What is happening to the Internet in Venezuela? Did the U.S. use cyber capabilities?

In light of the tragic events that have occurred in Venezuela, what is happening to the Internet in the country, and how are users accessing it?

Yesterday, the United States launched a “large scale strike” in Venezuela, capturing Venezuelan President Nicolas Maduro and his wife. 

Former Venezuelan leader Nicolás Maduro and his wife were taken to New York, and face federal charges, which he denies. Trump said the U.S. would temporarily run Venezuela and restore oil production.

Meanwhile, as events continue to unfold, are Venezuelans able to access the Internet? Do they fear being monitored?

NetBlocks is an independent and non-partisan global internet monitor that shared some metrics confirming internet outages in parts of Caracas, linked to power cuts during a U.S. military operation that captured and removed President Maduro.

“Confirmed: Metrics show a loss of internet connectivity in parts of Caracas, Venezuela, corresponding to power cuts during the US military operation which landed strikes on the capital and captured and removed President Maduro from the country” NetBlocks wrote on Mastodon.

According to POLITICO, President Trump suggested the U.S. used cyber or technical capabilities to cut power in Caracas during strikes that led to Nicolás Maduro’s capture. If confirmed, it would be a rare public use of U.S. cyber power. Trump said the capital was plunged into darkness due to U.S. expertise.

“President Donald Trump suggested Saturday that the U.S. used cyberattacks or other technical capabilities to cut power off in Caracas during strikes on the Venezuelan capital that led to the capture of Venezuelan President Nicolás Maduro.” reads the report published by POLITICO.

“It was dark, the lights of Caracas were largely turned off due to a certain expertise that we have, it was dark, and it was deadly,” Trump said during a press conference at Mar-a-Lago detailing the operation.

For my own curiosity, I analyzed Tor Metrics data to see whether there were significant changes in the number of users accessing the Tor network from the country during the U.S. military operation. The results confirm my suspicions: a significant increase in users is visible in the chart below.

The sharp rise in Tor usage from Venezuela is a classic signal of a society under acute political and informational stress. When people perceive that ordinary channels are no longer safe or trustworthy, they move toward tools that offer anonymity, censorship‑resistance, and paths out of the national information bubble.

In the wake of the recent tragic events, several dynamics likely converged. First, reports of blocking, throttling, or selective disruption of social media, messaging apps, and independent news sites push citizens to Tor as a way to bypass filtering and reach foreign media, NGOs, and exile communities. Second, as repression escalates, activists, journalists, and ordinary users become more concerned about surveillance of their browsing and communications; Tor’s ability to hide IP addresses and route traffic through multiple relays makes it one of the few accessible options for safer organizing, leaking evidence, or simply reading the news without being profiled. Third, diaspora networks and digital rights groups typically respond to crackdowns by actively promoting tools like Tor and publishing “how‑to” guides, which can rapidly boost adoption once a critical mass starts sharing them.

The pattern in the chart, modest, fluctuating usage followed by a sudden, sustained jump to several times the previous baseline, fits what has been seen in other crises (for example during major protests or post‑election unrest in countries where authorities restrict the internet). It suggests not a temporary technical glitch, but a behavioral change: tens of thousands of Venezuelans trying to regain some control over what they can see, say, and share online in a moment when doing so through normal channels has become dangerous.

In mid-December, Venezuela’s state-owned oil company, PDVSA, was hit by a cyberattack that disrupted its export operations. The company said the incident only affected some administrative systems and did not impact operations.

PDVSA said security protocols prevented supply or export disruptions, framing the cyber incident as an attempted aggression linked to alleged U.S. efforts to seize Venezuelan oil. The oil and gas company PDVSA accused the U.S. government of carrying out the cyberattack. 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Venezuela)