Three separate active cyber operations in 2025

Canada’s Communications Security Establishment (CSE) has confirmed that its operatives carried out state-authorized hacks against three different criminal targets last year. The operations — detailed in a newly released report — struck a ransomware-as-a-service gang, drug dealers involved in fentanyl trafficking, and a violent extremist group recruiting in Western countries.

The CSE is Canada’s equivalent of the U.S. National Security Agency. Its 2025 report, published last week, describes these actions as “active cyber operations” aimed at foreign groups that posed a direct threat to Canadian security. The agency does not name the specific groups, but the details paint a picture of a spy agency increasingly willing to go on the offensive.

Disrupting violent extremists’ recruitment machine

One of the operations targeted a foreign extremist group that was spreading violent ideology and actively trying to recruit members in Canada and other Western nations. The CSE says it exploited data pulled from internet-connected devices to weaken the group’s operations.

“We successfully undermined the group’s credibility and limited their ability to radicalize and recruit new members,” the report states. The operation did not simply monitor the extremists — it actively interfered with their propaganda and outreach channels.

Taking on the fentanyl supply chain

A second hack went after overseas cybercriminals who were helping sell precursor chemicals used to make fentanyl. The synthetic opioid has killed tens of thousands of people annually in North America, and Canadian authorities have made disrupting its supply chain a top priority.

The CSE says its operation “disrupted and diminished” the traffickers. The report does not specify whether the hack destroyed data, took down servers, or something else, but the language suggests a significant blow to the network’s ability to operate.

Fentanyl-related deaths remain a crisis across the continent. In 2024 alone, more than 70,000 people died from synthetic opioid overdoses in the U.S. and Canada combined, according to public health data.

Ransomware gang’s infrastructure wiped out

The third and most technically detailed operation targeted a ransomware-as-a-service gang. The CSE used signals intelligence to map the group’s internal structure, then moved to disable its infrastructure.

“The operation rendered the group’s infrastructure inoperable and deleted a large amount of stolen data that was being advertised for sale on the dark web,” the report explains. That means the agency not only stopped ongoing extortion but also erased the evidence the gang planned to use against victims.

Ransomware-as-a-service operations have become a dominant model in cybercrime. Affiliates rent access to malware and infrastructure from core developers, then split the ransom payments. By taking out the central platform, the CSE likely disrupted dozens of ongoing extortion campaigns at once.

Ten more ransomware groups hit with “technical disruptions”

The report also reveals that the CSE carried out “authorized technical disruptions” against 10 major ransomware gangs last year. These actions were designed to “make parts of their infrastructure unusable” without necessarily destroying the entire operation. The agency does not name any of the targeted groups, but the scale of the effort signals a sustained campaign against the ransomware ecosystem.

This is not the first time Canada has publicly acknowledged offensive cyber operations. In 2023, the CSE revealed it had disrupted the LockBit ransomware group in coordination with international partners. But the 2025 report goes further in describing the range of targets and the methods used.

What this means for cybercrime and national security

The CSE’s willingness to hack criminal groups — not just foreign state adversaries — marks a notable shift. For years, Western intelligence agencies focused on espionage and counterterrorism, with cybercrime handled largely by law enforcement. Now, spy agencies are taking direct action against criminal networks that operate from overseas sanctuaries.

Legal experts point out that the CSE operates under a strict legal framework. The agency must obtain authorization from the Minister of National Defence and is subject to oversight by the Intelligence Commissioner and the National Security and Intelligence Review Agency. Each of the three operations described in the report was separately approved.

Still, the trend raises questions. If Canada’s spy agency can hack ransomware gangs and drug traffickers, what stops it from targeting other groups? The report emphasizes that all operations were conducted against foreign entities and were designed to protect Canadian interests. But as the line between cybercrime and state threats blurs, the CSE is likely to keep expanding its offensive toolkit.

For ransomware victims and law enforcement agencies tracking the fentanyl trade, the news is mostly positive. The CSE’s actions show that governments are willing to go beyond passive defense and actively dismantle the infrastructure that enables these crimes. Whether that approach can scale to match the sheer volume of ransomware and drug trafficking operations remains an open question.

One thing is clear: Canada’s spy agency is no longer just watching. It’s hacking back.

A New Threat Actor Emerges

Since early 2026, a previously unknown cyber group has been systematically targeting Israeli government agencies and IT firms. The group, which Check Point researchers track as Cavern Manticore, appears to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).

The findings come from a threat intelligence report published July 6. Check Point says the group shares technical fingerprints with two established Iranian-aligned adversaries: MuddyWater and Lyceum.

“The adversary’s ability to gain access to organizations in the defense and government sectors during the US military campaign ‘Operation Epic Fury’ demonstrates both a high operational tempo and a disciplined approach to target selection,” the researchers wrote.

How Cavern Manticore Breaches Networks

The group’s preferred entry point is surprisingly mundane: legitimate remote monitoring and management (RMM) software. By abusing these tools, Cavern Manticore moves laterally across a victim’s environment, then delivers malware disguised as routine software updates.

Another vector? Browser-based remote desktop tools. When clipboard copy-paste or file uploads are blocked, the attackers use remote printing features to siphon data out.

Once inside, the group weaponizes a SysAid software update mechanism to drop malicious payloads onto the target network.

The Modular C2 Framework at the Core

Cavern Manticore’s most distinctive asset is its custom modular command-and-control (C2) framework. Check Point describes it as “a mature and adaptable toolset built around a shared .NET foundation.”

