Trump Signals U.S. Cyber Role in Caracas Blackout During Maduro Capture

On Sat, the power grid in Caracas experienced a significant blackout coinciding with U.S. forces' movement to apprehend Venezuelan leader Nicolás Maduro. This event demonstrated the potential role of malware in modern conflict scenarios.

It is understood that U.S. Cyber Command, along with allied units, may have deployed a cyber payload targeting Venezuela’s power infrastructure. The malware, once activated, opened circuit breakers, disrupted synchronization of control systems, and severed communication links between field devices and central consoles.

This operation resulted in a controlled power outage in strategic areas of Caracas, minimizing civilian disruption while disrupting loyalist forces' operations.

Subsequent analysis by experts identified the malware as a modular grid-attack tool, with similarities to previous campaigns targeting regional utilities. Analysis of network telemetry and timing data suggests the malware infiltrated control networks through compromised VPN gateways.

The malware systematically mapped substation controllers and prioritized feeders supplying power to central Caracas. Initial signs of disruption appeared as intermittent power drops on monitoring systems, not as a complete outage. Logs indicated abrupt, controlled shutdowns of multiple 230 kV lines, followed by erroneous sensor readings that misled local operators. By the time backup systems activated, the central areas were already affected.

Infection Mechanism and Payload Behavior

The infection process began with spear-phishing emails targeting engineers at the national utility. These emails contained a signed remote-access tool disguised as a maintenance report. When opened, the tool exploited stolen VPN credentials to gain access to the control network, deploying a secondary module on Windows servers responsible for SCADA workstations and historian databases.

On compromised servers, the malware executed routines querying live breaker statuses and issuing shutdown commands when grid load conditions were optimal. This approach ensured precise targeting, minimized hardware damage, and complicated subsequent investigation efforts. Responders encountered clean logs, misleading readings, and systems that appeared to self-recover.

Based on reporting by Cyber Security News.