Spy Games or Glitch? The Truth Behind Venezuela’s BGP Leak

Security researchers traced a BGP route leak at Venezuela’s state-owned CANTV (AS8048) to just before a U.S. military operation aimed at Nicolás Maduro, with one analyst noting that traffic from AS8048 was anomalously redirected through Sparkle, an Italian transit provider. According to Cloudflare’s Bryton Herdes, after reviewing historical routing data the event was unlikely a deliberate attack and more likely the product of crude mistakes and misconfigurations by CANTV’s engineering staff.

The incident, which occurred on 2 January 2026 local time, followed as many as eleven similar leaks since December 2025, suggesting long-standing issues with CANTV’s ingress and egress filtering rather than a targeted operation. Cloudflare also pointed out that the route origin did not change, only the intermediate path, and that even with RPKI Route Origin Validation protection, such an anomaly could still occur.

The report highlights ASPA, a forthcoming IETF standard intended to let networks declare legitimate upstream providers, as a potential automatic blocker for hairpin-style leaks, while emphasising that RFC 9234 and the “Only-to-Customer” attribute are now matters of national infrastructure protection.