AnonymousMedia.org

Category: Uncategorized

Can Maduro’s trusted lieutenant now work for Trump?

Vanessa BuschschlüterLatin America editor, BBC News Online

REUTERS/Leonardo Fernandez Viloria

Many of those who tuned in to US President Donald Trump’s news conference on Saturday were probably hoping to hear dramatic details of how US forces seized Venezuela’s leader, Nicolás Maduro, in a pre-dawn raid.

But arguably a more surprising moment came when Trump announced that now that Maduro was in custody, the US would “run” Venezuela “until such time as we can do a safe, proper and judicious transition”.

In another unexpected development, he added that Secretary of State Marco Rubio had been speaking to Maduro’s Vice-President, Delcy Rodríguez, who he said was “essentially willing to do what we think is necessary to make Venezuela great again”.

However, Rodríguez seemed less than co-operative in her own news conference later where she denounced Maduro’s detention as a kidnapping and stressed that Venezuela would not become a colony.

Given these conflicting messages, many are asking who is now in charge in Venezuela.

Under Venezuela constitution, it falls to the vice-president to take over should the president be absent.

So, on the face of it, the Venezuelan Supreme Court ruling that Delcy Rodríguez was the country’s acting president seems like a logical step.

But most Venezuela watchers had expected the immediate aftermath of a US intervention to look differently.

The US – and many other nations – did not recognise Nicolás Maduro as Venezuela’s legitimate president, having denounced the 2024 election as rigged.

Maduro was declared president by Venezuela’s electoral council (CNE), a body dominated by government loyalists.

But the CNE never produced the detailed voting tallies to back up their claim and copies of voting tallies collected by the opposition and reviewed by the Carter Center suggested that the opposition candidate, Edmundo González, had won by a landslide.

JUAN BARRETO/AFP via Getty Images

Edmundo González stood in for María Corina Machado after she was barred from running in the election

In view of that, the US and dozens of other countries recognised González as the president-elect.

González, a little-known former diplomat, had the backing of popular opposition leader María Corina Machado, whom he replaced on the ballot after she was barred from running for office by officials from the Maduro government.

With the security forces cracking down on the opposition in the aftermath of the election, González went into exile in Spain and Machado into hiding in Venezuela.

For the past 18 months, they have been urging Maduro to step down and lobbying for international support for their cause, especially from the US.

Machado’s profile was boosted by her winning the Nobel Peace Prize for “her struggle to achieve a just and peaceful transition from dictatorship to democracy” in Venezuela.

Following the publicity and recognition she received after embarking on a risky journey from her hiding place in Venezuela to Oslo to accept the award, many assumed that any post-Maduro scenario would see her returning to her homeland to take up the reins of power together with Edmundo González.

Machado herself posted a letter on social media following Maduro’s capture declaring that the “hour of freedom has arrived”.

“Today we are ready to enforce our mandate and take power,” she wrote.

But the US president stunned journalists when he declared that Machado did not have the “support or respect” to lead the country.

Trump said that his team had not spoken to Machado following the US strikes, but Marco Rubio had spoken to Delcy Rodríguez.

Trump’s next remark may provide the answer as to why the Trump administration is now Maduro’s loyal lieutenant – at least for now.

Trump quoted Rodríguez as saying “we’ll do whatever you want”, adding “she really doesn’t have a choice”.

Watch: The key questions on Trump’s actions on Venezuela

With Maduro’s inner circle still seemingly in power in Venezuela, US officials may have considered that the smoothest transition would be provided by having someone from the existing government take over.

In his news conference, President Trump said that the US was “ready to stage a second and much larger attack if we need to do so”, which appears to explain why he thinks that Delcy Rodríguez has no choice but to do the US’s bidding.

Gaby Oraa/Bloomberg via Getty Images

Delcy Rodríguez often appeared at events shoulder to shoulder with Nicolás Maduro and his wife, Cilia Flores

The fact that Rodríguez was seen surrounded by some of the most powerful men in Maduro’s inner circle hours after the president had been arrested and flown out of the country seems to suggest that she has won their backing, too.

