US, observers watch for cyber, disinformation campaigns in wake of Venezuela raid

Federal agencies and private groups are keeping their eyes peeled for hacking and information-warfare efforts launched in response to the wake of the United States' Jan. 3 attack on Venezuela to capture leader Nicolás Maduro. The unilateral attack has raised concerns that countries aligned with Venezuela, such as China or Russia, may launch retaliatory cyberattacks on U.S. soil.

The situation requires “heightened vigilance,” said Madhu Gottumukkala, acting director of the Cybersecurity and Infrastructure Security Agency, in a statement. 

“While CISA has not identified a specific threat at this time, we remain steadfast in monitoring for any indicators of malicious activity and are working shoulder-to-shoulder with our government and industry partners to defend against today’s risks and strengthen resilience for the future,” Gottumukkala said.

Last year, CISA removed many employees who tracked false information online, part of a broader effort launched under Trump 2.0 to rework the agency after GOP figures made unsubstantiated and disputed accusations that the cyber agency had used its counter-disinformation resources to censor Americans’ free speech.

Since the raid, regional experts have seen a rise in synthetic and inaccurate content. Adrián González, co-founder of the Venezuela-based nonprofit news and messaging monitor Cazadores de Fake News, said that much of the content generated by AI tools is coming from users in Venezuela and other Latin American countries, as opposed to larger U.S. adversaries. 

“There has been a wave of hoaxes created with AI, there is a lot of synthetic content on social media,” González said in an interview. “But it is spontaneous: it is content generated by the same users, which confuses a lot of other users.” 

He said the authors of this content are not linked to any foreign campaigns, despite previous documented coordination between Venezuela and Russia to amplify their individual preferred narratives. 

“These videos are generated in a spontaneous way and are not coordinated by a large number of users,” he said. “They don’t form part of coordinated disinformation operations.”

Some of the most viral AI-created images have purported to portray Maduro in prison, content which Cazadores de Fake News and others have worked to discredit. 

They are “creating images of Maduro detained that don’t exist, creating videos of Maduro dancing, uniformed in jail, or of the destruction of military or iconic installations of Chavismo that, in reality, were never destroyed,” said González.

Chavismo is a left-wing populist political movement in Venezuela named after the nation’s founder, former president Hugo Chávez, and associated with Maduro.

There has also been an increase in website domain registrations around Maduro, Donald Trump, and other high-profile figures related to the Venezuela operation, said Rishika Desai, a threat researcher with BforeAI, a firm that uses predictive AI tools to identify and stop cyber threats.

“We identified over 140 domains in various stages of preparation in the past three days, referencing alleged ‘releases’ or sites claiming as his [Maduro's] official narrative,” Desai said.

The firm also tracked the registration of more than 460 new domains on themes such as Nobel Peace Prize claims and petition-based campaigns against political figures, she said.

She said the team “also noted the emergence of coin-branded narratives, including so-called ‘Venezuelan libre’ tokens and ‘Crypto Maduro,’ which are commonly used for fraudulent investments and pump-and-dump schemes.”

Venezuela is no stranger to information warfare, with its government having spent years promoting state-aligned narratives through official media and online supporters. Those efforts have typically lacked the scale, sophistication and global reach seen with more robust influence operations from nations like Russia and China.