Cyber Threat Assessment for Canadian Organizations: Navigating State-Sponsored and Criminal Threats

Executive Summary: Key Threats and Strategic Imperatives

Canadian organizations are confronting an increasingly dangerous and complex cyber threat landscape defined by the convergence of two distinct but interconnected challenges: the escalating aggression of state-sponsored actors and the pervasive, resilient operations of a global cybercrime ecosystem. State adversaries, particularly the People's Republic of China and Russia, are leveraging sophisticated cyber capabilities not only for espionage but also for pre-positioning within critical networks, conducting malign influence campaigns, and repressing dissent, posing a direct threat to Canada's national security and economic prosperity.

Simultaneously, the financially motivated cybercrime threat, supercharged by the Cybercrime-as-a-Service (CaaS) model, has become more accessible and impactful than ever. Ransomware remains the foremost operational threat, directly targeting Canada's critical infrastructure and digital supply chains. These attacks disrupt essential services, jeopardize public safety, and impose staggering financial and reputational costs on businesses of all sizes. The operational dependency on a small number of dominant technology vendors has created systemic vulnerabilities, where a single security failure can trigger cascading, sector-wide disruptions.

This hostile environment is further amplified by rapidly evolving technologies. Artificial intelligence is lowering the barrier to entry for malicious actors, enabling them to create more persuasive social engineering attacks and spread disinformation at an unprecedented scale. Adversaries are also refining their tradecraft, employing advanced evasion techniques like "living off the land" and targeting network edge devices to bypass traditional security defenses and operate with a high degree of stealth.

In response to this escalating risk, the Canadian regulatory landscape is also intensifying. Navigating this environment is no longer a matter of IT security alone; it is a core function of business strategy, risk management, and corporate governance. Survival and prosperity will depend on integrating robust technical defenses with a deep understanding of geopolitical risk and an unwavering commitment to the growing legal and compliance obligations that define the new reality for Canadian businesses.

1.0 Introduction: The Intensifying Cyber Threat to Canadian National Security and Economic Prosperity

The cyber threat landscape facing Canada has grown increasingly complex and hostile. State adversaries are becoming more aggressive in their use of cyberspace to advance their strategic interests, while financially motivated cybercrime has become more pervasive and disruptive. This environment presents a significant and evolving threat to Canada's national security, economic prosperity, and the operational integrity of its businesses and critical infrastructure. The proliferation of advanced technologies and the interconnectedness of the global digital ecosystem have created new vectors for malicious actors to exploit, making a proactive and informed security posture more critical than ever.

The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 makes the following key judgments that encapsulate the primary challenges facing Canadian organizations today:

• Aggressive State Adversaries: State-sponsored actors are increasingly using cyber operations not only for espionage but also for disruption and to sow division, combining computer network attacks with online information campaigns to intimidate and shape public opinion.
• The People's Republic of China (PRC): The PRC's expansive and aggressive cyber program represents the most sophisticated and active state-sponsored cyber threat to Canada. Its operations are designed to serve high-level political and commercial objectives through espionage, intellectual property theft, and transnational repression.
• The Russian Federation: Russia continues to leverage its formidable cyber program to confront and destabilize Canada and its allies. Moscow's activities target Canada due to its role in NATO, its support for Ukraine, and its presence in the Arctic.
• Resilient Cybercrime Ecosystem: The global cybercrime ecosystem remains highly resilient, driven by the profitable and accessible Cybercrime-as-a-Service (CaaS) business model. This model lowers the barrier to entry, enabling a growing number of actors to launch sophisticated attacks.
• Ransomware as the Top Threat: Ransomware remains the most significant and disruptive cybercrime threat to Canada's critical infrastructure. These attacks directly impede the delivery of essential services, putting the physical and emotional well-being of Canadians at risk.

This report is designed to provide Canadian business leaders and security professionals with a strategic overview of these threats. By analyzing the tactics, motivations, and evolving capabilities of key state and criminal actors, this assessment aims to inform effective risk management, enhance organizational resilience, and support strategic decision-making in an era of persistent digital conflict.

2.0 Analysis of State-Sponsored Cyber Threats

State-sponsored cyber operations represent a persistent, well-resourced, and strategic threat to Canadian organizations. These activities extend far beyond traditional espionage and now routinely include pre-positioning within critical networks for future disruptive effects, conducting malign influence campaigns to undermine democratic institutions, and engaging in transnational repression to silence dissent. For Canadian businesses, this means the threat is not merely the theft of sensitive data but also potential operational sabotage, supply chain disruption, and significant reputational damage.

2.1 The People's Republic of China (PRC): The Premier Strategic Threat

The People's Republic of China's expansive and aggressive cyber program is the most sophisticated and active state-sponsored threat to Canada. The PRC conducts extensive cyber operations against Canadian interests to serve high-level political and commercial objectives set by the Chinese Communist Party (CCP). These objectives include advancing its own industrial policy, gaining a strategic advantage in bilateral relations, and silencing critics of the CCP both at home and abroad.

