Canada's cyber threat landscape: ransomware, state actors and AI top the national assessment

Cybersecurity has become one of the defining concerns for governments, businesses and ordinary citizens alike, and Canada is no exception. According to the Canadian Centre for Cyber Security, the National Cyber Threat Assessment 2025-2026 sets out a detailed picture of the risks facing the country, drawing on both public reporting and classified intelligence to map the current landscape and forecast how threats are likely to evolve.

A national picture of the threat

The assessment is designed to help Canadians understand where the dangers lie. According to the Canadian Centre for Cyber Security, the report is built around a set of key judgements that cover cybercrime, state sponsored activity and emerging technologies, offering a framework for individuals and organisations to grasp how the threat environment is shifting and what it could mean for them.

Ransomware tops the list

Among all the threats identified, one stands out as especially serious. According to the Canadian Centre for Cyber Security, ransomware is the top cybercrime threat facing Canada's critical infrastructure, and threat actors are expected to escalate their extortion tactics through 2026, putting pressure on the essential services that Canadians rely on every day.

The numbers behind ransomware help explain the concern. According to the Canadian Centre for Cyber Security, global ransomware incidents rose sharply in recent years, average ransom payments in Canada climbed to more than one million Canadian dollars, and the number of Canadian incidents has been growing at a rate of roughly a quarter each year, underlining how quickly the problem has expanded.

Cybercrime as a business

Part of what makes cybercrime so resilient is how it has become organised. According to the Canadian Centre for Cyber Security, the cybercrime as a service model is almost certainly contributing to the continued strength of the criminal ecosystem, by lowering the barriers to entry and allowing even less skilled actors to launch damaging attacks using tools and services bought from others.

A handful of criminal groups have become especially prominent. According to the Canadian Centre for Cyber Security, some of the most active ransomware operations, including those known as LockBit, ALPHV, CL0P, PLAY and Black Basta, operate primarily on ransomware as a service models, renting out their capabilities to affiliates who then carry out attacks against victims.

Financial fraud has also continued to climb alongside ransomware. According to the Canadian Centre for Cyber Security, reported fraud losses in Canada rose year after year, reflecting a broad and persistent problem that affects individuals and businesses of all sizes, and reinforcing the sense that cybercrime has become a lucrative and enduring industry.

State sponsored actors grow bolder

Beyond criminals motivated by money, the assessment highlights the role of nation states. According to the Canadian Centre for Cyber Security, the People's Republic of China presents the most sophisticated and active state cyber threat to Canada, engaging in espionage, intellectual property theft, malign influence and transnational repression, and reportedly compromising numerous networks associated with Government of Canada agencies over several years.

Other states feature prominently as well. According to the Canadian Centre for Cyber Security, Russia leverages cyber operations to confront and destabilise Canada and its allies through a mix of espionage and disinformation, while Iran is increasingly conducting disruptive cyber attacks beyond the Middle East and persistently monitoring those it regards as opponents of its regime.

A common thread runs through the behaviour of these state actors. According to the Canadian Centre for Cyber Security, state sponsored threat actors are almost certainly combining disruptive computer network attacks with online information campaigns, using the two together to intimidate populations and shape public opinion, a tactic that blurs the line between technical attacks and influence operations.

AI changes the game

New technology is also reshaping how attacks are carried out. According to the Canadian Centre for Cyber Security, both cybercriminals and state actors are turning to artificial intelligence to craft more convincing and personalised phishing messages, generate deepfakes and automate parts of their operations, developments that could make scams harder to detect and defend against for everyday users.

What it means for Canadians

Taken as a whole, the assessment paints a picture of a threat environment that is growing more complex and more aggressive. According to the Canadian Centre for Cyber Security, the combination of resilient cybercrime, emboldened state actors and rapidly advancing technology means that awareness and preparation are more important than ever, both for organisations responsible for critical services and for individuals seeking to protect their own data.