Loading story…
US intelligence agencies, including the CIA and Cyber Command, conducted a series of covert cyber operations against Venezuela during President Trump's first term. These operations successfully disrupted the computer networks of Maduro's intelligence service, interrupted satellite communications used by Wagner Group mercenaries supporting Maduro, and temporarily disabled the Venezuelan military's payroll system. The intent behind these actions was to create enough disruption and discomfort within the Venezuelan regime, particularly among the military, to encourage a shift in loyalty away from President Nicolás Maduro.
Despite achieving their immediate operational objectives, such as disabling critical systems and causing unrest due to delayed military payments, the broader strategic goal of ousting Maduro from power was not realized. Former officials noted that while the cyber campaigns were technically effective, they lacked a clear plan for translating disruption into regime change, especially given Venezuela's ongoing humanitarian crisis and the military's entrenched support for Maduro. The operations highlight both the capabilities and limitations of cyber power in achieving complex political outcomes.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Security concerns were raised in Norway about Chinese electric buses that could allegedly be remotely disabled by their manufacturer. The issue centered on the potential national security and operational risks of remote control capabilities in transport systems.
Russian law enforcement arrested individuals linked to the Meduza Stealer group. The arrests targeted operators associated with the information-stealing malware operation.
The U.S. Department of Justice indicted two cybersecurity employees for allegedly carrying out ransomware attacks. The case involved insiders from the security industry being accused of participating in cybercrime.
The FCC announced plans to roll back a cybersecurity mandate affecting telecommunications providers, arguing that the sector's security posture had improved. The move represented a policy change in federal cyber regulation for telcos.
CISA released updated security guidance for organizations running on-premises Microsoft Exchange servers. The guidance was intended to help defenders harden and secure self-managed Exchange environments.
A person identified as a Conti ransomware affiliate was extradited to the U.S. The extradition marked a law-enforcement action tied to the Conti ransomware operation.
Microsoft added a scareware blocker feature to its Edge browser. The feature was introduced as a defensive measure against fraudulent scareware pages and related social-engineering attacks.
Investigative journalists acquired billions of location records from the U.S. digital advertising ecosystem, demonstrating how commercially traded geolocation data can expose sensitive sites, including locations in the European Union. The reporting highlighted the national security risks created by large-scale collection and sale of such data.
During President Trump's first term, U.S. cyber operations successfully disrupted Venezuelan intelligence and military systems. The operations, however, did not achieve the broader strategic objective of regime change in Venezuela.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States conducted a military operation in Caracas, Venezuela, resulting in multiple explosions and the removal of the country's authoritarian president to face narco-terrorism charges. During the operation, a significant power outage occurred in Caracas, prompting speculation about the involvement of a cyberattack, especially as U.S. Cyber Command was named among the agencies participating in the strikes. President Donald Trump alluded to the use of "a certain expertise" in causing the blackout, but did not confirm a cyber operation. Military officials stated that the operation involved coordinated efforts from Space Command, Cyber Command, and other interagency partners to facilitate the mission. While there is no official confirmation that a cyberattack was responsible for the grid outage, the incident is being compared to previous cases, such as the Russian cyberattack on Ukraine's power grid in 2023, which coincided with kinetic military actions. The lack of clear attribution leaves open questions about the role of cyber capabilities in the U.S. operation against Venezuela's critical infrastructure.
Jun 29, 2026
CIA Deputy Director Michael Ellis said the agency's cyber operations were central to the intelligence picture supporting **Operation Absolute Resolve**, in which U.S. special operations forces located and apprehended Venezuelan President Nicolás Maduro and his wife in Caracas. According to Ellis, cyber-enabled intelligence identified Maduro's location and allowed forces to apprehend him within four minutes of arriving on the ground; he did not disclose the systems, sources, methods, or validation processes involved. Ellis cited the operation in support of elevating the CIA's Center for Cyber Intelligence into a standalone **Cyber Mission Center**, intended to improve prioritization, reporting, agility, and resource alignment. He also highlighted the Directorate of Mission Systems, faster technology acquisition, and AI-assisted collection and analysis, while emphasizing human oversight and avoidance of dependence on a single AI model or vendor. Although some reports attributed power outages during the operation to a cyberattack, experts noted that visible physical attacks could also have caused them.
Sep 9, 2026
The United States conducted a large-scale military operation in Venezuela, targeting multiple locations including military installations and residential areas. The raid involved airstrikes, with Bellingcat identifying remnants of an AGM-88 missile at a residential building in Catia La Mar, resulting in civilian casualties. US forces reportedly captured President Nicolas Maduro and First Lady Cilia Flores, with the operation causing significant fatalities among both civilians and military personnel, including Cuban and Venezuelan soldiers. The attack also followed a series of strikes on alleged drug boats in the region. Amid the military action, speculation arose regarding possible cyber operations preceding the raid. A red team engineer observed unusual BGP routing activity involving Venezuela's state-owned telecom, CANTV, on the day before the attack. The anomalies suggested the potential for a man-in-the-middle attack, possibly enabling surveillance or disruption of communications. While Cloudflare reviewed these claims and expressed skepticism about direct links between the BGP incidents and the US operation, the timing and nature of the network events have prompted calls for further investigation into the electronic aspects of the attack.
Jun 29, 2026