Loading story…
CIA Deputy Director Michael Ellis said the agency's cyber operations were central to the intelligence picture supporting Operation Absolute Resolve, in which U.S. special operations forces located and apprehended Venezuelan President Nicolás Maduro and his wife in Caracas. According to Ellis, cyber-enabled intelligence identified Maduro's location and allowed forces to apprehend him within four minutes of arriving on the ground; he did not disclose the systems, sources, methods, or validation processes involved.
Ellis cited the operation in support of elevating the CIA's Center for Cyber Intelligence into a standalone Cyber Mission Center, intended to improve prioritization, reporting, agility, and resource alignment. He also highlighted the Directorate of Mission Systems, faster technology acquisition, and AI-assisted collection and analysis, while emphasizing human oversight and avoidance of dependence on a single AI model or vendor. Although some reports attributed power outages during the operation to a cyberattack, experts noted that visible physical attacks could also have caused them.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Earlier in 2026, Ratcliffe said the CIA reorganized its acquisition and technology directorates to address emerging technologies including artificial intelligence and quantum computing. The agency also created the Directorate of Mission Systems to speed delivery of mission-enabling technology.
At the Billington Cybersecurity Summit, CIA Deputy Director Michael Ellis publicly said CIA cyber operations produced the intelligence picture supporting Operation Absolute Resolve. He did not disclose the cyber methods, systems, sources, or validation processes used.
Following the capture, the United States unsealed narcoterrorism charges against Maduro and his wife. They subsequently sought dismissal of the charges on immunity grounds.
During Operation Absolute Resolve in January, U.S. special operations forces captured Venezuelan President Nicolás Maduro and his wife from a bunker in Caracas. CIA cyber-enabled intelligence helped identify Maduro's location, and forces apprehended him within four minutes of landing.
CIA Director John Ratcliffe elevated the Center for Cyber Intelligence into a standalone Cyber Mission Center, a change intended to improve prioritization, reporting, agility, and alignment of personnel, funding, and technical resources.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States conducted a large-scale military operation in Venezuela, targeting multiple locations including military installations and residential areas. The raid involved airstrikes, with Bellingcat identifying remnants of an AGM-88 missile at a residential building in Catia La Mar, resulting in civilian casualties. US forces reportedly captured President Nicolas Maduro and First Lady Cilia Flores, with the operation causing significant fatalities among both civilians and military personnel, including Cuban and Venezuelan soldiers. The attack also followed a series of strikes on alleged drug boats in the region. Amid the military action, speculation arose regarding possible cyber operations preceding the raid. A red team engineer observed unusual BGP routing activity involving Venezuela's state-owned telecom, CANTV, on the day before the attack. The anomalies suggested the potential for a man-in-the-middle attack, possibly enabling surveillance or disruption of communications. While Cloudflare reviewed these claims and expressed skepticism about direct links between the BGP incidents and the US operation, the timing and nature of the network events have prompted calls for further investigation into the electronic aspects of the attack.
Jun 29, 2026
US intelligence agencies, including the CIA and Cyber Command, conducted a series of covert cyber operations against Venezuela during President Trump's first term. These operations successfully disrupted the computer networks of Maduro's intelligence service, interrupted satellite communications used by Wagner Group mercenaries supporting Maduro, and temporarily disabled the Venezuelan military's payroll system. The intent behind these actions was to create enough disruption and discomfort within the Venezuelan regime, particularly among the military, to encourage a shift in loyalty away from President Nicolás Maduro. Despite achieving their immediate operational objectives, such as disabling critical systems and causing unrest due to delayed military payments, the broader strategic goal of ousting Maduro from power was not realized. Former officials noted that while the cyber campaigns were technically effective, they lacked a clear plan for translating disruption into regime change, especially given Venezuela's ongoing humanitarian crisis and the military's entrenched support for Maduro. The operations highlight both the capabilities and limitations of cyber power in achieving complex political outcomes.
Jun 29, 2026
The United States conducted a military operation in Caracas, Venezuela, resulting in multiple explosions and the removal of the country's authoritarian president to face narco-terrorism charges. During the operation, a significant power outage occurred in Caracas, prompting speculation about the involvement of a cyberattack, especially as U.S. Cyber Command was named among the agencies participating in the strikes. President Donald Trump alluded to the use of "a certain expertise" in causing the blackout, but did not confirm a cyber operation. Military officials stated that the operation involved coordinated efforts from Space Command, Cyber Command, and other interagency partners to facilitate the mission. While there is no official confirmation that a cyberattack was responsible for the grid outage, the incident is being compared to previous cases, such as the Russian cyberattack on Ukraine's power grid in 2023, which coincided with kinetic military actions. The lack of clear attribution leaves open questions about the role of cyber capabilities in the U.S. operation against Venezuela's critical infrastructure.
Jun 29, 2026