Three separate active cyber operations in 2025
Canada’s Communications Security Establishment (CSE) has confirmed that its operatives carried out state-authorized hacks against three different criminal targets last year. The operations — detailed in a newly released report — struck a ransomware-as-a-service gang, drug dealers involved in fentanyl trafficking, and a violent extremist group recruiting in Western countries.
The CSE is Canada’s equivalent of the U.S. National Security Agency. Its 2025 report, published last week, describes these actions as “active cyber operations” aimed at foreign groups that posed a direct threat to Canadian security. The agency does not name the specific groups, but the details paint a picture of a spy agency increasingly willing to go on the offensive.
Disrupting violent extremists’ recruitment machine
One of the operations targeted a foreign extremist group that was spreading violent ideology and actively trying to recruit members in Canada and other Western nations. The CSE says it exploited data pulled from internet-connected devices to weaken the group’s operations.
“We successfully undermined the group’s credibility and limited their ability to radicalize and recruit new members,” the report states. The operation did not simply monitor the extremists — it actively interfered with their propaganda and outreach channels.
Taking on the fentanyl supply chain
A second hack went after overseas cybercriminals who were helping sell precursor chemicals used to make fentanyl. The synthetic opioid has killed tens of thousands of people annually in North America, and Canadian authorities have made disrupting its supply chain a top priority.
The CSE says its operation “disrupted and diminished” the traffickers. The report does not specify whether the hack destroyed data, took down servers, or something else, but the language suggests a significant blow to the network’s ability to operate.
Fentanyl-related deaths remain a crisis across the continent. In 2024 alone, more than 70,000 people died from synthetic opioid overdoses in the U.S. and Canada combined, according to public health data.
Ransomware gang’s infrastructure wiped out
The third and most technically detailed operation targeted a ransomware-as-a-service gang. The CSE used signals intelligence to map the group’s internal structure, then moved to disable its infrastructure.
“The operation rendered the group’s infrastructure inoperable and deleted a large amount of stolen data that was being advertised for sale on the dark web,” the report explains. That means the agency not only stopped ongoing extortion but also erased the evidence the gang planned to use against victims.
Ransomware-as-a-service operations have become a dominant model in cybercrime. Affiliates rent access to malware and infrastructure from core developers, then split the ransom payments. By taking out the central platform, the CSE likely disrupted dozens of ongoing extortion campaigns at once.
Ten more ransomware groups hit with “technical disruptions”
The report also reveals that the CSE carried out “authorized technical disruptions” against 10 major ransomware gangs last year. These actions were designed to “make parts of their infrastructure unusable” without necessarily destroying the entire operation. The agency does not name any of the targeted groups, but the scale of the effort signals a sustained campaign against the ransomware ecosystem.
This is not the first time Canada has publicly acknowledged offensive cyber operations. In 2023, the CSE revealed it had disrupted the LockBit ransomware group in coordination with international partners. But the 2025 report goes further in describing the range of targets and the methods used.
What this means for cybercrime and national security
The CSE’s willingness to hack criminal groups — not just foreign state adversaries — marks a notable shift. For years, Western intelligence agencies focused on espionage and counterterrorism, with cybercrime handled largely by law enforcement. Now, spy agencies are taking direct action against criminal networks that operate from overseas sanctuaries.
Legal experts point out that the CSE operates under a strict legal framework. The agency must obtain authorization from the Minister of National Defence and is subject to oversight by the Intelligence Commissioner and the National Security and Intelligence Review Agency. Each of the three operations described in the report was separately approved.
Still, the trend raises questions. If Canada’s spy agency can hack ransomware gangs and drug traffickers, what stops it from targeting other groups? The report emphasizes that all operations were conducted against foreign entities and were designed to protect Canadian interests. But as the line between cybercrime and state threats blurs, the CSE is likely to keep expanding its offensive toolkit.
For ransomware victims and law enforcement agencies tracking the fentanyl trade, the news is mostly positive. The CSE’s actions show that governments are willing to go beyond passive defense and actively dismantle the infrastructure that enables these crimes. Whether that approach can scale to match the sheer volume of ransomware and drug trafficking operations remains an open question.
One thing is clear: Canada’s spy agency is no longer just watching. It’s hacking back.