The PRC employs a wide range of tactics against a broad set of Canadian targets:

• Government Espionage: PRC state-sponsored actors persistently target all levels of government—including federal, provincial, territorial, municipal, and Indigenous networks—to acquire information that advances the PRC's strategic, economic, and diplomatic interests. This targeting extends to government officials and parliamentarians, particularly those perceived as being critical of the CCP.
• Economic and Intellectual Property Theft: The PRC's cyber program is a key tool in its strategy to achieve economic and technological dominance. Actors systematically target Canada's private sector, academic institutions, and research and development (R&D) sectors to steal commercially sensitive data, trade secrets, and intellectual property. This theft is intended to support the PRC's own industrial policy priorities and provide its companies with a competitive advantage.
• Transnational Repression: PRC actors use cyber surveillance and monitoring to support the regime's efforts to silence activists, journalists, and diaspora communities in Canada. These groups, which the PRC collectively refers to as the "Five Poisons"—Falun Gong practitioners, Uyghurs, Tibetans, supporters of Taiwanese independence, and pro-democracy activists—are targeted online to facilitate harassment and intimidation.
• Critical Infrastructure Pre-positioning: In a significant strategic shift, PRC-sponsored actors like Volt Typhoon are seeking to pre-position within North American critical infrastructure networks. Their goal is to gain persistent access that could be used for disruptive or destructive cyber attacks in the event of a major conflict. Due to the high degree of cross-border interdependence in sectors like energy and transportation, a major disruption to U.S. infrastructure would almost certainly have a significant impact on Canadian business operations.

2.2 The Russian Federation: Destabilization and Confrontation

Russia's cyber program is a core component of its multi-layered strategy to confront and destabilize Canada and its allies. Moscow combines conventional cyber espionage with sophisticated disinformation and influence operations to erode trust in democratic institutions, undermine Western support for Ukraine, and promote its own geopolitical objectives.

Russia's primary operational methods create significant risks for Canadian organizations:

• Espionage against High-Value Targets: Due to Canada's prominent role in NATO and its unwavering support for Ukraine, Russian state-sponsored actors very likely view Canadian government, military, and critical infrastructure networks as valuable espionage targets. These actors have demonstrated a high degree of sophistication in conducting supply chain compromises, such as the 2020 SolarWinds incident, and are almost certainly targeting widely used cloud-based services, like those offered by Microsoft, to gain access to customer data.
• Leveraging Non-State Proxies: Russia frequently utilizes a network of pro-Russia non-state (PRNS) hacktivist groups to conduct disruptive cyber activity with a degree of deniability. These groups, some of which we assess likely have links to the Russian government and intelligence services, have targeted Canada with distributed denial-of-service (DDoS) campaigns, such as the series of attacks on government and private sector websites in April 2023 that coincided with the Ukrainian Prime Minister's visit to Canada.
• Disruption of Operational Technology (OT): PRNS actors are increasingly attempting to compromise vulnerable internet-connected OT systems within critical infrastructure. While often opportunistic, these attacks can have serious consequences. For example, a PRNS group claimed responsibility for causing water storage tanks to overflow at facilities in Texas in January 2024. This incident highlights the potential for similar attacks in Canada to create risks to public safety.

2.3 Other State Actors of Concern

While the PRC and Russia represent the most significant state-sponsored threats, other nations are expanding their cyber capabilities with concerning implications. Iran has demonstrated an increasing willingness to conduct disruptive cyber attacks beyond the Middle East. Its aggressive cyber program is used to coerce, harass, and repress its opponents, and its persistent efforts to track and monitor regime opponents through cyberspace present a growing challenge for Canada. Iran has shown it will use proxies, including individuals linked to transnational organized crime, to target perceived enemies abroad. The 2024 indictment of two Canadian nationals in the U.S. for their alleged role in a murder-for-hire plot on behalf of Iranian intelligence underscores this threat.

While state-sponsored threats are strategic, persistent, and aimed at undermining national interests, the more frequent and immediate danger for most Canadian businesses comes from the high-volume, opportunistic, and financially devastating operations of the global cybercrime ecosystem.

3.0 The Pervasive Threat of Financially Motivated Cybercrime

Financially motivated cybercrime is the threat most likely to directly affect Canadian organizations. It is sustained by a thriving and highly resilient global ecosystem that has professionalized the development and deployment of malicious tools. Central to this ecosystem is the Cybercrime-as-a-Service (CaaS) model, an illicit business framework that, according to the Cyber Centre, almost certainly owes its persistence to making sophisticated cyber attacks accessible, profitable, and scalable for a wide range of criminals, regardless of their technical expertise.

