Loading story…
Canada’s Communications Security Establishment (CSE) disclosed that it carried out three state-authorized foreign active cyber operations against an overseas ransomware-as-a-service gang, fentanyl-linked chemical traffickers, and a violent extremist organization. According to the agency’s annual reporting, the ransomware operation rendered parts of the gang’s infrastructure inoperable and deleted a large volume of stolen data that had been advertised for sale on the dark web, while the operation against chemical brokers disrupted activity tied to precursor sales used in fentanyl production.
CSE also said its operation against the extremist group used data from internet-connected devices to undermine the group’s credibility and reduce its ability to recruit and radicalize people in Western countries, including Canada. Separately, the agency reported technical disruptions against 10 significant ransomware gangs targeting Canadian healthcare, transportation, and business sectors, as well as a defensive cyber operation that disrupted a phishing campaign aimed at Canadian federal institutions and other critical systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-06, reporting on CSE’s annual report revealed the agency’s previously undisclosed 2025 cyber operations against criminal and extremist targets. The disclosure included details on active operations and broader ransomware disruptions.
CSE also reported a separate defensive cyber operation against a phishing campaign aimed at Canadian federal institutions and other important systems. The references describe this as an additional operation disclosed in the agency’s annual reporting.
CSE reported that it carried out authorized technical disruptions against 10 significant ransomware gangs in 2025. The agency said these actions made parts of the gangs’ infrastructure unusable.
In 2025, CSE targeted an unspecified ransomware-as-a-service gang affecting Canadian healthcare, transportation, and business sectors. The agency said it rendered the gang’s infrastructure inoperable and deleted a large amount of stolen data from its servers.
CSE said a 2025 operation targeted an extremist group involved in recruiting and spreading violent ideology. Using data from internet-connected devices, the agency said it reduced the group’s credibility and its ability to radicalize and recruit in Western countries, including Canada.
One of CSE’s 2025 active cyber operations targeted overseas brokers selling chemicals used to make fentanyl. The agency said the operation disrupted and diminished the traffickers’ activity.
Canada’s Communications Security Establishment said it carried out three state-authorized foreign active cyber operations in 2025. The operations targeted fentanyl-linked chemical traffickers, a violent extremist group, and a ransomware-as-a-service operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
risky.biz
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourcecse-cst.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
International and national law enforcement actions were reported targeting a range of cybercrime activity, including ransomware, extortion, and large-scale fraud. SentinelOne summarized multiple cases: Dutch authorities arrested a man accused of attempting to extort officials after receiving sensitive documents by mistake and refusing to delete them; Polish authorities detained a suspect linked to the **Phobos** ransomware-as-a-service ecosystem as part of Europol-coordinated **Operation Aether**, seizing materials such as stolen credentials and access information; and **Operation Red Card 2.0** (coordinated through Interpol/AFJOC) resulted in hundreds of arrests across multiple African countries, along with seizures of devices, takedowns of malicious sites, and recovery of funds tied to investment fraud and mobile-money/loan scams. Separately, Security Affairs’ weekly newsletter highlighted additional ongoing cyber risk items that align with the same broad theme of active cybercrime and enforcement pressure, including an **FBI warning** about a surge in **ATM jackpotting** losses and reporting on **Operation Red Card 2.0**. Other items in the Security Affairs roundup (e.g., additions to CISA’s KEV catalog, vendor/software issues, and various malware reports) were presented as a curated link list rather than a single unified incident. A SOCRadar profile on the China-attributed **Lotus Blossom** espionage group and a Tom’s Hardware historical piece on the first computer search warrant are not part of the law-enforcement disruption story and do not materially support the same specific event narrative.
Jun 29, 2026
International law enforcement agencies have intensified efforts to disrupt the infrastructure of prominent malware and ransomware operations. Europol, as part of Operation Endgame, targeted the servers supporting the Rhadamanthys information stealer, resulting in a sudden loss of access for its operators and a halt in observed activity since late October 2025. Rhadamanthys, a C++-based stealer-as-a-service, had been widely distributed through phishing campaigns and malicious ads, with its latest version released in October 2025. The operation's impact on the long-term viability of Rhadamanthys remains to be seen, but the immediate effect has been a significant reduction in its activity. In parallel, law enforcement agencies across the US and Europe have made notable arrests and infrastructure takedowns targeting ransomware groups. The UK’s National Crime Agency apprehended a suspect linked to a ransomware attack that disrupted multiple European airports, while US authorities filed charges against the administrator of several notorious ransomware gangs and seized assets from a Zeppelin ransomware distributor. Additionally, a coordinated international operation dismantled the infrastructure of the BlackSuit ransomware group, further demonstrating the global commitment to combating cybercrime. These actions collectively signal a robust and ongoing crackdown on cybercriminal operations by international authorities.
Jun 29, 2026
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026