Loading story…
Petróleos de Venezuela, S.A. (PDVSA), Venezuela's state-owned oil company, experienced a significant cyberattack that disrupted its export operations and administrative systems. While PDVSA publicly claimed that the attack was limited to administrative functions and did not affect operational continuity, internal communications and multiple media reports indicate that the disruption was more severe, with systems managing the main crude terminal offline and oil cargo deliveries suspended. The company attributed the attack to foreign actors, specifically blaming the United States and domestic conspirators, and linked the incident to recent geopolitical tensions, including the U.S. seizure of a sanctioned Venezuelan oil tanker.
Despite PDVSA's assurances of minimal impact, sources cited by Reuters and Bloomberg reported that all systems were down, with staff instructed to disconnect from the network and shut down computers. Some employees referred to the incident as a ransomware attack, though no technical details or attribution have been independently confirmed by cybersecurity experts. The attack has drawn international attention due to its timing amid escalating U.S.-Venezuela tensions and the critical role of PDVSA in Venezuela's economy and international relations.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
By Monday, restoration work was still ongoing, but PDVSA had begun resuming deliveries using manual processes. By December 17, reports said some cargoes, including Chevron U.S.-bound shipments, were loading again after the initial shutdown.
After disclosing the incident, PDVSA said the attack targeted administrative systems and claimed operational continuity was maintained. The company accused the United States and domestic collaborators of trying to destabilize Venezuela and undermine its energy sector, though no public evidence was provided.
As part of its response, PDVSA instructed employees to shut down computers, disconnect external devices, and disable Wi‑Fi and Starlink connections. Reports also said antivirus remediation and network isolation measures contributed to operational disruption.
Over the weekend of December 13-14, PDVSA suffered a cyberattack that affected administrative and export-management systems. Reports from internal sources said key systems tied to cargo handling and the main crude terminal went offline, halting or suspending oil loadings and deliveries.
Shortly before the cyber incident, U.S. forces seized a tanker carrying Venezuelan crude linked to PDVSA, escalating tensions between Washington and Caracas. Multiple reports cite this seizure as the geopolitical backdrop to the later attack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcedarkreading.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States conducted a military operation in Caracas, Venezuela, resulting in multiple explosions and the removal of the country's authoritarian president to face narco-terrorism charges. During the operation, a significant power outage occurred in Caracas, prompting speculation about the involvement of a cyberattack, especially as U.S. Cyber Command was named among the agencies participating in the strikes. President Donald Trump alluded to the use of "a certain expertise" in causing the blackout, but did not confirm a cyber operation. Military officials stated that the operation involved coordinated efforts from Space Command, Cyber Command, and other interagency partners to facilitate the mission. While there is no official confirmation that a cyberattack was responsible for the grid outage, the incident is being compared to previous cases, such as the Russian cyberattack on Ukraine's power grid in 2023, which coincided with kinetic military actions. The lack of clear attribution leaves open questions about the role of cyber capabilities in the U.S. operation against Venezuela's critical infrastructure.
Jun 29, 2026
Reporting described multiple state-linked cyber activities tied to geopolitical events, including a phishing campaign attributed with **moderate confidence** to China-nexus espionage group **Mustang Panda** (aka **UNC6384**, **Twill Typhoon**) that used the capture of Venezuelan President **Nicolás Maduro** as a lure to target US government agencies and policy organizations. Acronis researchers identified a ZIP lure (“US now deciding what’s next for Venezuela”) containing a legitimate executable side-loaded with a hidden DLL backdoor dubbed **Lotuslite**, though it remains unclear whether any targets were successfully compromised. Separately, unnamed US officials cited by *The New York Times* claimed a “precise” US cyber operation—reportedly involving **US Cyber Command**—briefly disrupted electricity in **Caracas** and interfered with Venezuelan military radar to support the helicopter mission that captured Maduro, but public technical details of the methods used were not provided. In Europe, **Poland** said it repelled what it described as its most serious cyberattack on energy infrastructure in years after attackers targeted communications between distributed renewable generation (solar and wind) and electricity distribution operators, an incident officials said came close to a blackout and “everything points to” **Russian sabotage,” while withholding specific technical indicators or a formal threat-actor attribution.
Jun 29, 2026
A ransomware attack on Colonial Pipeline’s IT environment forced the company to temporarily halt pipeline operations, causing fuel supply disruptions across parts of the United States. Dragos said with high confidence that the **DarkSide** ransomware group was responsible for the compromise and described the incident as the most disruptive cyber intrusion it had seen affecting U.S. energy infrastructure. The shutdown highlighted how closely linked IT and OT environments can be in industrial organizations, allowing an enterprise-system intrusion to trigger major operational consequences. As Colonial Pipeline restarted service, U.S. officials warned that fuel availability would recover gradually and urged the public not to panic-buy gasoline or accept price gouging. The FBI said the Russian government was not behind the attack, though the perpetrators were believed to be operating from Russia. Reporting on the incident also pointed to common ransomware entry paths, including weak passwords on internet-exposed services and exploitation of devices such as **Pulse Connect Secure**, **Fortinet FortiOS**, and **Accellion FTA**, while recommended defenses included stronger network segmentation, improved monitoring and logging, offline backups, and exercised OT incident response plans.
Aug 15, 2026