Flanking her were her brother Jorge Rodríguez, who is the president of Venezuela’s National Assembly, Interior Minister Diosdado Cabello, Defence Minister Vladimir Padrino and the top commander of the armed forces, Domingo Hernández Lárez, among others.

This will have pleased US officials concerned that the capture of Maduro would lead to a potentially destabilising battle for control among his inner circle.

But the message Delcy Rodríguez had for the US would have been less pleasing to US ears.

She insisted that “there is only one president in Venezuela, and his name is Nicolás Maduro” and called his seizure “a kidnapping”.

“We will never again be a colony of any empire,” she insisted, promising to “defend” Venezuela.

While she certainly did not sound like the person Trump had described as “willing to do the US’s bidding”, there has been speculation that she may have struck a nationalistic note to keep Maduro’s most loyal supporters on board.

Quizzed about Trump’s support for Rodríguez and her remarks, Marco Rubio told CBS on Sunday that the US would make an assessment based on her actions, not her words.

“Do I know what decisions people are going to make? I don’t,” he added, seemingly implying that he was not as certain of Rodríguez’s willingness to work with the US as Trump.

What he was adamant about was the US’s willingness to pressure Rodríguez’s interim government.

“I do know this, that if they don’t make the right decisions, the United States will retain multiple levers of leverage to ensure that our interests are protected, and that includes the oil quarantine that’s in place, among other things,” he said.

In an interview with ABC, Rubio also appeared to suggest that fresh elections should be held in Venezuela.

“Government will come about through a period of transition and real elections, which they have not had,” he told This Week.

He also appealed for “realism”, suggesting that fresh elections would take time: “Everyone’s asking, why 24 hours after Nicolas Maduro was arrested, there isn’t an election scheduled for tomorrow? That’s absurd.”

Talk of fresh elections will no doubt disappoint not only María Corina Machado and Edmundo González but also many of the Venezuelans who voted for them and who have been adamant that they want to see those votes honoured.

The opposition has long insisted that free and fair elections are not possible while the key institutions involved in organising them are stacked with Maduro loyalists. A reform of those bodies will take time.

In the short term, therefore, Venezuela looks likely to be governed by Delcy Rodríguez and Maduro’s inner circle – as long as they meet the Trump administration’s expectations.

How long that may last will depend on whether Rodríguez can find a golden middle between accommodating Trump’s requests and the Maduro base interests.

She may soon find herself between a rock and a hard place.

Source link

01/04/2026
Saudi-backed forces spread across Yemen's Mukalla after retaking port city

Saudi-backed forces spread across Yemen's Mukalla after retaking port city

Source link

01/04/2026
Cracked Software and YouTube Videos Spread CountLoader and GachiLoader Malware
Cybersecurity researchers have disclosed details of a new campaign that has used cracked software distribution sites as a distribution vector for a new version of a modular and stealthy loader known as CountLoader.

The campaign “uses CountLoader as the initial tool in a multistage attack for access, evasion, and delivery of additional malware families,” Cyderes Howler Cell Threat Intelligence team said in an analysis.

CountLoader was previously documented by both Fortinet and Silent Push, detailing the loader’s ability to push payloads like Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner. The loader has been detected in the wild since at least June 2025.

The latest attack chain begins when unsuspecting users attempt to download cracked versions of legitimate software like Microsoft Word, which causes them to be redirected to a MediaFire link hosting a malicious ZIP archive, which contains an encrypted ZIP file and a Microsoft Word document with the password to open the second archive.

Present within the ZIP file is a renamed legitimate Python interpreter (“Setup.exe”) that has been configured to execute a malicious command to retrieve CountLoader 3.2 from a remote server using “mshta.exe.”

