For years the defender’s lot has been to absorb, respond, and rebuild while the extortion crews operate from comfortable jurisdictions with functionally zero risk. Canada’s signals intelligence agency has been quietly rearranging that math, and it just said so out loud.

According to TechCrunch, Canada’s Communications Security Establishment (CSE) disclosed that it actively hacked into the infrastructure of ransomware operations, drug traffickers, and extremist organizations over the past year. Operating under its foreign cyber operations mandate, the agency disrupted the command-and-control operations of these threat networks to mitigate global criminal campaigns. CSE said the operations successfully degraded the criminal syndicates’ technological capabilities.

Why hitting C2 actually hurts

Command-and-control is the nervous system of a criminal operation. It’s how implants phone home, how operators issue instructions, how stolen data gets routed, and how encryption gets triggered on the timetable the crew chooses. Take the C2 away and the malware still exists but stops being useful — it’s a weapon with the trigger removed. Rebuilding infrastructure costs money, time, and operational security, and every rebuild is a fresh chance to make a mistake that investigators can see.

That’s the strategic logic of disruption over prosecution. Arrests are the ideal outcome and often impossible — the people running these operations frequently sit somewhere no extradition treaty reaches. Degrading their capability doesn’t require anyone to board a plane. It just requires being in their infrastructure, which is a thing signals intelligence agencies happen to be quite good at.

It is worth being precise about what we know: CSE’s own account is the source for the claim of success, and the agency did not, in this disclosure, name the specific ransomware operations it targeted or quantify the degradation. “We hacked criminals and it went well” is a statement with an obvious interested party attached, and we’ll note that rather than pretend it’s an independent audit.

What it means for defenders

• Don’t confuse disruption with resolution: Degraded C2 buys time; it doesn’t retire a group. Ransomware crews rebrand, rebuild, and return. Keep your controls where they are.
• Keep the fundamentals funded: Offensive operations by friendly governments are a tailwind, not a substitute for backups, segmentation, MFA, and patching.
• Report incidents to authorities: Disruption operations run on intelligence, and a meaningful share of that intelligence comes from victims who reported rather than quietly paid.
• Watch for infrastructure churn: When C2 gets knocked over, groups migrate. Fresh domains and new hosting patterns follow disruption events.

The outrage

Let’s dispense with the outrage for a paragraph, because this one deserves applause. A government agency used its offensive capability against the criminals extorting hospitals, schools, and small businesses, and then told the public it had done so. Both halves matter — the doing and the saying. Transparency about offensive operations is rare and it’s how democratic accountability for these programs gets built.

Now the outrage. It has taken this long, and it’s still this rare. Ransomware has been an economy-scale problem for the better part of a decade, and the standard operating model remains: victims pay, insurers absorb, vendors sell, and the crews face roughly the risk profile of a mildly regulated startup. Canada disrupting C2 infrastructure is the right idea; the fact that it’s newsworthy is the indictment. Make it boring. Make it constant. Make running a ransomware operation a career with actual occupational hazards — and then we can stop writing the other kind of story every single week.