An Iranian-Swedish analyst and outspoken critic of the Islamic Republic has told The Jerusalem Post he believes Tehran was behind an alleged murder plot against him in Sweden, after a teenager armed with a knife came to his home in Malmo and asked for him at the door.
Arvin Khoshnood, a researcher and commentator on Iranian affairs, said that the attempted attack last September has since been folded into a wider Swedish criminal case involving multiple defendants, a separate shooting in another city, and alleged plans to target a defense company linked to Israeli military cooperation.
The case is now being heard at Gothenburg District Court under case number B 2853-25, with hearings running from April 8 to April 29. Court officials told the Post that a verdict is expected within a few weeks of the final hearing date.
Swedish prosecutors have not publicly established in court that Iran directly ordered the plot against Khoshnood. But in an interview with the Post, he said that the method, timing, and wider context all point in the same direction – the use of criminal proxies to target perceived enemies of the regime in Europe.
“Directly from that second, I thought someone had been sent by the regime to kill me,” Khoshnood said.
The incident took place on the evening of September 2, when he and his wife were at home in Malmo and not expecting visitors. His wife answered the door after the bell rang, and a young man outside asked for him.
Khoshnood, who had been in the bathroom, said the circumstances immediately struck him as suspicious.
“It was in the evening. We didn’t expect anyone [to visit],” he told the Post from hiding, where he and his family have been for safety reasons since September’s attempted attack. “I didn’t recognize the voice. I got a really bad feeling about it.”
He said that he soon realized the visitor had likely jumped over a closed fence to reach the front of the house – another detail that raised alarm.
“No normal person would jump over a fence and ring a doorbell,” he said.
After his wife closed the door, Khoshnood went upstairs, turned off the lights, and looked out from a bedroom window. There, he said, he saw the suspect pacing outside, speaking repeatedly on the phone, and behaving in a way he described as tense and unnatural.
He took a photo and called the police.
By the time officers arrived, the suspect was gone.
Khoshnood said he later learned the man who came to his home had been carrying a knife and was allegedly part of a wider group of young recruits tasked with attacking him.
At first glance, the legal case has seemed confusing.
The attempted attack on Khoshnood happened in Malmo, in southern Sweden. Yet the case is being tried in Gothenburg, a city much farther north, with proceedings taking place in a secure courtroom.
Khoshnood said the reason is that his case is not being handled as a standalone incident.
According to his understanding, the alleged plot against him has been grouped together with several other cases involving the same suspects, including a separate shooting in Uddevalla and another planned attack in Malmo.
“There are four or five cases being tried together because it’s the same people involved,” he said. “It’s the same accused.”
He said that one of the additional alleged targets was Aimpoint, the Swedish optics and defense company known for its red-dot sights and for cooperation with Israeli defense-linked entities.
According to Khoshnood, the alleged plan discussed by the suspects was to kill him first and only then move on to the company.
“The plan was that they wanted to murder me first and then attack the company,” he told the Post.
The researcher also explained that the case only fully opened up after one of the suspects later became involved in a separate shooting in Uddevalla.
That second attack, he said, was not political and appears to have involved a criminal target rather than a dissident or ideological opponent.
But after police arrested suspects in that case, Khoshnood said investigators uncovered chats and other evidence that allegedly linked the same network back to the attempted attack on him.
“What happened after is that this guy went to Uddevalla, where he shot someone,” he said.
“And when they arrested him, they could connect everything back to me as well.”
According to Khoshnood, the messages included references to an unidentified figure using the name “Tartarus,” who he said appears to have acted as a coordinator or handler in the background of the alleged plot.
That figure, he said, allegedly issued instructions to the young suspects both to kill him and to later attack Aimpoint, which had also been discussed in the same chats.
Khoshnood said the role of “Tartarus” is now one of the most important unresolved elements in the case.
“As soon as Tartarus is identified, then we need to see if there is a link to Iran as well or not,” he said, noting that Swedish prosecutors have so far not publicly identified the person behind the alias.
He also said the case appears to reflect a wider pattern in Sweden, in which criminal networks and freelance gang recruits can be used for both political and non-political violence.
Khoshnood said he initially suspected a possible connection to Foxtrot, the notorious Swedish criminal network repeatedly linked in public reporting to proxy violence and subcontracted attacks.
