Providing a uncommon glimpse on the priorities of a prime spy group, Canada’s Communications Safety Institution (CSE) stated it performed a handful of state-authorized hacks final 12 months with a purpose to disrupt the operations of drug traffickers, violent extremists, and a ransomware gang.
The disclosures within the Canadian intelligence agency’s annual report underscore a few of the major nationwide safety threats that face Canada and its closest allies: starting from the import of unlawful medicine to cyberattacks. The spy company, CSE, is tasked with gathering international intelligence, defending authorities programs, and disrupting on-line adversaries.
Printed final week, the report says the CSE final 12 months carried out three international “energetic cyber operations” — the time period the company makes use of to explain its cyberattacks on abroad operations that threaten Canadian nationwide safety and public security.
One of many operations, per the report, focused cybercriminals outdoors of Canada who had been brokering the sale of chemical compounds used to create the artificial opioid fentanyl. The CSE collected intelligence on the brokers, then performed an operation that “disrupted and diminished their capability to function,” the report stated.
One other energetic operation concerned the gathering of alerts intelligence — information produced from electronics and internet-connected units — on an abroad extremist group that was spreading violent ideology and recruiting members, together with in Canada.
The report stated the company analyzed the group’s group, attain, and potential vulnerabilities to conduct an operation that “efficiently undermined the group’s credibility and restricted their capability to radicalize and recruit new members.”
One other operation concerned disrupting a ransomware-as-a-service operation that permit hackers hire entry to a ransomware gang’s infrastructure to launch damaging extortion assaults. The CSE stated its alerts intelligence unit recognized how the gang labored in opposition to the healthcare, transportation, and enterprise sectors in Canada, then used an energetic cyber operation that “rendered the group’s infrastructure inoperable.” The operation additionally deleted a lot of the information on the gang’s servers.
The company stated it undertook concurrent “technical disruptions” in opposition to 10 of probably the most vital ransomware gangs concentrating on Canada to “make components of their infrastructure unusable.”
The report didn’t say the place the hackers, extremists, or the ransomware gang had been situated, or the specifics of the operations that the CSE used to focus on them. It’s not unusual for spy businesses to conduct cyberattacks in opposition to their adversaries, however such operations are seldom disclosed or detailed to guard the strategies and methods used.
Fort Meade, Maryland-based Cyber Command, which conducts cyber operations for the U.S. authorities, repeatedly carries out “hunt ahead” operations that contain sending cyber groups to allied nations to safe their networks and disrupt cyber operations launched by adversaries. The variety of U.S.-led hunt-forward operations have risen from a couple of handful throughout 2018 to more than two dozen during 2025.
Canada’s CSE stated it additionally carried out one defensive cyber operation in the course of the 12 months to focus on a phishing marketing campaign geared toward Canadian federal authorities establishments and different vital programs. The company stated it disrupted the group’s infrastructure and “degraded their capability” to focus on Canadians.
If you buy by way of hyperlinks in our articles, we could earn a small fee. This doesn’t have an effect on our editorial independence.
