Loading story…
The United States conducted a large-scale military operation in Venezuela, targeting multiple locations including military installations and residential areas. The raid involved airstrikes, with Bellingcat identifying remnants of an AGM-88 missile at a residential building in Catia La Mar, resulting in civilian casualties. US forces reportedly captured President Nicolas Maduro and First Lady Cilia Flores, with the operation causing significant fatalities among both civilians and military personnel, including Cuban and Venezuelan soldiers. The attack also followed a series of strikes on alleged drug boats in the region.
Amid the military action, speculation arose regarding possible cyber operations preceding the raid. A red team engineer observed unusual BGP routing activity involving Venezuela's state-owned telecom, CANTV, on the day before the attack. The anomalies suggested the potential for a man-in-the-middle attack, possibly enabling surveillance or disruption of communications. While Cloudflare reviewed these claims and expressed skepticism about direct links between the BGP incidents and the US operation, the timing and nature of the network events have prompted calls for further investigation into the electronic aspects of the attack.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-08, Cloudflare principal network engineer Bryton Herdes said the unusual routing activity was consistent with a common BGP route leak rather than a deliberate cyberattack. He assessed it as unrelated to the US military operation in Venezuela.
Following the strike, the US Department of Defense said a Battle Damage Assessment was underway and did not confirm whether the civilian residential building had been an intended target. This was the first official response described in the reporting.
In findings published on 2026-01-07, Bellingcat reported that remnants recovered from the Catia La Mar strike site matched an AGM-88 series missile. Because Venezuela does not operate that munition, the evidence strongly suggested US involvement in the strike.
Around the time of the US operation, observers noted unusual BGP routing activity involving Venezuela's CANTV network (AS8048). The anomalies prompted speculation that telecom infrastructure had been targeted to support surveillance or disruption during the incursion.
During the 2026-01-03 operation, an apartment complex in Catia La Mar was struck, causing civilian casualties. Rosa Gonzalez, 79, was killed and other residents were severely injured.
On 2026-01-03, the US military carried out a large-scale operation in Venezuela, striking multiple locations including military installations and areas around Caracas. The raid also reportedly destroyed several Venezuelan air defense systems, including Buk-M2E launchers.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States conducted a military operation in Caracas, Venezuela, resulting in multiple explosions and the removal of the country's authoritarian president to face narco-terrorism charges. During the operation, a significant power outage occurred in Caracas, prompting speculation about the involvement of a cyberattack, especially as U.S. Cyber Command was named among the agencies participating in the strikes. President Donald Trump alluded to the use of "a certain expertise" in causing the blackout, but did not confirm a cyber operation. Military officials stated that the operation involved coordinated efforts from Space Command, Cyber Command, and other interagency partners to facilitate the mission. While there is no official confirmation that a cyberattack was responsible for the grid outage, the incident is being compared to previous cases, such as the Russian cyberattack on Ukraine's power grid in 2023, which coincided with kinetic military actions. The lack of clear attribution leaves open questions about the role of cyber capabilities in the U.S. operation against Venezuela's critical infrastructure.
Jun 29, 2026
CIA Deputy Director Michael Ellis said the agency's cyber operations were central to the intelligence picture supporting **Operation Absolute Resolve**, in which U.S. special operations forces located and apprehended Venezuelan President Nicolás Maduro and his wife in Caracas. According to Ellis, cyber-enabled intelligence identified Maduro's location and allowed forces to apprehend him within four minutes of arriving on the ground; he did not disclose the systems, sources, methods, or validation processes involved. Ellis cited the operation in support of elevating the CIA's Center for Cyber Intelligence into a standalone **Cyber Mission Center**, intended to improve prioritization, reporting, agility, and resource alignment. He also highlighted the Directorate of Mission Systems, faster technology acquisition, and AI-assisted collection and analysis, while emphasizing human oversight and avoidance of dependence on a single AI model or vendor. Although some reports attributed power outages during the operation to a cyberattack, experts noted that visible physical attacks could also have caused them.
Sep 9, 2026
US intelligence agencies, including the CIA and Cyber Command, conducted a series of covert cyber operations against Venezuela during President Trump's first term. These operations successfully disrupted the computer networks of Maduro's intelligence service, interrupted satellite communications used by Wagner Group mercenaries supporting Maduro, and temporarily disabled the Venezuelan military's payroll system. The intent behind these actions was to create enough disruption and discomfort within the Venezuelan regime, particularly among the military, to encourage a shift in loyalty away from President Nicolás Maduro. Despite achieving their immediate operational objectives, such as disabling critical systems and causing unrest due to delayed military payments, the broader strategic goal of ousting Maduro from power was not realized. Former officials noted that while the cyber campaigns were technically effective, they lacked a clear plan for translating disruption into regime change, especially given Venezuela's ongoing humanitarian crisis and the military's entrenched support for Maduro. The operations highlight both the capabilities and limitations of cyber power in achieving complex political outcomes.
Jun 29, 2026