Top stories.
- Maduro capture demonstrated US cybercapabilities.
- Suspected Chinese threat actor is using Venezuela-themed spearphishing lures.
- Dutch police arrest alleged AVCheck operator.
Maduro capture demonstrated US cybercapabilities.
The New York Times reports that the United States used cyberattacks to cut power across Caracas and disrupt Venezuelan radar during a January 3rd operation to capture Venezuelan President Nicolás Maduro, who faces drug trafficking charges in the US. Anonymous US officials who were briefed on the operation told the Times that the operation included the ability to quickly restore electricity and limit collateral damage. Most hospitals in Venezuela also have backup generators due to frequent blackouts, and no fatalities were reported as a result of the power cut.
Details of the operation are sparse, but the Times notes that the incident "was one of the most public displays of offensive U.S. cybercapabilities in recent years" and "showed that at least with a country like Venezuela, whose military does not have sophisticated defenses against cyberattacks, the United States could use cyberweapons with powerful and precise effects."
Suspected Chinese threat actor is using Venezuela-themed spearphishing lures.
Researchers at Acronis warn that the Chinese threat actor Mustang Panda is targeting US government entities with spearphishing emails that reference US policy regarding Venezuela. The emails contain ZIP archives designed to deliver a backdoor dubbed "LOTUSLITE." Acronis says the malware "is a custom C++ implant that communicates with a hard-coded IP-based command-and-control server and supports basic remote tasking and data exfiltration with a decent persistence technique indicating an espionage-focused capability set rather than financially motivated objectives."
Dutch police arrest alleged AVCheck operator.
Dutch police have arrested a 33-year-old man who allegedly ran the popular malware screening website AVCheck, HackRead reports. AVCheck enabled malware developers to check if their code would be detected by antivirus software, allowing them to refine the code until it would run undetected. The service was shuttered by law enforcement in May 2025.
The suspect, a Dutch resident, had been living in the United Arab Emirates following AVCheck's shutdown. He was arrested at Amsterdam's Schiphol Airport on Sunday.
