Are There Iranian Sleeper Cells in Canada? What Could They Target?

A sleeper cell is a group of people who remain inactive in a target area until they are activated to carry out covert operations, usually involving espionage, terrorism, or sabotage.

Information on the topic is typically a closely guarded state secret, but publicly available material may offer insight into what a potential threat could look like, based on previous successful and foiled Iranian regime operations abroad.

There have been a number of small-scale attacks against U.S. and Jewish targets in different countries in recent days, but investigations are just beginning.

The methods used in the attacks, such as firing gunshots at the U.S. Consulate in Toronto, or detonating a small explosive device against the U.S. Embassy in Norway, do not immediately suggest actions perpetrated by highly skilled operatives.

At the same time, small attacks may still be viewed as valuable by a foreign hostile actor seeking to send a message or to generate panic and a loss of confidence in local authorities.

Ontario Premier Doug Ford suggested the potential involvement of sleeper cells after the attack against the U.S. Consulate in Toronto on the morning of March 10.

“This is just me speaking: I believe there’s sleeper cells all over the world, as we know. They’re in the U.S., they’re in Canada here, and we have to weed these people out and hold them accountable,” Ford told reporters at Queen’s Park.

The premier added he hasn’t received any information that suggests the recent shootings in the Toronto area are related. Three synagogues have been shot at this month, and a gym owned by an Iranian Canadian who advocates against the Iranian regime was shot at 17 times.

The consequences of one shooting in Austin, Texas, in early March were more grim, when a man opened fire at a bar, killing three and injuring others. The suspect was wearing clothing with an Iranian regime flag design and the words “Property of Allah,” a law enforcement official told The Associated Press.

Texas Governor Greg Abbott said after the incident that there was a possibility of Iranian sleeper cells or “lone wolves” conducting retaliatory attacks because of the Iran war.

So far, publicly reported Iranian retaliation has mostly included missile and drone strikes on neighbouring countries and attacks on ships in or near the Strait of Hormuz, through which about 20 percent of the world’s oil production transits.

This was always a play Iran was expected to run if under a major attack by the United States.

But the potential use of sleeper cells abroad, or other attack methodologies employing operatives or proxies deployed in the field, has remained a concern for security agencies.

Here’s a rundown of what is known publicly on this secretive topic.

No Official Confirmation

It is expected that authorities would not publicly confirm the presence of a sleeper cell on Canadian soil. Such information could cause public panic and also risk compromising active investigations.

The RCMP commented on the matter following the U.S. Consulate shooting in Toronto.

“I don’t have any information to provide at this time on any sleeper cells that may or may not exist in Canada,” RCMP Chief Superintendent Chris Leather, the officer in charge of Criminal Operations in Ontario, told reporters on March 10.

“Suffice to say that our CSIS counterparts and the INSETs across the country are actively investigating matters such as this, and we will continue to do so,” Leather added. INSETs, Integrated National Security Enforcement Teams, are led by the RCMP and include other security agencies.

The Epoch Times contacted the Canadian Security Intelligence Service (CSIS) to ask about the recent shootings in Toronto and the possibility of having potential sleeper cells in Canada.

CSIS says it has increased its operational efforts related to “potential Iranian state-directed and violent extremist activity” in response to the conflict in Iran. There has also been increased outreach to affected communities, it added.

Masked IRGC members stand beside rocket and artillery launchers on the back of a truck during a parade in downtown Tehran, Iran, on Jan. 10, 2025. Hossein Beris / Middle East Images / Middle East Images via AFP

“Over the last year, CSIS has worked to counter the actions of Iranian intelligence services and their proxies who have targeted individuals they perceive as threats to their regime,” the agency said. “In more than one case this involved detecting, investigating, and disrupting potentially lethal threats against individuals in Canada.”

Even though the conflict in Iran has raised tensions, CSIS said the Integrated Threat Assessment Centre (ITAC) it houses has not recommended raising the terrorism threat level, which has been set at “medium” since 2014, meaning that a violent extremist attack “remains a realistic possibility.”

Phil Gurski, a veteran counterterrorism expert who previously worked at CSIS, told The Epoch Times the threat level hasn’t been raised because there is no available information warranting a change.

“If CSIS is finding more and more stuff out, that can justify a shift in threat level,” he said in an interview. “But no intelligence that you’re seeing an increase in activity? No justification for raising the level.”

How Would It Work?

A sleeper cell typically refers to organized individuals living under the radar or under cover who have been provided a certain amount of training, have established certain plans, and have amassed certain kinetic capabilities. Living seemingly normal lives, they can be called upon at a certain time to conduct an attack.

These individuals are typically activated through some form of communication or by having previously received specific instructions to strike when a certain event occurs.

Passing on communications—whether via encrypted channels, a human courier, or mail—carries a risk of detection. It would be normal for the United States, Israel, and other countries to devote significant resources to detecting such communications.

One such communication was intercepted in recent days, according to ABC News. The media outlet said a U.S. government alert was sent to law enforcement agencies across the country.

The alert reportedly says that encoded radio transmissions believed to come from Iran were sent out shortly after the death of Iranian leader Ali Khamenei. It’s possible the transmissions could “be intended to activate or provide instructions to prepositioned sleeper assets operating outside the originating country,” the alert said.

“While the exact contents of these transmissions cannot currently be determined, the sudden appearance of a new station with international rebroadcast characteristics warrants heightened situational awareness,” the alert said. The Epoch Times has not independently reviewed the alert.

