Canadian Spy Agency Conducts Offensive Cyber Operations Against Criminal Groups
Canada's Communications Security Establishment (CSE) executed state-authorized cyberattacks against ransomware gangs, drug traffickers, and extremist organizations in 2025.
Canada's Communications Security Establishment (CSE), the nation's equivalent of the NSA, has revealed the execution of offensive cyber operations against three distinct foreign criminal groups throughout 2025. These "active cyber operations" were authorized by the state and targeted entities posing a threat to Canadian interests, according to a report released by the agency.
One of the operations focused on disrupting an unspecified foreign extremist group that was actively spreading violent ideology and attempting to recruit members in Western countries, including Canada. The CSE reported that its actions successfully undermined the group's credibility and significantly limited its capacity for radicalization and recruitment.
In a separate operation, the CSE targeted cybercriminals operating overseas who were involved in supplying chemicals essential for the production of fentanyl. This powerful synthetic opioid has been responsible for tens of thousands of deaths annually across North America. The agency stated that its cyber intervention successfully disrupted and diminished the operations of these drug traffickers.
A third offensive cyber operation was directed at an unspecified ransomware-as-a-service (RaaS) gang. By utilizing signals intelligence, the CSE mapped the internal workings of the RaaS operation. The subsequent hack rendered the group's infrastructure inoperable and resulted in the deletion of a substantial volume of stolen data that was being offered for sale on the dark web, thereby disrupting the malware users' ability to extort victims.
Beyond these specific operations, the CSE also reported carrying out "authorized technical disruptions" against a total of 10 major ransomware gangs during the past year. The objective of these disruptions was to render significant portions of their infrastructure unusable, aiming to curb their malicious activities.
These revelations underscore the growing role of state-sponsored offensive cyber capabilities in combating transnational criminal activities. By leveraging advanced technical means, intelligence agencies like the CSE are actively engaging with and dismantling illicit networks that pose threats ranging from violent extremism and drug trafficking to financial extortion through ransomware.
The CSE's report highlights a proactive approach to national security in the digital age, demonstrating a commitment to disrupting criminal enterprises before they can inflict significant harm on Canadian citizens and interests. The agency's actions serve as a stark reminder of the evolving landscape of cyber warfare and law enforcement.
While the report does not name the specific groups targeted or detail the exact methods used in each operation, it provides a clear indication of the CSE's expanded mandate and capabilities in conducting offensive cyber actions against foreign threats.