3.1 The Cybercrime-as-a-Service (CaaS) Ecosystem

The CaaS model mirrors legitimate software-as-a-service businesses. Specialized threat actors develop malicious tools, infrastructure, and services, which they then sell or lease to other cybercriminals through online marketplaces and forums. This division of labor allows actors to specialize in specific areas—such as malware development, initial access brokering, or money laundering—increasing the overall efficiency and effectiveness of the criminal enterprise.

3.2 Ransomware: The Foremost Threat to Canadian Business Operations

Ransomware is the most disruptive and impactful form of cybercrime facing Canadian organizations. Since 2020, ransomware attacks have increased in scope, frequency, and complexity, becoming the top cybercrime threat to Canada's critical infrastructure. Ransomware groups are constantly refining their tactics to maximize profits and increase pressure on victims to pay.

Key extortion tactics employed by modern ransomware groups include:

• Big Game Hunting: This strategy involves specifically targeting large, critical organizations, such as hospitals, energy companies, and municipal governments. Threat actors perceive these entities as more willing to pay large ransoms to avoid prolonged operational disruptions and the associated public safety risks.
• Data Exfiltration and Leak Threats: It is now standard practice for ransomware actors to not only encrypt a victim's data but also exfiltrate it before detonation. They then threaten to leak the stolen sensitive information on public "leak sites" on the dark web, a form of double extortion that pressures victims concerned about regulatory penalties and reputational damage.
• Harassment Campaigns: To further coerce payment, some of the most aggressive ransomware groups have escalated their tactics to include directly contacting a victim organization's employees, customers, business partners, or even the media to publicize the breach and amplify pressure.

Several prominent Ransomware-as-a-Service (RaaS) groups, including LOCKBIT, ALPHV (BlackCat), and CL0P, have been responsible for high-impact incidents in Canada. In recent years, Canadian critical infrastructure sectors have been significantly affected, with publicly reported incidents impacting organizations such as Suncor Energy, which led to disruptions at Petro-Canada stations; the retailer London Drugs; and the City of Hamilton, which confirmed it was the victim of a ransomware attack.

3.3 The Enduring Threat of Fraud and Scams

While ransomware causes significant disruption, fraud and scams—particularly phishing and business email compromise (BEC)—remain the most common forms of cybercrime affecting Canadians and their businesses. These social engineering tactics are designed to steal personal, financial, and corporate information for direct financial gain. According to the Canadian Anti-Fraud Centre, reported financial losses from fraud in Canada reached $567 million in 2023.

Both state-sponsored and criminal actors are constantly refining their methods by leveraging new technologies and innovative tactics to bypass defenses and increase the effectiveness of their operations.

4.0 Evolving Cyber Threat Tactics and Technologies

Understanding how threat actors operate is as crucial as understanding why. As organizations improve their cyber defenses, adversaries are continuously evolving their tradecraft to evade detection, amplify their impact, and exploit systemic weaknesses in the digital ecosystem. By adopting new technologies and refining their techniques, these actors seek to maintain their advantage and ensure the success of their malicious campaigns.

4.1 The Amplifying Role of Artificial Intelligence (AI)

Artificial intelligence technologies are lowering the barrier to entry for malicious actors and enhancing the quality, scale, and precision of cyber threats. Both cybercriminals and state-sponsored groups are using generative and predictive AI tools, including Large Language Models (LLMs), to support and improve their operations.

Primary applications of AI in malicious cyber activity include:

• Enhanced Social Engineering: AI and LLMs are used to craft highly convincing, grammatically correct phishing emails that mimic human writing styles, making them harder for both people and security filters to detect. Generative AI also enables the creation of realistic audio and visual deepfakes, which can be used to impersonate trusted individuals in more persuasive and targeted attacks.
• Disinformation at Scale: State actors are leveraging generative AI to create and spread disinformation at an unprecedented scale. AI tools are used to generate fake news articles, images, and fictitious social media bot accounts to pollute the online information space, amplify polarizing narratives, and undermine trust in democratic institutions.

4.2 Advanced Evasion and Persistence Techniques

To bypass modern security tools, sophisticated threat actors are increasingly relying on stealthy techniques that minimize their digital footprint within a victim's network.

• Living Off the Land (LOTL): This technique involves using a victim’s own native system tools, scripts, and processes to conduct malicious activities. By repurposing legitimate software already present in the environment (e.g., PowerShell), actors can operate discreetly and avoid detection by security products that are designed to flag known malicious files. This technique is a hallmark of sophisticated actors, with the NCTA noting its use by PRC, Russian, and Iranian state-sponsored groups to operate with a high degree of stealth.
• Targeting "Edge" Devices: Threat actors are increasingly targeting and exploiting vulnerabilities in network perimeter devices like routers, firewalls, and Virtual Private Network (VPN) solutions. These "edge" devices are attractive targets because they often have limited security monitoring, allowing actors to gain initial access to a network and remain undetected.
• Abusing Domestic Infrastructure: To mask their origins and blend in with normal network traffic, foreign actors are routing their operations through compromised infrastructure within North America. State-sponsored groups have been observed conducting malicious campaigns through compromised small office and home office (SOHO) routers belonging to unsuspecting Canadian and U.S. households and businesses.

