Canadian Spy Agency Disrupted Drug Traffickers, Extremists and Ransomware Network in Cyber Operations

Canada’s Communications Security Establishment (CSE) has revealed that it carried out several government-authorised cyber operations last year targeting international drug traffickers, violent extremist groups, and a ransomware organisation, offering a rare insight into the operational priorities of one of the country’s top intelligence agencies.

The disclosures, published in the agency’s latest annual report, highlight several of the major national security challenges facing Canada and its allies, including illicit drug trafficking and increasingly sophisticated cybercrime. The CSE is responsible for gathering foreign intelligence, protecting Canadian government networks, and conducting cyber operations against online threats that affect national security and public safety.

Released last week, the report states that the agency conducted three foreign “active cyber operations” during the year, the term CSE uses to describe offensive cyber activities directed at overseas targets considered threats to Canada’s national security.

According to the report, one of those operations focused on cybercriminals located outside Canada who were facilitating the sale of chemicals used in the production of the synthetic opioid fentanyl. The CSE said it first gathered intelligence on the brokers before launching an operation that “disrupted and diminished their ability to operate.”

A second active cyber operation involved collecting signals intelligence, which includes information generated through electronic communications and internet-connected devices, on an overseas extremist organization engaged in spreading violent ideology and recruiting members, including individuals in Canada.

After analysing the group’s structure, reach, and potential weaknesses, the agency said it carried out an operation that “successfully undermined the group’s credibility and limited their ability to radicalise and recruit new members.”

The third operation targeted a ransomware-as-a-service network that enabled cybercriminals to lease access to ransomware infrastructure and launch extortion attacks against victims. According to the CSE, its signals intelligence specialists identified how the criminal organization was targeting Canada’s healthcare, transportation, and business sectors before carrying out an active cyber operation that “rendered the group’s infrastructure inoperable.” The agency also reported that much of the data stored on the group’s servers was deleted during the operation.

In addition to those activities, the CSE said it conducted simultaneous “technical disruptions” against 10 of the most significant ransomware groups that target Canadian organisations, making parts of their operational infrastructure unusable.

The report does not identify where the cybercriminals, extremist organisations, or ransomware operators were based, nor does it disclose the technical methods used during the operations. Intelligence agencies rarely reveal details of offensive cyber campaigns to protect their operational capabilities, techniques, and intelligence sources.

The report also highlights similar activities carried out by the United States. U.S. Cyber Command, headquartered at Fort Meade, Maryland, regularly conducts “hunt forward” missions in partnership with allied countries. These operations involve deploying cybersecurity teams to friendly nations to strengthen network defences and help disrupt cyber threats before they spread. According to the report, the number of U.S.-led hunt-forward operations has increased from only a handful in 2018 to more than two dozen by 2025.

Alongside its offensive activities, Canada’s Communications Security Establishment said it also completed one defensive cyber operation during the year. That mission targeted a phishing campaign directed at Canadian federal government institutions and other critical systems. According to the agency, it successfully disrupted the attackers’ infrastructure and “degraded their ability” to continue targeting Canadian organisations and government entities.