Canadian spy agency says it hacked drug traffickers, extremists and a ransomware gang last year

In a rare disclosure, Canada's Communications Security Establishment (CSE) has revealed its engagement in a series of state-sanctioned cyber operations aimed at thwarting the activities of drug traffickers, violent extremists, and a notorious ransomware group. The insights from the CSE's recent annual report highlight significant threats to national security, including illegal drug imports and cyberattacks that affect Canadians and their allies alike. The CSE, responsible for gathering foreign intelligence, safeguarding government systems, and countering online threats, reported executing three foreign 'active cyber operations' last year. This term refers to the agency’s proactive measures against overseas entities that pose risks to Canadian security and public safety. Among these operations was a targeted strike against cybercriminals facilitating the distribution of chemicals used to manufacture fentanyl, a potent synthetic opioid. The agency gathered intelligence on these brokers and subsequently executed an operation that significantly disrupted their activities. Another operation focused on an extremist group operating abroad, which was noted for spreading violent ideologies and attempting to recruit individuals in Canada. The CSE analyzed the group’s structure and outreach capabilities, conducting an operation that effectively undermined its credibility and curtailed its recruitment efforts. Furthermore, the CSE targeted a ransomware-as-a-service model that allowed hackers to lease access to malicious infrastructures for extortion attacks. The agency’s signals intelligence unit pinpointed the gang’s operations affecting critical sectors like healthcare and transportation in Canada, leading to an intervention that rendered their infrastructure inoperable and wiped much of their data. In a broader effort, the CSE executed concurrent technical disruptions against ten of the most significant ransomware gangs targeting Canada, aiming to incapacitate parts of their operational frameworks. While the report refrained from detailing the specific locations of these adversaries or the exact methods employed, it underscored a growing trend among global intelligence agencies to conduct cyberattacks against threats. Additionally, the CSE conducted a defensive operation to dismantle a phishing campaign targeting Canadian federal institutions, disrupting the group’s capabilities and reducing their threat level to Canadians. As cyber warfare escalates, the CSE's proactive measures illustrate the ongoing battle against both domestic and international cyber threats.