Image: cbc.ca
The Story
Toronto’s shooters-for-hire network is real; Iran’s role remains an attribution question, not a public verdict.
The strongest established fact is the local criminal machinery: encrypted recruitment, paid shooters, shared guns and repeated targets. Iranian sponsorship is a serious investigative line, supported in reporting by intelligence assessments and links to an alleged IRGC-connected figure, but public reporting has not yet proved that Tehran directed the full series.
- What is establishedPolice have identified a multilayered criminal network tied to numerous shootings and recruited through encrypted applications.
- What remains unresolvedThe public record does not establish who selected or financed every target, or whether Iran directed the broader campaign.
- Toronto police said young criminals were recruited and paid through encrypted messaging apps, with seized handguns potentially linked to 27 shootings.
- CBC reported that a dozen politically motivated shootings appeared to have been financed by Iran, while noting the attribution as a conclusion of its investigation rather than a publicly adjudicated finding.
- CBC’s experts distinguished real risks from speculation, describing criminal proxies as plausible while questioning the idea of dormant Iranian sleeper cells in Canada.
Source mix
9 sources
- 6 News reporting
- 3 Forum, video, personal
Deeper Insight
Toronto's paid shooters show how a state could outsource violence, then hide behind the criminals it hired.
Young people recruited through encrypted apps, paid shootings, shared guns, and repeated targets are the hard facts in Toronto. Reporting links a dozen attacks to possible Iranian financing, but has not proved Tehran directed them all. That gap is the point: violence can travel through local criminals while accountability gets stranded in the shadows.
- What it could changeFollowing money and messages could become as important as identifying the person who pulled the trigger.
- How it touches todayEncrypted apps already let criminals recruit shooters while separating them from whoever may be paying.
- Our futurePolitical violence could become easier to export and harder for the public to trace back to power.
- The originating story presents the Toronto case as part of a wider shift toward intelligence operations conducted through criminal networks, commercial technology and intermediaries.
- Reporting describes encrypted recruitment, financial incentives and layered structures that separate attackers from those directing them.
- Canadian security reporting connects the broader threat picture to possible Iranian state-directed activity and criminal proxies, while leaving the full attribution unresolved.
Sources · 9
- 6 News reporting
- 3 Forum, video, personal
What do these mean?
- News reporting. Journalism: newspapers, magazines and news sites.
- Forum, video, personal. Forums, social posts, video, blogs and personal accounts.
Featured · Analysis · reddit.com
Canada's New Nightmare: Violence As A Service?
Forum or personal account
This week marks the 100th episode of Global Intelligence Weekly Wrap-Up, a podcast where I examine international intelligence developments, connect them to previous cases and explore their implications for national security. For this milestone episode, we're looking at three stories that raise important questions about how intelligence operations are increasingly conducted through criminal network
Read sourceAnalysis · neilbisson1.substack.com
Canada's Growing Threat of Proxy Operations
Forum or personal account
Canada's Growing Threat of Proxy Operations # Neil Bisson Generate transcript A transcript unlocks clips, previews, and editing. The Toronto shootings investigation reveals how criminal networks and national security threats are becoming increasingly intertwined. Neil Bisson Jun 22, 2026 Transcript
Read sourceAnalysis · theglobeandmail.com
CSIS increases operation to combat Iranian state-directed activity, warns of continued threats - The Globe and Mail
News reporting
CSIS increases operation to combat Iranian state-directed activity, warns of continued threats - The Globe and Mail # CSIS increases operation to combat Iranian state-directed activity, warns of continued threats Marie Woolf Ottawa Published June 23, 2026 Updated June 24, 2026 Open this photo in gal
Read source