Canada's Spy Agency Just Told Us Who It Hacked Last Year. That Almost Never Happens.

 

Intelligence agencies conduct offensive cyber operations all the time. What they almost never do is tell you about it afterward. Canada's Communications Security Establishment just broke that pattern in its latest annual report, and the details offer a genuinely rare look at what a Western spy agency actually spends its cyber capabilities on.

The CSE disclosed three foreign "active cyber operations" last year, the term it uses for offensive actions against overseas threats to Canadian national security and public safety. None of them target a nation-state rival in the way most cyber-conflict headlines suggest. All three target the kind of threats that affect ordinary people directly.

The first went after cybercriminals brokering the sale of chemicals used to manufacture fentanyl. CSE collected intelligence on the brokers, then ran an operation that disrupted their ability to operate, directly striking at a link in the synthetic opioid supply chain rather than waiting to intercept the drugs themselves.

The second targeted an overseas extremist group actively recruiting members, including inside Canada, and spreading violent ideology online. CSE analyzed the group's structure, reach, and vulnerabilities, then ran an operation that undermined its credibility and limited its ability to radicalize new recruits. That's a notably different tactic than taking down infrastructure. It's an information operation aimed at making the group less persuasive, not just less connected.

The third hit a ransomware-as-a-service operation, the kind of setup where a criminal gang rents out its ransomware infrastructure to other hackers who then launch their own extortion attacks. Having tracked how this particular gang was targeting Canadian healthcare, transportation, and business sectors, CSE rendered the group's infrastructure inoperable and deleted much of the data sitting on its servers. Separately, CSE ran concurrent technical disruptions against 10 more of the most significant ransomware gangs threatening Canada, making parts of their infrastructure unusable without a full takedown.

CSE also disclosed one defensive operation, disrupting a phishing campaign aimed squarely at Canadian federal institutions and degrading the group's ability to keep targeting Canadians.

What's missing is just as telling as what's included. The report doesn't say where any of these groups were based or how the operations were technically carried out, which is standard practice. Agencies protect their tradecraft precisely so it still works next time.

This kind of disclosure isn't unique to Canada. US Cyber Command runs "hunt forward" operations, sending cyber teams into allied nations to help secure networks and disrupt adversary operations, and that program has scaled from a handful of missions in 2018 to more than two dozen in 2025. Offensive cyber work by Western intelligence agencies is clearly expanding. What's rare is a government being this specific about what it actually did and why, rather than leaving it to leaks or investigative reporting years later.

Does more transparency like this build public trust in how these agencies operate, or does even this level of detail still leave too much unaccountable?