4.3 Vendor Concentration and Supply Chain Vulnerabilities

A growing systemic risk stems from vendor concentration, where entire industries rely on a small number of dominant providers for critical digital services, such as cloud computing, payment processing, or specialized software. A cyber incident at a single one of these providers can have cascading, system-wide impacts, disrupting the operations of thousands of dependent businesses simultaneously.

Recent incidents have highlighted the tangible consequences of this risk:

• The June 2024 ransomware attack on CDK Global, a dominant provider of dealer management software, shut down the systems of thousands of auto dealerships across Canada and the U.S., disrupting sales, financing, and service operations for up to two weeks.
• The February 2024 breach of Change Healthcare, a platform that processes medical claims and payments for a significant portion of the U.S. healthcare system, caused massive disruptions to medical payments and prescription fulfillment for weeks.

This extreme operational dependency on digital chokepoints creates systemic vulnerabilities across Canada's critical infrastructure, linking the external threat of a single supply chain failure directly to the internal risk management and compliance obligations that Canadian businesses must navigate.

5.0 The Canadian Regulatory Landscape: Compliance as a Core Security Function

In addition to defending against a complex array of external threats, Canadian businesses must navigate an evolving landscape of privacy and data security laws. Federal and provincial regulations impose strict obligations on how organizations collect, use, and protect personal information. Failure to comply can result in severe financial penalties, regulatory investigations, and significant reputational damage, making legal compliance a critical and non-negotiable component of any comprehensive risk management strategy.

5.1 Core Privacy Obligations under PIPEDA

Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), is founded on ten fair information principles. These principles establish a framework for the responsible handling of personal data. For businesses, the core obligations include:

• Accountability: Organizations are responsible for the personal information under their control and must designate a privacy officer to ensure compliance.
• Consent: Businesses must obtain an individual's informed and meaningful consent before collecting, using, or disclosing their personal information.
• Limiting Collection: Data collection must be limited to what is necessary for the specific purposes identified by the organization.
• Safeguards: Personal information must be protected by security safeguards appropriate to the sensitivity of the information to prevent loss, theft, or unauthorized access.

PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of commercial activities, regardless of their size. Some provinces, including Alberta, British Columbia, and Québec, have their own private-sector privacy laws that have been deemed "substantially similar" to PIPEDA.

5.2 Mandatory Breach Reporting and Notification

Under PIPEDA, organizations are subject to mandatory data breach reporting and notification requirements. A "breach of security safeguards" is defined as the loss of, unauthorized access to, or unauthorized disclosure of personal information. In the event of such a breach, organizations have two primary obligations:

1. Report to the Commissioner: Organizations must report any breach to the Office of the Privacy Commissioner of Canada (OPC) if it is reasonable to believe that the breach creates a "real risk of significant harm" (RROSH) to an individual.
2. Notify Individuals: Organizations must also notify affected individuals about any breach that poses a RROSH as soon as feasible.

"Significant harm" is broadly defined and includes bodily harm, humiliation, damage to reputation or relationships, financial loss, identity theft, and negative effects on a credit record. Critically, organizations are required to keep and maintain a record of all breaches of security safeguards for a minimum of two years, even those that do not meet the RROSH threshold.

5.3 Emerging Legislation and Future Compliance Demands

The Canadian regulatory environment continues to evolve, with significant pending federal legislation set to expand cybersecurity and privacy obligations for businesses across key sectors. Organizations should prepare for more stringent requirements and increased enforcement powers.

• Bill C-26 (Critical Cyber Systems Protection Act): This proposed legislation will establish a new cybersecurity framework for federally regulated operators of vital services and systems. It will impose new requirements on organizations in sectors such as telecommunications, banking, transportation, and energy, including establishing cybersecurity programs and reporting incidents. Non-compliance could result in administrative monetary penalties of up to $15 million.
• Bill C-27 (Digital Charter Implementation Act): This bill is set to overhaul Canada's federal private-sector privacy law, replacing PIPEDA with a new regime. It introduces significantly higher fines for non-compliance (up to the greater of $25 million or 5% of the organization's global revenue) and establishes new rules governing the use of artificial intelligence and automated decision-making systems.

For Canadian organizations, navigating this landscape is no longer a matter of IT security alone; it is a core function of business strategy, risk management, and corporate governance. Survival and prosperity will depend on integrating robust technical defenses with a deep understanding of geopolitical risk and an unwavering commitment to legal and compliance obligations.