Caracas Power Grid

Summary

The Caracas power outage that occurred during the operation to capture the Venezuelan leader resulted from a combination of cyber intrusion and physical attacks on substations; video evidence showed bullet impacts, destroyed equipment and oil leaks at several sites, and experts said the kinetic damage alone could explain the loss of electricity. They also said cyber operations were part of the plan but the visible physical damage alone could account for the outage, while the blackout was described as stemming from manipulation of industrial control systems rather than conventional sabotage.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The predawn hours of January 3 2026 saw a coordinated effort to capture Venezuelan President Nicolás Maduro, during which the capital’s electricity supply was interrupted. Videos and photographs that began circulating on January 5 showed apparent physical damage at the Panamericana 69 kV and Escuela Militar 4.8 kV substations, including bullet impacts, destroyed equipment, blown doors and oil leaks. Venezuelan officials stated that the damage was caused by missiles and that it took several transmission lines out of service, specifically the OAM‑Vega Caricuao‑Panamericana 1 and 2 and the Junquito‑Panamericana 1 and 2 lines, both operating at 69 kV. Local journalists also reported attacks on a third substation at the Fuerte Tiuna military installation, with YouTube videos uploaded on January 12 depicting fires still burning at the site; AirWars confirmed the geolocations and noted that heavy weapons and explosive munitions were used, though no civilian harm was reported. Experts who reviewed the footage, such as Earl Shockley of INPOWERD, observed .50‑caliber bullet holes in substation walls, and retired Rear Adm. Mark Montgomery described the damage as a kinetic attack. Patrick Miller of Ampyx Cyber and Ron Brash, an OT/ICS specialist, said the visible destruction alone would be sufficient to cause an outage, noting that the grid is older, poorly defended and under‑resourced.

Separate reporting characterized the blackout as the result of a precise and invisible manipulation of the industrial control systems that manage electricity flow, asserting that the outage was not due to bombed towers or severed lines but to cyber interference. This account described how malware could compromise controllers to create a split reality, intercepting legitimate commands and replacing them with malicious instructions that destabilize the system, for example by rapidly opening and closing circuit breakers (flapping) to overheat transformers or generators while feeding false normal sensor readings to operators so they see green lights despite physical overload. The piece cited historical precedents such as Stuxnet against Iran’s nuclear program and the Industroyer attack on Ukraine’s grid in 2016, and noted that the Volt Typhoon campaign by China had pre‑positioned access to U.S. critical infrastructure. It also mentioned that U.S. Cyber Command follows a “defend forward” strategy and that CISA promotes “secure by design” principles, though these points are presented as general context rather than specific actions taken during the Caracas incident.

Regarding the cyber dimension, Article 1 noted that no public confirmation of a cyberattack had been provided by the Pentagon or Cyber Command; CyberScoop’s inquiry was referred to the Department of War, which did not respond. Widely cited reports attributing the outage to a U.S. cyberattack relied on anonymous sources and lacked forensic evidence or technical details. Experts interviewed in Article 1 suggested that cyber operations may have played a supporting role, such as blind­ing enemy situational awareness, reducing defenders’ ability to coordinate, or temporarily disrupting power transmission to facilitate kinetic strikes, with cyber effects described as reversible and temporary. They also said that months‑long cyber‑based surveillance could have been used to map the grid’s weak points before the kinetic strikes. The observed impacts included localized power losses: some areas experienced only brief interruptions lasting a few minutes, while other sections remained without electricity for a couple of hours, and the outage was not described as plunging the entire city into darkness. Venezuelan officials said the damage removed multiple transmission lines from service, contributing to the observed outages. No further details on detection, containment or remediation efforts were provided in the sources.

Sources

Sources available to members: 2 sources.