Dozen Toronto attacks linked to Iranian funding

A dozen politically motivated shootings in Toronto appear to have been financed by the Iranian government, according to a CBC News investigation. The attacks targeted synagogues, a school, businesses in the Greater Toronto Area, and the U.S. Consulate in downtown Toronto. No one was injured in any of the incidents.

Most of the shootings occurred in the hours or days following the United States and Israel beginning to bomb Iran on Feb. 28, 2026. That same period saw the assassination of Iranian Supreme Leader Ayatollah Ali Khamenei. The attacks followed a consistent pattern: suspects arrived in stolen vehicles in the early morning and fired handguns into building entrances. In several cases, they or accomplices filmed the actions on a phone.

Toronto Police, the RCMP, and the Canadian Security Intelligence Service are investigating whether a foreign power instigated the violence. While some alleged triggermen have been arrested and charged, identifying the paymasters has proven difficult. Chief Superintendent Joe Matthews, who oversees the Toronto Police Service investigation, noted that the gun-for-hire model creates layers of separation between the client and the criminal. He stated that police do not think there is a very direct connection between the financier and the perpetrator on the street.

CBC News spent weeks reviewing court files and building profiles of the accused. Most suspects face charges for multiple attacks. The group is young, with members ranging in age from 15 to their early 20s. The investigation revealed a pattern of shootings concentrated in the same areas over the same nights. Synagogues and Jewish-owned businesses were hit shortly before or after attacks on addresses associated with waste management company Green For Life.

Toronto Police confirmed through ballistic tests that the same firearms were used in both the geopolitical and GFL-linked attacks. Matthews explained that this indicates the same hired guns carried out both types of incidents. The link suggests a coordinated effort to strike both political and non-political targets in the same region.

The Iranian government and its intelligence service have been linked to similar plots in Germany, the Netherlands, the U.K., Australia, and the United States. In May 2026, the FBI arrested Mohammad Baqer al-Saadi, a senior member of the Harakat Ashab al-Yamin al-Islamiya militia. He faces six terrorism-related charges. The indictment alleges he helped plan at least 18 attacks in Europe and two in Canada, including the March 2026 shooting at the U.S. Consulate and an assault on an unnamed synagogue.

In June 2026, Canada joined 20 other nations in a joint statement condemning Iran's lethal plotting in Europe, North America, and Australia. The statement described the relationship between Iranian security services and local criminal groups as long-standing and deplorable. Keir Giles, a security analyst at Chatham House in London, said the Iranian-linked attacks follow a blueprint similar to what Russia has used in Europe. He noted that encrypted communication apps have made it vastly easier to recruit willing or unknowing dupes to carry out attacks at low cost.

CBC News contacted Iran’s Foreign Ministry about the alleged involvement in the Toronto attacks but did not receive a response. The Iranian government has previously dismissed claims that it sponsors violence globally. Beth Avraham Yoseph of Toronto was one of the synagogues attacked in early March 2026, with its doors and windows peppered with gunfire. Rabbi Daniel Korobkin said the congregation refuses to be intimidated. He added that it does not matter whether the person who hates Jews is pulling the trigger or paying someone else to do it, as the end result is the same.

The investigation highlights the growing use of encrypted messaging apps to enlist youth in organized crime and political violence. Police continue to analyze the data to determine the full scope of the foreign involvement. The next step in the investigation will focus on tracing the financial flows that supported the attacks.