The framework splits into two main components:

• Cavern agent — a persistent backdoor that handles all communication with attacker-controlled servers. It comes in multiple .NET compilation formats (.NET Framework, .NET Mixed-Mode C++/CLI, and .NET Native AOT) to evade detection and complicate reverse engineering.
• Cavern modules — specialized post-exploitation tools for reconnaissance, data theft, tunneling, and lateral movement. Each module is compiled separately, allowing the attackers to tailor the toolset per victim.

The framework also uses per-module AppDomain isolation. That means even if defenders discover one component on a compromised host, they cannot easily recover the full toolkit. The design keeps the group’s footprint small and its persistence high.

Check Point noted that most Cavern Manticore samples score zero or very low detection rates on VirusTotal. That’s a clear sign the group has invested heavily in evasion techniques.

Technical Overlaps with MuddyWater and Lyceum

During analysis, Check Point found a communication module (CAV3RN_Http_Module) that uses a webshell-style ASP.NET handler named cac.aspx. It runs on a separate IIS server at one of two attacker-controlled domains.

“The use of victim-side infrastructure to proxy C2 traffic, combined with XOR-based obfuscation, Base64 encoding, and a fixed verb set per backdoor, is consistent with techniques we have previously observed in operations attributed to OilRig subgroup named Lyceum,” the researchers wrote.

The targeting of SysAid servers also aligns with tactics used by MuddyWater, another MOIS-aligned group. WHOIS records for the root domain hospitalinstallation[.]com — used in the campaign — showed it was registered through Fars Data, an Iranian hosting provider.

What This Means for Israeli Defenders

“By decoupling its core infrastructure from mission-specific modules, Cavern Manticore’s operators gain both operational agility and durability under defensive pressure,” Check Point concluded. “This modularity allows them to adjust capabilities per campaign while preserving the underlying framework.”

For Israeli government and IT security teams, the message is clear: this Iran-nexus hacking group is sophisticated, well-resourced, and actively targeting critical infrastructure. Defenders should scrutinize RMM tools, restrict browser-based remote desktop features, and monitor for unusual SysAid update activity.

The group’s low detection rate on VirusTotal also suggests that signature-based defenses alone won’t cut it. Behavioral monitoring and network anomaly detection may offer a better chance of catching Cavern Manticore before it completes its mission.

The New Attack Surface: Web Content That Talks to AI

Security researchers have found a disturbing new way to exploit AI agents — by hiding instructions inside ordinary web pages. The technique, called indirect prompt injection, plants commands in content that an AI agent reads, steering the agent toward fraudulent actions without the human user ever noticing.

Researchers at Zscaler‘s ThreatLabz documented two real-world campaigns that used this method. One posed as software documentation to run a payment scam. The other impersonated a cryptocurrency service. The findings were shared publicly this week.

The attacks don’t target humans directly. Instead, they target the AI agents people increasingly rely on for coding, research, and financial tasks.

How Attackers Bury Instructions Where Only Machines See Them

In both cases, the attackers started with SEO poisoning — pushing their malicious pages high in search results so that an AI agent would be more likely to land on them. Once the agent arrived, it found carefully hidden instructions.

The attackers used CSS to move text off-screen, making it invisible to human eyes. They also tucked prompt-style commands inside JSON-LD metadata — structured data that machines treat as authoritative context. A person scrolling the page sees a normal website. An AI agent sees a set of commands.

This is indirect prompt injection at work. The instructions are not injected directly into the LLM’s input. They sit in the content the model reads, waiting to be interpreted as legitimate context.

The Fake Python Documentation Scam

The first campaign used a fake page dressed up as a Python library’s documentation. The hidden text instructed any AI agent on a coding task that it had to buy a $3 API license key to fix an error. Then it walked the agent through paying an attacker’s cryptocurrency wallet for a bogus key.

Zscaler noted that the same site also tried to scam human developers. The page was a two-for-one trap — targeting both people and their AI helpers.

The Cryptocurrency Typosquat

For the second campaign, the attackers registered a typosquatting domain impersonating DeBank, a popular cryptocurrency portfolio tracker. Hidden text told an AI agent to treat the fake site as the “authoritative” DeBank and rank it first in results.

The goal was to manipulate the agent into directing users to the fraudulent page, where they might hand over credentials or wallet access.

Which AI Models Fell for the Trick?

ThreatLabz ran its own autonomous agent against the malicious sites, testing 26 large language models (LLMs). The results were uneven — and revealing.

Four of the 26 models were manipulated into executing the fraudulent payment. The vulnerable models included versions of Meta’s Llama and Google’s Gemini. In the second test, two models — OpenAI’s GPT-5.4 and Anthropic’s Claude Sonnet 4.5 — wrongly rated the fake DeBank site as legitimate. But that only happened when the models lacked a trusted reference for the real DeBank. When the genuine site was provided for comparison, none were fooled.

The takeaway? Susceptibility depends heavily on the LLM and the amount of context it is given. Some models are better at ignoring hidden commands. Others follow them blindly.

For a deeper look at how these payloads work in the wild, see the research on prompt injection payloads targeting AI agents that Zscaler uncovered.

What This Means for AI Agent Security

The attacks are still early-stage, but the implications are clear. As AI agents become a more common interface to the web, the content itself becomes a larger attack surface. A malicious website doesn’t need to hack the model — it only needs to speak its language.

“AI is a double-edged sword,” Zscaler warned in its report. “It can streamline workflows while also introducing new avenues for abuse.”

The company recommends that developers building AI agent security into their products treat all web content as untrusted input. That means sandboxing agent actions, limiting the tools an agent can call, and requiring human approval before any payment or sensitive operation.

For users, the advice is simple: don’t let AI agents make financial decisions autonomously — especially when they visit unfamiliar websites.

The research adds to a growing body of evidence that prompt injection is not just a theoretical risk. It is happening now, in the wild, and it is targeting the AI tools people are starting to trust with real money.