Loading story…
The United States conducted a military operation in Caracas, Venezuela, resulting in multiple explosions and the removal of the country's authoritarian president to face narco-terrorism charges. During the operation, a significant power outage occurred in Caracas, prompting speculation about the involvement of a cyberattack, especially as U.S. Cyber Command was named among the agencies participating in the strikes. President Donald Trump alluded to the use of "a certain expertise" in causing the blackout, but did not confirm a cyber operation.
Military officials stated that the operation involved coordinated efforts from Space Command, Cyber Command, and other interagency partners to facilitate the mission. While there is no official confirmation that a cyberattack was responsible for the grid outage, the incident is being compared to previous cases, such as the Russian cyberattack on Ukraine's power grid in 2023, which coincided with kinetic military actions. The lack of clear attribution leaves open questions about the role of cyber capabilities in the U.S. operation against Venezuela's critical infrastructure.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-08, a report claimed U.S. Cyber Command used spear-phishing, stolen VPN credentials, and modular malware inside Venezuela's grid operator to selectively shut down substations and falsify sensor data during the Maduro capture operation. These technical details were not corroborated by the other references provided.
By 2026-01-05, public reporting and expert analysis had converged on uncertainty over whether the Caracas blackout was caused by cyber operations, kinetic effects, or other means such as electronic warfare or physical grid disruption. Experts cited both the plausibility of cyber techniques and Venezuela's fragile infrastructure as complicating factors.
After the January 3 operation, observers noted a significant increase in Tor usage from Venezuela, indicating attempts by residents to bypass censorship, surveillance, or connectivity restrictions during the crisis. The pattern was compared to internet behavior seen during unrest in other countries.
Following the operation, President Donald Trump implied U.S. technical or cyber means helped cut power in Caracas, and Gen. Dan Caine said Cyber Command and Space Command layered effects to enable the mission. Officials did not provide technical details or definitive attribution for the blackout.
During the 2026-01-03 operation, Caracas experienced major power cuts and internet disruptions. NetBlocks confirmed connectivity losses coinciding with the military action, though the exact cause of the outages remained unconfirmed.
On 2026-01-03, the United States launched a large-scale military operation in Caracas, later identified as Operation Absolute Resolve, and captured Venezuelan President Nicolás Maduro and his wife for transfer to New York to face federal charges. Multiple explosions were reported during the raid.
In December 2025, Venezuela's state-owned oil company PDVSA suffered a cyberattack affecting oil and gas infrastructure. Venezuelan authorities attributed the incident to U.S. efforts, but no U.S. confirmation was reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedarkreading.com
Open sourceschneier.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcesecurityaffairs.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States conducted a large-scale military operation in Venezuela, targeting multiple locations including military installations and residential areas. The raid involved airstrikes, with Bellingcat identifying remnants of an AGM-88 missile at a residential building in Catia La Mar, resulting in civilian casualties. US forces reportedly captured President Nicolas Maduro and First Lady Cilia Flores, with the operation causing significant fatalities among both civilians and military personnel, including Cuban and Venezuelan soldiers. The attack also followed a series of strikes on alleged drug boats in the region. Amid the military action, speculation arose regarding possible cyber operations preceding the raid. A red team engineer observed unusual BGP routing activity involving Venezuela's state-owned telecom, CANTV, on the day before the attack. The anomalies suggested the potential for a man-in-the-middle attack, possibly enabling surveillance or disruption of communications. While Cloudflare reviewed these claims and expressed skepticism about direct links between the BGP incidents and the US operation, the timing and nature of the network events have prompted calls for further investigation into the electronic aspects of the attack.
Jun 29, 2026
US intelligence agencies, including the CIA and Cyber Command, conducted a series of covert cyber operations against Venezuela during President Trump's first term. These operations successfully disrupted the computer networks of Maduro's intelligence service, interrupted satellite communications used by Wagner Group mercenaries supporting Maduro, and temporarily disabled the Venezuelan military's payroll system. The intent behind these actions was to create enough disruption and discomfort within the Venezuelan regime, particularly among the military, to encourage a shift in loyalty away from President Nicolás Maduro. Despite achieving their immediate operational objectives, such as disabling critical systems and causing unrest due to delayed military payments, the broader strategic goal of ousting Maduro from power was not realized. Former officials noted that while the cyber campaigns were technically effective, they lacked a clear plan for translating disruption into regime change, especially given Venezuela's ongoing humanitarian crisis and the military's entrenched support for Maduro. The operations highlight both the capabilities and limitations of cyber power in achieving complex political outcomes.
Jun 29, 2026
CIA Deputy Director Michael Ellis said the agency's cyber operations were central to the intelligence picture supporting **Operation Absolute Resolve**, in which U.S. special operations forces located and apprehended Venezuelan President Nicolás Maduro and his wife in Caracas. According to Ellis, cyber-enabled intelligence identified Maduro's location and allowed forces to apprehend him within four minutes of arriving on the ground; he did not disclose the systems, sources, methods, or validation processes involved. Ellis cited the operation in support of elevating the CIA's Center for Cyber Intelligence into a standalone **Cyber Mission Center**, intended to improve prioritization, reporting, agility, and resource alignment. He also highlighted the Directorate of Mission Systems, faster technology acquisition, and AI-assisted collection and analysis, while emphasizing human oversight and avoidance of dependence on a single AI model or vendor. Although some reports attributed power outages during the operation to a cyberattack, experts noted that visible physical attacks could also have caused them.
Sep 9, 2026