The Canadian Threat Landscape: What the Cyber Centre Is Warning

The Canadian Centre for Cyber Security (the Cyber Centre, part of the Communications Security Establishment) publishes the National Cyber Threat Assessment. The most recent edition, NCTA 2025-2026, was released on 30 October 2024 using information available as of 20 September 2024. The judgments below are paraphrased from the Cyber Centre’s release and summaries; organisations should confirm the exact key-judgment language and the Centre’s probability lexicon against the primary document. A companion “Ransomware Threat Outlook 2025-2027” provides deeper ransomware analysis.

Key Judgments

• Cybercrime is assessed as a persistent, widespread and disruptive threat to Canada, with the cybercrime-as-a-service model almost certainly sustaining its resilience.
• Ransomware is assessed as the top cybercrime threat to Canada’s critical infrastructure — a precise framing specific to cybercrime against critical infrastructure, not a blanket “number-one threat to all Canadian organisations.”
• State-sponsored and financially motivated threats are increasingly likely to affect Canadians, and foreign actors are assessed as moving beyond espionage toward more disruptive activity.
• State actors are assessed as almost certainly willing to combine disruptive computer-network attacks with online information and influence campaigns to intimidate and shape opinion.

State Adversaries

• China (PRC): assessed as the most sophisticated and active state cyber threat to Canada — espionage, intellectual-property theft and surveillance for strategic and economic advantage. (Allied reporting on Volt Typhoon pre-positioning and Salt Typhoon telecom espionage, which named Canada among affected nations, is corroborating context rather than direct NCTA quotation.)
• Russia: assessed as a threat aligned to its foreign-policy and strategic interests, with pro-Russia hacktivism part of the broader picture.
• Iran and North Korea: persistent state threats; precise Canada-specific wording for each should be confirmed against the assessment. North Korea’s documented global focus is revenue generation (crypto theft and fraudulent IT workers).

Critical Infrastructure

The Cyber Centre assesses critical infrastructure as targeted both for espionage and, increasingly, for pre-positioning and disruptive potential by state actors — consistent with allied findings on long-dwell access to operational networks.

What Canadian Organisations Should Do

• Treat ransomware as a primary resilience risk: offline and immutable backups, tested recovery and network segmentation.
• Prioritise OT and critical-infrastructure monitoring and IT/OT separation given pre-positioning concerns.
• Deploy phishing-resistant MFA and patch internet-facing and edge systems rapidly; vet supply-chain and managed-service dependencies, since cybercrime-as-a-service lowers the attacker barrier.
• Prepare for hybrid disruptive-plus-influence operations, and report incidents to and consume alerts from the Cyber Centre and sector ISACs.