Canadian spy agency reports hacking three criminal groups in 2025

Canada's Communications Security Establishment (CSE), the nation's equivalent of the NSA, conducted state-sanctioned cyber operations against three distinct criminal organizations in 2025. These operations targeted a ransomware gang, drug traffickers, and violent extremists operating outside of Canada but posing a threat to the country. The details of these "active cyber operations" were disclosed in a report released by the CSE.

One of the cyber operations focused on a foreign extremist group that was actively recruiting and spreading its ideology in Western nations, including Canada. By leveraging data obtained from internet-connected devices, the CSE was able to disrupt the group's activities. The report states that the agency successfully diminished the group's credibility and hampered its capacity for radicalization and recruitment.

In a separate operation, the CSE targeted overseas cybercriminals involved in the trafficking of chemicals used in the production of fentanyl. This powerful opioid has been responsible for a significant number of deaths annually across North America. The agency reported that its cyber intervention disrupted and reduced the capabilities of these traffickers.

A third operation utilized signals intelligence to gain insight into the internal operations of an unspecified ransomware-as-a-service gang. This intelligence was used to disrupt the ability of the malware's users to extort victims. The CSE's actions rendered the group's infrastructure inoperable and resulted in the deletion of a substantial volume of stolen data that was being offered for sale on the dark web.

Beyond these three specific operations, the CSE also reported undertaking "authorized technical disruptions" against ten major ransomware gangs during the past year. The objective of these broader actions was to render portions of the gangs' infrastructure unusable, thereby hindering their criminal activities.