The explosion outside the US Embassy in Norway at 1 a.m. on March 8 is likely a significant marker that the war with Iran has now expanded beyond the Middle East.
Other events across the continent reinforce the message that Tehran has activated its terror networks; on March 9, a bomb exploded at a synagogue in the Belgian city of Liege, and on March 6, British counter-terrorist police arrested four Iranian men suspected of spying on Jewish sites.
One week into the conflict, pundits and intelligence officers had been holding their collective breath waiting for the first sign of Iran activating its support groups for attacks outside the Persian Gulf neighborhood. The question has been, not if, but when will Iran’s extensive proxy network, whose online chatter has rung alarm bells since February, take action.
Although news reports are limited in detail and local authorities, as well as the State Department, are tight-lipped, Oslo may prove to have been the first in a wave of kinetic attacks. The blast has the hallmarks of an Iranian-ordered Foxtrot gang proxy attack.
Several contextual elements about the Oslo attack bring the picture into clearer focus:
The Building: The current US Embassy in Oslo opened in 2017, built to meet strict security specifications as a major upgrade over the former 1959 embassy that stood across from the Norwegian royal palace on a main street downtown.
The new compound is in a residential neighborhood north of downtown with no other embassies nearby. Its closest official neighbor is the King’s Guard military base. This is neither a commercial nor a heavily trafficked area, especially in the middle of the night.
The explosion occurred at the heavily fortified consular screening entrance, which is not connected to the main building, but rather situated along the sidewalk with a high security fence on either side. A commuter road runs past the side of the embassy, whose main entrance and visitor parking are around the corner. Whoever did this planned to make a loud, audacious point, but seems not to have had the resources or desire for a large and more damaging explosion.
The Timing: Oslo is not a big or densely populated city (725,000 residents). It is spread out along the waterfront of the fjord and up to the top of Holmenkollen mountain. The embassy sits up the mountain from the fjord. In the evening, especially in winter, the neighborhood is quite quiet. There are no restaurants or bars nearby, only families hunkered down for the country’s long winter; spring is still weeks away. In such silence, the blast was clearly heard throughout the neighborhood. The message was likely “See, we can even hit you here”. Embassy staff will have been well aware of a possible attack — only last year, a locally-hired guard at the building was convicted of spying for Russia and Iran.
The Gang: Chances are high that the Norwegian police services are focusing on the Foxtrot criminal gang for leads. Founded in 2010, Foxtrot is a notorious, transnational drug trafficking gang based in Sweden. In March 2025, the US Treasury sanctioned both the Foxtrot Network and its fugitive leader, Rawa Majid, accusing them of arms and drug trafficking, shootings, and contract killings across Northern Europe and at the behest of Iran. Swedish authorities have numerous charges pending against Majid, who is a fugitive in Iran.
Investigative journalists following gang violence in Sweden highlight two key elements in the quickly rising violence there: the recruitment of minors to carry out gang dirty work (because minors cannot be interrogated or convicted as adults in Scandinavian legal systems) and the persistent use of hand grenades (salvaged from the Yugoslav wars and smuggled into Scandinavia). In October and November, the Norwegian Foxtrot branch used minors in three separate hand grenade attacks across Oslo, believed to be part of an inter-gang competition for drug territory.
The Iran Connection: Foxtrot is connected to the Iranian regime, specifically the Ministry of Intelligence and Security (MOIS), and takes orders from them. In the official US Treasury sanction notification, Treasury Secretary Scott Bessent stated: “Treasury, alongside our U.S. government and international partners, will continue to hold accountable those who seek to further Iran’s thuggish and destabilizing agenda.”
Iran gave sanctuary to Foxtrot’s leader, Majid, and American officials and Mossad say that the Iranian regime ordered Foxtrot to attack the Israeli Embassy in Stockholm in January 2024. In October of that year, two Foxtrot-recruited Swedish teenagers threw hand grenades at the Israeli embassy compound in Copenhagen, leading a Danish court to sentence them in February to 12-year prison terms for terrorism. In June 2025, the US Embassy in Sweden released a warning to US citizens that Iran could be targeting US interests in Sweden using the Foxtrot network.
Iran has long developed links to transnational criminals and drug traffickers. Like Russia, whose extensive network of proxy bad actors has attempted to sow fear and destabilization across NATO territory, Iran’s use of young gang members recruited crudely over social media in Scandinavia poses real challenges for law enforcement agencies working to prevent civilian casualties and public fear-mongering.
The cherished sense of Scandinavian safe societies is under tremendous pressure, leading to the rise in popularity of anti-immigrant, ethno-nationalist political parties. This Oslo explosion, whether attributable to Foxtrot or others, will heighten tensions throughout Northern Europe, putting residents and leaders on edge and wondering what comes next.
Sharon Hudson-Dean is former Deputy Assistant Secretary of State for Northern Europe, NATO and Arctic Security (2024-25) and former Charge d’Affaires a.i. (Acting Ambassador) at the US Embassy in Oslo.
Europe’s Edge is CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America. All opinions expressed on Europe’s Edge are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
Ukraine 2036
How Today’s Investments Will Shape Tomorrow’s Security
CEPA Forum 2025
Explore CEPA’s flagship event.
