Canadian intelligence officials carried out three state-authorized cyber operations in 2025 targeting a ransomware gang, drug traffickers, and a violent extremist group, according to a report released by the Communications Security Establishment (CSE).
The agency said it disrupted an extremist organization that was recruiting in Western countries, including Canada, by undermining its credibility and limiting its ability to radicalize new members. CSE also targeted overseas cybercriminals involved in selling chemicals used to produce fentanyl, saying the operation disrupted their activities.
In a separate operation, the agency used signals intelligence to infiltrate an unnamed ransomware-as-a-service group, rendering its infrastructure inoperable and deleting a significant amount of stolen data that had been offered for sale on the dark web.
The agency also said the Cyber Centre took action against a phishing campaign targeting Canadian federal institutions and important systems. The operation disrupted the threat actor’s infrastructure and degraded its ability to continue to target Canadians.
The report also revealed that CSE conducted authorized technical disruptions against 10 major ransomware gangs in 2025, making parts of their infrastructure unusable as part of Canada's broader efforts to combat cybercrime and foreign threats.