Allied Intelligence — 2026-07-06

Canadian Spy Agency Discloses Offensive Cyber Operations Against Drug Traffickers, Extremists, and Ransomware Gang

BLUFOttawa's decision to publicize effects against criminal networks elevates transnational crime to parity with state threats in Canadian offensive cyber doctrine and pressures allies toward similar disclosure.

Canada's Communications Security Establishment disclosed in its 2025-2026 annual report that it conducted three foreign "active cyber operations" last year, targeting overseas cybercriminals brokering fentanyl-precursor chemical sales, an unnamed extremist group recruiting members including in Canada, and a ransomware-as-a-service operation affecting Canada's healthcare, transportation, and business sectors 12. CSE said the fentanyl-related operation "disrupted and diminished" the brokers' ability to operate, the extremist-targeting operation "undermined the group's credibility" and limited recruitment, and the ransomware operation "rendered the group's infrastructure inoperable" while deleting much of the data on its servers 1. The agency also reported concurrent "technical disruptions" against 10 of the most significant ransomware gangs targeting Canada and one defensive operation against a phishing campaign aimed at federal government institutions 1. The report did not identify the location of the traffickers, extremist group, or ransomware gang, nor detail the specific techniques used 1.

Analysis
CSE's itemization of targets and outcomes, rather than mere confirmation the authority exists, gives allies and adversaries a rare baseline for what Ottawa treats as threat-worthy enough to warrant foreign hacking. Grouping fentanyl brokers, an extremist recruiter, and a ransomware-as-a-service gang under one disclosure signals transnational criminal infrastructure now sits alongside state and terrorist actors as a peer target set. Withholding geography and technique keeps the operational picture opaque even as the policy signal goes public, denying allied services a template to replicate the effect. Reporting rests on CSE's own annual report with no independent corroboration, and prior coverage surfaced only the fentanyl operation before the fuller account added the extremist and ransomware operations plus ten separate ransomware disruptions and one defensive action against government phishing. The itemized accounting may function chiefly as deterrent signaling rather than a complete record of the period's offensive activity.

3 sources

Canadian spy agency says it hacked drug traffickers, extremists and a ransomware gang last year - TechCrunch
Canada's Electronic Spy Agency Used Cyber Operations to Disrupt Online Fentanyl Supply Networks, Report Says - HSToday
Communications Security Establishment Canada Annual Report 2025-2026 - Communications Security Establishment Canada (CSE)