Canadian Spy Agency Reveals Cyber Operations Against Major Threats
In a rare public disclosure, Canada’s Communications Security Establishment (CSE) has revealed it conducted three state-authorized hacks last year to disrupt drug traffickers, violent extremists, and a ransomware gang. The report, published last week, offers a unique glimpse into the priorities of the top spy organization.
Three Active Cyber Operations Detailed
The CSE carried out three foreign “active cyber operations” — the agency’s term for cyberattacks on overseas operations that threaten Canadian national security and public safety. These operations targeted:
- Fentanyl Chemical Brokers: An operation targeting cybercriminals outside Canada who were brokering the sale of chemicals used to create the synthetic opioid fentanyl. The CSE collected intelligence on the brokers and conducted an operation that “disrupted and diminished their ability to operate.”
- Violent Extremist Group: An operation involving signals intelligence collection on an overseas extremist group spreading violent ideology and recruiting members, including in Canada. The agency analyzed the group’s organization and vulnerabilities to “successfully undermine the group’s credibility and limit their ability to radicalize and recruit new members.”
- Ransomware-as-a-Service Gang: An operation that disrupted a ransomware-as-a-service operation, letting hackers rent access to infrastructure to launch extortion attacks. Using signals intelligence, the CSE identified how the gang targeted Canada’s healthcare, transportation, and business sectors. The active cyber operation “rendered the group’s infrastructure inoperable” and deleted much of the data on their servers.
Additional Disruptions and Defensive Actions
The agency also undertook concurrent “technical disruptions” against 10 of the most significant ransomware gangs targeting Canada, aiming to “make parts of their infrastructure unusable.” Additionally, one defensive cyber operation targeted a phishing campaign aimed at Canadian federal government institutions. The CSE disrupted the group’s infrastructure and “degraded their ability” to target Canadians.
Context and Secrecy
The report did not specify the locations of the hackers, extremists, or ransomware gang, nor the exact methods used. Such operations are seldom disclosed to protect techniques. The disclosure comes as the U.S. Cyber Command conducts similar “hunt forward” operations, the number of which has risen significantly since 2018.
This report underscores key national security threats facing Canada and its allies, from illegal drug imports to cyberattacks. The CSE is tasked with collecting foreign intelligence, defending government systems, and disrupting online adversaries.