To establish persistence, the malware creates a scheduled task that mimics Google by using the name “GoogleTaskSystem136.0.7023.12” along with an identifier-like string. It’s configured to run every 30 minutes for 10 years by invoking “mshta.exe” with a fallback domain.

It also checks if CrowdStrike’s Falcon security tool is installed on the host by querying the antivirus list via Windows Management Instrumentation (WMI). If the service is detected, the persistence command is tweaked to “cmd.exe /c start /b mshta.exe .” Otherwise, it directly reaches out to the URL using “mshta.exe.”

CountLoader is equipped to profile the compromised host and fetch the next-stage payload. The newest version of the malware adds capabilities to propagate via removable USB drives and execute the malware directly in memory via “mshta.exe” or PowerShell. The complete list of supported features is as follows-
- Download an executable from a provided URL and execute it
- Download a ZIP archive from a provided URL and executes either a Python-based module or an EXE file present within it
- Download a DLL from a provided URL and run it via “rundll32.exe”
- Download an MSI installer package and install it
- Remove a scheduled task used by the loader
- Collect and exfiltrate extensive system information
- Spread via removable media by creating malicious shortcuts (LNK) next to their hidden original counterparts that, when launched, execute the original file and run the malware via “mshta.exe” with a C2 parameter
- Directly launch “mshta.exe” against a provided URL
- Execute a remote PowerShell payload in memory
In the attack chain observed by Cyderes, the final payload deployed by the CountLoader is an information stealer known as ACR Stealer, which is equipped to harvest sensitive data from infected hosts.

“This campaign highlights CountLoader’s ongoing evolution and increased sophistication, reinforcing the need for proactive detection and layered defense strategies,” Cyderes said. “Its ability to deliver ACR Stealer through a multi-stage process starting from Python library tampering to in-memory shellcode unpacking highlights a growing trend of signed binary abuse and fileless execution tactics.”

YouTube Ghost Network Delivers GachiLoader

The disclosure comes as Check Point disclosed details of a new, heavily obfuscated JavaScript malware loader dubbed GachiLoader that’s written in Node.js. The malware is distributed by means of the YouTube Ghost Network, a network of compromised YouTube accounts that engage in malware distribution.

“One variant of GachiLoader deploys a second-stage malware, Kidkadi, that implements a novel technique for Portable Executable (PE) injection,” security researchers Sven Rath and Jaromír Hořejší said. “This technique loads a legitimate DLL and abuses Vectored Exception Handling to replace it on-the-fly with a malicious payload.”

As many as 100 YouTube videos have been flagged as part of the campaign, amassing approximately 220,000 views. These videos were uploaded from 39 compromised accounts, with the first video dating back to December 22, 2024. A majority of these videos have since been taken down by Google.

In at least one case, GachiLoader has served as a conduit for the Rhadamanthys information stealer malware. Like other loaders, GachiLoader is used to deploy additional payloads to an infected machine, while simultaneously performing a series of anti-analysis checks to fly under the radar.

It also verifies if it’s running in an elevated context by executing the “net session” command. In the event the execution fails, it attempts to start itself with admin privileges, which, in turn, triggers a User Account Control (UAC) prompt. There are high chances that the victim will allow it to continue, as the malware is likely to be distributed through fake installers for popular software, as outlined in the case of CountLoader.

In the last phase, the malware attempts to kill “SecHealthUI.exe,” a process associated with Microsoft Defender, and configures Defender exclusions to avoid the security solution from flagging malicious payloads staged in certain folders (e.g., C:\Users\, C:\ProgramData\, and C:\Windows\).

GachiLoader then proceeds to either directly fetch the final payload from a remote URL or employ another loader named “kidkadi.node,” which then loads the main malware by abusing Vectored Exception Handling.

“The threat actor behind GachiLoader demonstrated proficiency with Windows internals, coming up with a new variation of a known technique,” Check Point said. “This highlights the need for security researchers to stay up-to-date with malware techniques such as PE injections and to proactively look for new ways in which malware authors try to evade detection.”
Source link
01/04/2026