But he stressed that, based on what prosecutors have said so far, no direct Foxtrot link has yet been publicly established in his case.
“My initial thought was it could be Foxtrot, but I’m not certain anymore,” he said. “The prosecutor has said that they cannot right now find any direct connection to Foxtrot in my case.”
He added, however, that the Uddevalla shooting in the wider case appears to have had a clearer connection to Foxtrot, reinforcing his view that the same group of young suspects may have been moving between criminal and politically motivated assignments.
That distinction, he said, is precisely what makes such cases difficult to untangle.
“It could be some other gang or network recruiting these same guys to do those jobs,” he said. “Some of these guys, they want just the money. They don’t care about anything else.”
Khoshnood explained that the material described to him suggests the alleged plot against him was meant to be carried out quietly and quickly. He said the plan, as he understands it, was to kill him with a knife rather than a firearm to avoid drawing attention.
Khoshnood said that detail, too, struck him as significant: not only the intention to kill, but the apparent effort to do so quietly, without triggering the kind of attention a shooting might bring.
According to Khoshnood, the group was allegedly offered 300,000 Swedish kronor, roughly $30,000, to kill him – about twice what was allegedly discussed for the planned attack on Aimpoint.
“Tartarus told these guys, it’s very important that you don’t make any mistakes,” Khoshnood said. “Because if we lose this guy now, it will take lots of time to find him again.
“Since that night, we left our house… and we never returned back again,” he said.
Khoshnood was careful to distinguish between what he believes and what Swedish authorities have formally established.
He told the Post the prosecutor has made clear that investigators have not yet identified “Tartarus,” and that no definitive evidentiary line to Tehran has yet been publicly laid out in court.
Still, he said he sees no other plausible motive.
“There are no other motives for why someone wanted to kill me except for this political motive,” he said.
The Islamic Republic’s proxy method
Khoshnood has, for years, been one of Sweden’s more visible critics of the Islamic Republic, writing and speaking publicly about Iranian intelligence operations, the regime’s networks in Scandinavia, and what he says are Tehran-linked influence and intimidation efforts inside Sweden.
He said that his work has likely put him on a target list.
“I think it’s about what I have done, and the contacts and networks I have,” he said.
He also said Swedish security services had previously warned him to be alert.
“Around one and a half [or] two years before this happened, I had a talk with the Swedish security services,” he told the Post. “They asked me to be more careful about my surroundings.”
He said the case fits what he sees as a broader Iranian pattern of dissidents and perceived enemies targeted through deniable criminal or local proxies operating at arm’s length.
Khoshnood’s suspicions also come amid a more public warning from Sweden’s own security establishment.
In a threat assessment published on March 3, Sapo, Sweden’s Security Service, said the ongoing escalation involving Iran has increased the threat not primarily against Sweden itself, but against targets located in Sweden.
Sapo said Iran and its intelligence and security services have long conducted security-threatening activity against Sweden, including intelligence-gathering and the mapping of opposition figures. It also noted that Iran has previously planned and carried out violent acts in Sweden using proxies.
The agency added that the current regional escalation has increased the threat to American, Israeli, and Jewish interests, as well as to Iranian opposition groups and individuals in Sweden.
The statement did not refer specifically to Khoshnood’s case, but it closely tracks the pattern he says he believes targeted him.
One of the more interesting aspects of the case, Khoshnood said, is that the alleged would-be attacker did not fit the stereotypical image of a foreign operative.
The youth who came to his door, he said, looked Swedish, spoke perfect Swedish, and appeared to be a local criminal recruit rather than an ideological militant.
“Some of these guys, they want just the money. They don’t care about anything else,” Khoshnood said. “A network that pays better is what they work for.”
That, he argued, is what allows hostile states and their intermediaries to operate with distance and deniability – outsourcing violence to criminal subcontractors who may move between gang assignments, personal disputes, and political targeting with little regard for the difference.
“And that’s also the reason why the regime in Iran uses these criminal networks and gangs,” he said. “It’s easy for them to deny that they have been part of this terror operation.”
For now, the courtroom focus will remain on the teenagers and the alleged operational cell around them. But the larger question – who gave the order, and whether Swedish authorities can ultimately trace it back to Tehran – remains unanswered.