The Canadian Security Intelligence Service (CSIS), in a special response to IranIntl's questions, confirmed it has countered threatening activities by Iranian intelligence services and their proxy elements operating on Canadian soil and has thwarted "potentially lethal" plots in some concrete cases. CSIS said it cannot provide details to protect ongoing investigations' sources and methods; however, it emphasized that threats from the Iranian regime's intelligence services and proxies have persisted throughout the year, that its personnel are in continuous counteraction against these entities, and that Tehran targets individuals and activists it views as threats.
The Royal Canadian Mounted Police (RCMP) also responded separately to IranIntl, stating it is aware of reports of possible foreign involvement in these incidents and is tracking all allegations of foreign interference, transnational coercion, and foreign-state-linked crimes in close cooperation with domestic intelligence agencies and international partners as part of its national security strategy.
According to IranIntl's report, these official confirmations substantiate earlier investigation findings into a "gun-for-hire" network that emerged in the Greater Toronto area. The network allegedly recruits local criminals and in some cases juveniles through encrypted messaging apps; attacks typically consist of early-morning armed assaults in stolen vehicles, and perpetrators are required to film their actions and send the video to their employers as "proof" in order to collect payment. Ballistic testing by Toronto Police showed a gun seized in one attack was linked not only to actions against diplomatic targets but also to dozens of other armed incidents across the city.
IranIntl wrote that the strongest evidence of the network's Tehran connection appeared in a federal court case in New York: a militia group affiliated with Iraqi-based Kata'ib Hezbollah and operating under Revolutionary Guards command, led by senior commander M.B.S.D.A., is accused in U.S. charges and FBI documents of planning and coordinating at least 18 armed attacks in Europe and two attacks in Canada against the U.S. consulate in Toronto and a Jewish synagogue. Audio recordings made before his arrest show M.B.S.D.A. describing the attacks as direct retaliation for Washington's military pressure and sanctions against Iran. The presumption of innocence applies.
Context
CSIS had previously shared warnings about Iran-linked threat activity in Canada with the public: in November 2025, the CSIS Director, in a rare public address, said Canada had foiled multiple potentially lethal plots by perceived Iranian enemies operating on Canadian soil; in March 2026, CSIS assessed that Iran and its proxies' threat activities were likely to persist throughout 2026. Today's confirmation pairs these warnings for the first time with concrete operational results (plot disruption) and a U.S. federal court file. Canada has repeatedly come into the spotlight in recent years in cases involving alleged Iranian targeting of overseas dissidents; in 2024, the foiling of an assassination plot against former Justice Minister Irwin Cotler was made public. A similar pattern surfaced in the U.K.: three Iranians in London were charged with surveilling Iran International journalists, showing that Iran-linked threat activity is not confined to Canada.
