sharing, and enhance preventive measures. It emphasizes that terrorist financing remains a dynamic and evolving phenomenon requiring continuous risk assessment and adaptive regulatory and operational responses. (Source)