CSE Discloses 2025 Active Cyber Operations Against Ransomware RaaS, Fentanyl Precursors, and Extremist Recruitment

The operations targeted an unspecified foreign ransomware-as-a-service group whose infrastructure was rendered inoperable with large volumes of stolen data removed from dark web marketplaces. Separate actions against overseas chemical suppliers reduced fentanyl precursor flows into North America while a third disrupted an extremist network's online credibility and recruitment pipelines through data pulled from internet-connected devices. CSE also reported ten additional technical disruptions against major ransomware gangs.

Public disclosure of these operations rests solely on CSE's annual report with no technical indicators, malware samples, or infrastructure details released. Contract and procurement records show consistent growth in CSE's active cyber authorities since 2019 but lack independent verification of outcomes or methods employed.

This marks a shift from prior Western practice where offensive cyber actions against criminal groups remained classified. The pattern aligns with U.S. and U.K. disruptive campaigns yet stands out for naming ransomware, fentanyl, and extremism in a single public document.

Next reporting cycle will likely test whether CSE continues selective disclosures or reverts to classified channels as operational tempo increases against ransomware affiliates.