Global Intelligence Summary

On the night of 7-8 March, an improvised explosive device (IED) was detonated outside the US Embassy in Oslo, causing minor damage to the building and no casualties. Norwegian authorities noted that, around the same time as the explosion, a video praising Ayatollah Ali Khamenei was posted on the embassy’s Google page. On 11 March, Norwegian authorities arrested three individuals of Iraqi origin in connection with the bombing. Early on 10 March, the US Consulate in Toronto was targeted by small arms fire. Canadian authorities reported that the occupants of a transiting vehicle had opened fire on the building, causing minor damage and no injuries. In addition to attacks targeting US diplomatic offices, incidents were also recorded at Jewish places of worship. On 8-9 March, an explosion occurred outside a synagogue in Liege, Belgium.

Solace Global Assessment: 

The timing of the attacks, as well as the publication of a video praising the Ayatollah, who was killed by US and Israeli strikes in the opening stages of the Iran conflict, suggests it is highly likely that the attacks are linked to the ongoing hostilities in the Middle East.

In the last five years, Iranian intelligence services have intensified “hybrid” operations targeting adversarial states, including in Europe and North America. In mid-2025, Swedish authorities reported that Iranian intelligence had enlisted local small organised criminal groups to carry out attacks against Israeli targets. Swedish authorities also linked Tehran to two shootings in October 2024 that targeted the Israeli embassies in Stockholm and Copenhagen. In the UK, the intelligence services and security services have warned of an increasing number of Iranian-linked plots targeting Israeli, Jewish, and dissident figures, with Tehran increasingly relying on proxy actors and criminal networks to conduct operations abroad while maintaining a high degree of plausible deniability. In the US, several Iranian plots have been disrupted, including an alleged plot to assassinate President Trump and other high-ranking US officials.

The alleged Iranian use of local criminals to carry out hybrid operations at the behest of Tehran strongly resembles the model used by Russia, with Moscow also financing local criminal groups, disenfranchised locals or political extremists to conduct operations in countries it deems hostile to its interests, in exchange for payment. However, Iran may also be able to leverage its extensive diaspora community, as well as sympathetic individuals and pre-existing militant networks, to facilitate or conduct attacks. While the overwhelming majority of the Iranian diaspora is opposed to the regime, at an estimated four to six million, its size and geographical spread will likely provide Tehran with opportunities to identify, recruit or even coerce individuals capable of supporting its covert activities.

The attacks on the two US diplomatic offices match previous cases of alleged Iran-sponsored attacks, including in their use of unsophisticated means and their occurrence at night, which was likely aimed at minimising the likelihood of the attackers being arrested. However, as the conflict continues and Iran’s risk threshold increases, there is a realistic possibility that Tehran or Iranian-aligned actors will conduct more complex or higher-impact attacks, targeting US and Israeli interests and the international Jewish community.