How the US shut down power in Caracas, and what it signals for the future of cyber warfare

The power outage that hit Venezuela's capital on Saturday, as the US launched targeted air strikes in a bid to oust President Nicolas Maduro, offers a rare glimpse into how cyber, space, and electronic capabilities are being used to disrupt civilian infrastructure, and why that matters for future conflict.

When large parts of Caracas went dark in the early hours of the morning, the outage appeared sudden, surgical, and brief.

Within minutes, US helicopters were reportedly landing in the city. By daylight, power and communications were largely restored.

After the mission, US President Donald Trump suggested the US used “a certain expertise to turn off the lights in Caracas during the strike that captured Maduro.

What exactly happened in those critical hours – and whether the blackout should be understood as a “cyber attack” at all – is now at the centre of a wider debate about how modern states use cyber, space, and electronic capabilities to enable operations against civilian infrastructure.

Based on interviews with former US cyber and law-enforcement officials, security executives, and publicly available telemetry, one aspect of this operation is clear: this was unlikely to have been a single cyber weapon or digital exploit.

Instead, it appears to have been a coordinated, multi-domain operation, blending power disruption, telecom interference, electronic warfare, limited cyber actions, and human access.

And the shape of this operation matters to cyber pros because how such events are framed will influence how similar operations may be justified, replicated, and defended against in future conflicts.

Blackout, but not a conventional cyberattack

The power and communications outage in Caracas coincided closely with US military activity in the city.

Early reports suggest the disruption was time-bounded and geographically limited, with services restored relatively quickly rather than suffering permanent damage.

There is no public evidence of a novel cyber weapon being deployed, nor independent confirmation that graphite “blackout bombs” were used.

These BLU-114/B canisters contain chemically treated carbon graphite filaments that, once released, can create short circuits in power lines.

However, at present, such claims remain speculative.

What is clear is that the pattern of disruption does not resemble uncontrolled infrastructure failure. Instead, it suggests deliberate, reversible interference designed to enable a specific operational window.

“Least sophisticated, most effective”

For Miguel Clarke, a former FBI Supervisory Special Agent specialising in cyber operations, that distinction is crucial.

Rather than seeing Caracas as an example of exotic cyber warfare, Clarke argues it reflects a much older operational logic in which cyber capabilities are treated as one tool among many.

That means targeting communications first, not data centres or exotic malware. Internet service providers, cellular networks, satellite links, and local routing infrastructure become operational terrain, just like roads, bridges, or fuel depots in earlier wars.

As Clarke puts it: “What you want to use are the least sophisticated and most effective techniques.”

Briefly disrupting power or communications can prevent information from spreading, delay response, and reduce uncertainty during an operation. It does not require novel exploits or destructive malware, just a detailed understanding of how civilian systems behave under pressure.

Signals in the network, and on the ground

Rob Demain, CEO of cybersecurity firm e2e assure, argues the blackout should be understood as the final stage of a much longer campaign rather than a spontaneous strike.

Publicly available internet routing data showed anomalous activity roughly 14 hours before the raid, with traffic redirection patterns consistent with reconnaissance rather than execution.

Clarke cautions that focusing solely on network telemetry risks missing the broader picture. In his experience, operations of this kind depend just as much on physical access and human presence as they do on cyber capabilities.

Gaining access to power stations, telecom facilities, or network exchange points days, weeks, or even months in advance allows operators to understand how systems function in practice, including their dependencies and manual overrides.

By the time disruption occurs, the most complex work has already been done.

Why attribution is difficult in cyber attacks on civil infrastructure

Nic Adams, co-founder and CEO of offensive security firm 0rcus, urges caution in drawing firm conclusions about how the Caracas outage was achieved.

A tightly scoped, short-lived disruption, he argues, points towards a targeted military enabler rather than a messy civilian infrastructure failure.

The key indicators lie in scope and recovery patterns – whether disruption was uneven across districts, and whether restoration occurred cleanly or required prolonged operator intervention.

Without substation-level forensic evidence or detailed restoration data, Adams says, it remains impossible to definitively distinguish between cyber, electronic, or physical causes, a reminder of how opaque modern multi-domain operations have become.

Lessons from Stuxnet

Clarke points out that earlier operations such as Stuxnet, the joint US–Israeli effort to sabotage Iranian nuclear centrifuges, demonstrated how highly specialized cyber tools, while effective, can also expose capabilities and accelerate their wider proliferation once they enter the public domain.

For many, that experience reinforced the value of simplicity. Permanently damaging infrastructure creates humanitarian risk, political fallout, and technical exposure.

Temporarily degrading systems achieve operational goals without burning capabilities.

The legal grey zone between cyber warfare and law enforcement

For Sarah Armstrong Smith, former chief security adviser at Microsoft, the most significant aspect of the Caracas outage is the space it occupies between war and peace.

“We are living in a grey zone,” she says, “and that grey area between military action and law enforcement is exactly where we are now operating.”

She argues that the ambiguity – including Trump’s vague hinting at the US’s cyber prowess – is not incidental, but operational.

“Even the US government hasn’t physically said ‘we carried out a cyberattack’,” she says.

“That deliberate vagueness allows misinformation and speculation to fill the gap. People don’t know what to believe, and that confusion becomes part of the influence operation that dissolves trust.”

What makes cases like Caracas particularly sensitive, Armstrong Smith argues, is that they appear to involve the disruption of national power and communications systems outside the context of a declared military conflict.

“If the stated justification is drugs, corruption, or legal crimes, rather than war crimes,” she says, “then you’re blurring the line between a military operation and law enforcement.”

Collateral damage is structural

Armstrong Smith warns that even limited disruption carries unavoidable risk.

“There’s a tendency to say: ‘It was only a couple of hours’,” she says.

“But a couple of hours without power or communications can be catastrophic for hospitals, transport systems, emergency services, and civilians.”

That risk, she argues, is baked into modern infrastructure.

“Energy grids, communications networks, transport, and logistics don’t exist in isolation,” she says.

“You might intend to take out one component, but the knock-on effects are unpredictable.”

History offers clear examples of how those effects can escape their intended bounds.

Echoing Clarke’s earlier Stuxnet reference, she adds: “NotPetya was not supposed to get into the wild.”

The 2017 malware attack, which primarily targeted Ukraine, went on to cause an estimated $80 billion in global damage.

“It was designed to target Ukraine, but once it was out, it propagated everywhere.”

How cyber operations set dangerous precedents for future conflicts

The bigger risk, Armstrong Smith argues, lies not in immediate escalation but in precedent.

“If a state can justify limited disruption of civilian infrastructure, then others will feel justified doing the same, such as activists,” she says.

“Once that threshold is crossed, it becomes very difficult to put the line back.”

Over time, she warns, operating in the grey zone and cyber-enabled disruption risks becoming normalized.

“People see missiles and burning buildings and understand that as war,” she says.

“What they don’t see is the damage caused by cyber-enabled disruption and destruction – the economic harm, the loss of essential services, the ongoing fear.”

The events in Caracas may not represent a dramatic escalation, but they do reflect the normalization of cyber-enabled disruption as a routine tool of state power.

Rather than spectacular attacks or permanent damage, advanced actors appear increasingly focused on temporary, deniable, and precisely timed effects, achieved through a blend of cyber, space, electronic, and human capabilities.

As Clarke says, cyber is no longer exceptional. It is simply part of the battlespace.

If power and communications can be selectively removed – briefly, plausibly, and without formal declarations of war – then civilian systems are no longer merely collateral. They are operational terrain.

And once that precedent is set, it is unlikely to remain confined to Caracas.

Unlock more exclusive Cybernews content on YouTube.