Canada's CSE Reveals Cyber Operations Against Drug Traffickers and Extremists

In a rare disclosure, Canada’s Communications Security Establishment (CSE) revealed its cyber operations in an annual report, detailing efforts to combat drug trafficking, violent extremism, and ransomware activities. The report highlights the agency's focus on national security threats, including illegal drug imports and cyberattacks.

Last year, the CSE executed three foreign "active cyber operations," a term used for cyberattacks aimed at overseas threats to Canadian security. One operation targeted cybercriminals involved in the sale of chemicals for synthetic opioids like fentanyl. The CSE gathered intelligence on these brokers and conducted an operation that disrupted their operations significantly.

Another operation focused on an overseas extremist group that was spreading violent ideology and recruiting members, including in Canada. The CSE analyzed the group’s structure and vulnerabilities, successfully undermining its credibility and limiting its recruitment efforts.

Additionally, the CSE disrupted a ransomware-as-a-service operation that allowed hackers to rent access to a ransomware gang's infrastructure. By identifying the gang's methods of targeting sectors such as healthcare and transportation in Canada, the agency rendered the group's infrastructure inoperable and deleted much of the data on their servers. Concurrently, the CSE targeted ten significant ransomware gangs to make parts of their infrastructure unusable.

While the report did not specify the locations of the targeted hackers or the details of the operations, it is common for spy agencies to conduct such cyberattacks without disclosing methods to protect operational security. The CSE also reported a defensive cyber operation aimed at a phishing campaign targeting Canadian federal institutions, successfully disrupting the group's infrastructure and reducing their targeting capabilities.