Canada's Communications Security Establishment (CSE) disclosed in its annual report that it conducted hacking operations against drug traffickers, extremist groups, and ransomware gangs throughout the past year. The revelations highlight how state-sponsored cyber operations now target criminal networks alongside traditional foreign intelligence threats.

CSE, Canada's equivalent to the NSA, framed the hacking campaigns as defensive measures protecting national security. The agency's operations targeted infrastructure used by organized crime networks distributing narcotics and by extremist organizations planning attacks. The ransomware gang targeting represents a notable escalation. Criminal groups using ransomware increasingly threaten critical infrastructure, hospitals, and government systems. By hacking back, CSE aims to disrupt operations before attacks occur.

The disclosures arrive as ransomware attacks have surged globally. Groups like LockBit and BlackCat have demanded hundreds of millions in ransom payments. Governments have grown frustrated with law enforcement's limited ability to prosecute attackers operating from jurisdictions beyond extradition reach. The CSE's offensive posture suggests Canada and allies are moving toward active disruption tactics.

The report demonstrates how cyber threats have blurred lines between national security and law enforcement. Drug trafficking and ransomware operations once fell purely under criminal jurisdiction. Now spy agencies intervene directly. This shift reflects how digital networks enable criminals to operate at scale across borders with near-impunity from traditional policing.

CSE's revelations also signal coordination with allies. The "Five Eyes" intelligence partnership between Canada, the US, UK, Australia, and New Zealand shares cyber intelligence and operations. CSE's actions likely align with similar hacking campaigns by NSA, GCHQ, and other partners targeting the same criminal networks.

The agency stopped short of naming specific targets or detailing operational methods, citing operational security. However, the disclosure itself represents a rare public acknowledgment of offensive