There are a number of Iranian regime officials and affiliates in Canada, but it is unclear whether they would be involved in any stage of an attack—planning, financing, scouting, or execution—since they would already be known to authorities through immigration and security screening.

The Canada Border Services Agency (CBSA) told The Epoch Times this week it has conducted 17,800 reviews of applications for potential inadmissibility to Canada due to links to the Iranian regime. Regime officials have been deemed inadmissible since 2022, and Iran’s Islamic Revolutionary Guards Corps (IRGC) was listed as a terrorist entity in 2024. The IRGC’s foreign operating arm, the Qods Force, was listed as a terrorist entity in 2012.

Only one regime official has been removed from Canada by the CBSA out of multiple cases, leading the Conservatives to say the government isn’t acting fast enough.

Public Safety Minister Gary Anandasangaree defended his department’s work on the matter this week, saying the CBSA is working “expeditiously” to remove individuals linked to the Iranian regime. Prime Minister Mark Carney also said in the House of Commons on March 11 that the government has prevented 10,000 IRGC officers from entering the country.

It is unclear whether the Iranian regime would risk employing individuals with obvious official ties to conduct clandestine work. What is more clear is that any foreign operation would likely be under the operational direction of the Qods Force or Iran’s spy service, the Ministry of Intelligence and Security (MOIS).

From the information provided by CSIS, it can be inferred that either or both of these two organizations are running operations in Canada. Their focus, however, has been geared toward silencing dissidents rather than attacking other targets. It is unknown whether the strategy has changed in recent days.

Iranian Proxies

The Iranian regime has been leveraging non-Iranians and criminal groups in order to evade detection when planning and conducting attacks abroad.

This week in New York, Pakistani national Asif Merchant was found guilty of plotting to assassinate U.S. politicians in 2024, including President Donald Trump. U.S. authorities said Merchant was a trained operative of the IRGC, who had been sent to the United States to retaliate against Trump for killing Qods Force commander Qasim Soleimani in 2020.

Some Canadian citizens have also allegedly been used in plots to assassinate targets of Iran in the United States. The U.S. Department of Justice indicted Damion Ryan and Adam Pearson in 2024, saying they had been recruited by Iran-based Naji Sharifi Zindashti. The allegations haven’t been proven in court.

CSIS in its latest annual report says Sharifi Zindashti is an Iranian-Turkish narcotics trafficker who has led a network targeting Iranian dissidents abroad through murder and kidnapping at the behest of the Iranian MOIS.

“CSIS assesses that Iran will continue to use proxies, such as individuals involved with transnational organized crime networks, when it targets perceived enemies living in foreign countries, including Canada,” the agency says.

Defence Minister David McGuinty said something similar last week when commenting on the attack against Iran. “We know the extent of the involvement of the Iranian regime in, for example, organized criminal syndicates,” he said on March 3.

There are publicly known direct impacts of Iranian plotting in Canada. Former Justice Minister Irwin Cotler, an outspoken critic of the Iranian regime, had been living under 24-hour police protection when it was reported in 2024 that a plot to assassinate him had been foiled.

While there are currently no known links to the Iranian regime, the B.C. RCMP has launched a homicide investigation in recent weeks into the disappearance of Masood Masjood, a mathematician who previously worked in academia and who had been critical of the regime.

Potential Targets

While Tehran is interested in targeting dissidents and critics in times of peace, today’s situation in which the regime lost multiple officials at the very top and a large chunk of its defence capacity likely puts transnational repression lower down the list of priorities.

In its current defensive posture, Iran is seeking to raise the cost of the war on the United States, Israel, and other countries siding with the offensive. The regime is also potentially inclined to pursue retaliatory actions to avenge Khamenei and others, but those efforts would likely take time to put in motion.

A strategy that could be pursued abroad by Iran is the targeting of various hard targets, such as U.S. and Israeli official installations, or softer targets such as diplomats or areas frequented by U.S. and Israeli personnel, or even tourists.

The amount of preparation needed would presumably depend on the complexity of the attack, the requirement of having pre-established local networks, and the ease to access and operate in the targeted country.

In 2012, attacks that Israel attributed to Iran targeted Israeli diplomats in India and Georgia. A bomb in New Delhi was placed on a car carrying diplomats and injured four, while a bomb in the Georgian capital of Tbilissi that was placed underneath a car was defused.

Around the same time, Iranians plotting an attack in Bangkok against Israeli interests were injured by their own explosive devices, one of which detonated in the house they were occupying. One of the operatives had his legs blown off by the bomb he attempted to throw at police, who were attending the scene. Two of the men were jailed in Thailand following the incident.

“There’s a reason why they’re labelled as one of the top state sponsors of terrorism,” Gurski said of the Iranian regime. “Because even if they’re not the most competent, they do have people, [including] proxy actors.”

Some Iranian proxy terrorist groups have also operated extensively abroad, including by using Canadian citizens who can travel more freely and draw less suspicion.

Canadian citizen Hassan El Hajj Hassan was convicted in abstentia in 2020 for the murder of five Israeli citizens in a bomb attack on a tourist bus in Burgas, Bulgaria, in 2012. The plot had been executed by Iranian proxy Lebanese Hezbollah.

Canadian citizen Hussein Bassam Abdallah was sentenced to six years in jail by a Cyprus court in 2015 for storing in the country nine tons of ammonium nitrate, an explosives precursor, for Hezbollah. Abdallah had previously lived in Windsor, Ont.