Offering a rare glimpse into the priorities of a top spy organization, Canada’s Communications Security Establishment (CSE) said it carried out a handful of state-sanctioned attacks last year to disrupt the operations of drug traffickers, violent extremists and a ransomware gang.

The revelations in the Canadian intelligence agency’s annual report highlight some of the major national security threats facing Canada and its closest allies – ranging from the importation of illegal drugs to cyber attacks. The spy agency, CSE, is tasked with collecting foreign intelligence, defending government systems and disrupting adversaries online.

Released last week, the report says that last year the CSE conducted three “active cyber operations” overseas, the term the agency uses to describe its cyber attacks on overseas operations that threaten Canada’s national and public security.

One of the operations, according to the report, targeted cybercriminals outside Canada who brokered the sale of chemicals used to create the synthetic opioid fentanyl. The CSE gathered intelligence on the brokers and then carried out an operation that “disrupted and diminished their ability to operate,” according to the report.

Another active operation involved collecting signals intelligence (data produced from electronic and Internet-connected devices) on an overseas extremist group that was spreading violent ideology and recruiting members, including in Canada.

The report says the agency analyzed the group’s organization, scope and potential vulnerabilities to carry out an operation that “successfully undermined the group’s credibility and limited its ability to radicalize and recruit new members.”

Another operation involved disrupting a ransomware-as-a-service operation that allowed hackers to rent access to a ransomware gang’s infrastructure to launch destructive extortion attacks. The CSE said its signals intelligence unit identified how the gang worked against the health, transportation and business sectors in Canada, and then used an active cyber operation that “rendered the group’s infrastructure inoperable.” The operation also deleted much of the data from the gang’s servers.

The agency said it carried out simultaneous “technical disruptions” against 10 of the largest ransomware gangs targeting Canada to “disable parts of its infrastructure.”

The report did not say where the hackers, extremists or ransomware gang were located, nor the details of the operations the CSE used to attack them. It is not uncommon for spy agencies to conduct cyber attacks against their adversaries, but such operations are rarely disclosed or detailed to protect the methods and techniques used.

Cyber ​​Command, headquartered at Fort Meade, Maryland, which conducts cyber operations for the U.S. government, periodically conducts “hunt forward” operations that involve sending cyber teams to allied nations to protect their networks and disrupt cyber operations launched by adversaries. The number of US-led search operations has increased from just a few during 2018 to more than two dozen during 2025.

Canada’s CSE said it also conducted a defensive cyber operation during the year to attack a phishing campaign targeting Canadian federal government institutions and other important systems. The agency said it disrupted the group’s infrastructure and “degraded its ability” to target Canadians.