CSIS said it assesses that “Iranian threat-related activities directed at Canada and its allies are likely to continue in 2026.”
The agency declined to discuss specific investigations or operational details, citing the need to protect its sources, tradecraft and methods.
Iranian intelligence services and their proxies have targeted individuals they perceive as threats to the Iranian government, according to CSIS.
“In more than one case this involved detecting, investigating, and disrupting potentially lethal threats against individuals in Canada,” the agency said.
It added that it works with foreign partners and domestic law enforcement to counter such activity and engages communities across Canada to strengthen their resilience against potential threats.
The Royal Canadian Mounted Police (RCMP) also told Iran International that it was aware of reporting and allegations about possible foreign involvement in the incidents but declined to attribute them to Iran or another state while investigations remain underway.
“As these matters remain under investigation, the RCMP is not in a position to comment on specific intelligence, investigative findings, or potential attribution,” the force said.
The RCMP said it was aware of foreign interference activity in Canada involving several states, including Iran, and takes allegations of foreign interference, transnational repression and foreign state-linked criminal activity seriously.
The RCMP said it works with Canadian and international partners through intelligence sharing, threat assessments, coordinated investigations and enforcement actions.
Gun-for-hire investigations
The responses come amid investigations into suspected gun-for-hire networks operating in the Greater Toronto Area.
Toronto police say young people are being recruited through encrypted messaging apps to carry out attacks for payment, while investigators are still working to determine who is directing and financing the violence.
Police have identified a recurring pattern in some of the attacks involving stolen vehicles, encrypted messaging apps and gunmen recording shootings on their phones.
Police say recruits are required to record the attacks as proof in order to receive payment.
Toronto police said ballistic evidence linked two firearms seized during the investigation to numerous shootings across the Greater Toronto Area, including the attack on the US Consulate.
Iran International previously reported in June that an armed assailant fired 17 rounds at a Toronto athletic facility owned by Iranian-Canadian opposition activist Salar Gholami, hours after the killing of senior Iranian officials in Tehran.
The facility has served as a gathering place for opponents of the Islamic Republic and a hub for anti-regime demonstrations.
Surveillance footage captured an assailant whose physical profile was described in the report as consistent with young individuals allegedly recruited in other shootings.
The attack has not been publicly established as part of the same criminal network involved in other shootings under investigation in Toronto.
Conservatives call for action
Conservative Party leader and opposition leader Pierre Poilievre has warned that foreign-backed networks are exploiting criminal groups to carry out attacks in Canada.
"Iran's terrorist regime is suspected of financing gun-for-hire shootings on Canadian soil. Synagogues, a school, businesses, and the U.S. Consulate targeted. Jewish Canadians and Iranian dissidents are being terrorized," Poilievre said.
He called on the federal government to identify and deport Iranian Revolutionary Guard operatives unlawfully present in Canada.
Canada and more than two dozen other countries said earlier this month that they condemned Iran’s use of violent attacks, including lethal plotting, arson, sabotage, cyberattacks and other hostile activities, and pledged to identify, investigate and disrupt such activity.