Canadian intelligence hacked three criminal groups in 2025, including a ransomware gang

The Communications Security Establishment (CSE), Canada’s cybersecurity and signals intelligence agency, announced in early July 2026 that it had conducted three state-authorized offensive cyber operations in 2025. The operations targeted three foreign groups “posing a threat to Canada”: a ransomware gang, drug traffickers, and violent extremists.

Cyber intelligence officers first infiltrated the information systems of a group “promoting a violent ideology and seeking to recruit individuals in Western countries, including Canada.” This enabled them to “undermine its credibility and reduce its ability to radicalize and recruit new members.” The CSE also “disrupted and degraded” foreign cybercriminals involved in the sale of chemicals used to manufacture fentanyl.

The third operation targeted a foreign ransomware gang. It resulted in the dismantling of the group’s infrastructure and “the removal of a large volume of stolen data that had been offered for sale on the dark web.” The CSE added that, in 2025, it also carried out “authorized technical disruptions” against ten other ransomware groups in order to limit their operational capabilities.