Canada’s CSE details foreign cyber operations against criminal groups

The Communications Security Establishment (the Canadian intelligence agency), or CSE, released its annual report last week detailing three foreign active cyber operations (the CSE term for cyberattacks on overseas operations) conducted last year. According to the report, these operations targeted drug traffickers, violent extremists, and a ransomware gang to disrupt their infrastructure and protect Canadian national security. In addition to these offensive actions, the CSE carried out one defensive cyber operation during the year to target a phishing campaign aimed at Canadian federal government institutions and other important systems, disrupting the group’s infrastructure.

According to the Communications Security Establishment annual report, the agency used its foreign cyber capabilities to execute three distinct operations:

• Targeting drug traffickers: CSE targeted cybercriminals outside of Canada who were brokering the sale of chemicals used to create the synthetic opioid fentanyl. The agency collected intelligence on the brokers and disrupted their operations, reducing their capacity to operate.
• Countering violent extremists: The agency collected signals intelligence on an overseas extremist group that was spreading violent ideology and recruiting members, including in Canada. CSE analyzed the group’s organization and vulnerabilities to successfully undermine its credibility and limit its recruitment.
• Dismantling a ransomware gang: CSE targeted a ransomware-as-a-service operation that allowed hackers to rent infrastructure to launch extortion attacks against Canada’s healthcare, transportation, and business sectors. The agency identified how the gang operated and launched an active cyber operation that, according to the Canadian intelligence agency, “rendered the group’s infrastructure inoperable” while deleting data on the gang’s servers.

Additionally, the agency undertook concurrent technical disruptions against 10 of the most significant ransomware gangs targeting Canada to make parts of their infrastructure unusable.

The disclosures offer a rare look at how Canada uses offensive cyber capabilities, contrasting with the approach of Cyber Command (the U.S. military command for cyberspace operations) based in Fort Meade, Maryland. Cyber Command regularly conducts hunt forward (U.S. operations to secure allied networks) operations to secure networks and disrupt adversary actions. The number of these U.S. hunt-forward operations has grown from a few handful during 2018 to more than two dozen during 2025.

Why it matters

The report provides a rare look at the operational priorities of Canada’s Communications Security Establishment, detailing how the agency uses cyber operations to counter threats ranging from fentanyl trafficking to ransomware.