Visualização normal

Antes de ontemStream principal
  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 5, April 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 5, April 2026           Emergence of a new ransomware group, M3RX Data from a South Korean religious organization sold on DarkForums ShinyHunters claims a data leak from a US interactive media company
     

Ransom & Dark Web Issues Week 5, April 2026

Por:ATCP
28 de Abril de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 5, April 2026           Emergence of a new ransomware group, M3RX Data from a South Korean religious organization sold on DarkForums ShinyHunters claims a data leak from a US interactive media company

US-Estonian Suspect Arrested Over Alleged Scattered Spider Cyberattacks

US-Estonian suspect Peter Stokes arrested in Finland over alleged ties to Scattered Spider, facing US charges for cyberattacks, fraud, and data breaches.
  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 4, April 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 4, April 2026           ShinyHunters Claims Data Breach Involving Major U.S. Convenience Store Chain ShinyHunters Claims Theft of Internal Data and Source Code from U.S. Software Development Firm Emergence of New Data Extortion Group: Prinz Eugen
     

Ransom & Dark Web Issues Week 4, April 2026

Por:ATCP
22 de Abril de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 4, April 2026           ShinyHunters Claims Data Breach Involving Major U.S. Convenience Store Chain ShinyHunters Claims Theft of Internal Data and Source Code from U.S. Software Development Firm Emergence of New Data Extortion Group: Prinz Eugen
  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 3, April 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 3, April 2026           Emergence of New Ransomware Groups: TiMC, BlackWater, and Lamashtu [1], [2], [3] NoName05716 Claims DDoS Attacks on South Korean Public & Private Sectors [1], [2], [3] VECT & TeamPCP Campaign: Supply Chain Attack Exploiting Global Travel Platform
     

Ransom & Dark Web Issues Week 3, April 2026

Por:ATCP
15 de Abril de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 3, April 2026           Emergence of New Ransomware Groups: TiMC, BlackWater, and Lamashtu [1], [2], [3] NoName05716 Claims DDoS Attacks on South Korean Public & Private Sectors [1], [2], [3] VECT & TeamPCP Campaign: Supply Chain Attack Exploiting Global Travel Platform

Storm-1175 Deploys Medusa Ransomware Within 24 Hours of Flaw Disclosure

Microsoft researchers have uncovered a fast-moving group, Storm-1175, launching high-speed Medusa ransomware attacks against healthcare and education sectors in the UK, US, and Australia by exploiting security flaws in as little as 24 hours.

Missile Alert Phishing Exploits Iran-US-Israel Conflict for Microsoft Logins

New Phishing scam uses fake missile alerts and the ongoing conflict involving Iran to target users with QR codes and fake government emails to steal Microsoft passwords.
  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 1, April 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 1, April 2026           Ransomware group NetRunner attack against the Indian subsidiary of a South Korean auto parts manufacturer Ransomware group Everest attack against a major Japanese automaker ShinyHunters claims of source code and internal data leak from a U.S. network infrastructure […]
     

Ransom & Dark Web Issues Week 1, April 2026

Por:ATCP
1 de Abril de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 1, April 2026           Ransomware group NetRunner attack against the Indian subsidiary of a South Korean auto parts manufacturer Ransomware group Everest attack against a major Japanese automaker ShinyHunters claims of source code and internal data leak from a U.S. network infrastructure […]

Iran-Linked Handala Hackers Breach FBI Chief Kash Patel’s Gmail

Iran-linked Handala hackers breached FBI Chief Kash Patel’s Gmail, leaking photos and documents. Officials say no classified data was exposed.

US Bans New Foreign-Made Home Routers Over National Security Fears

The FCC has officially added foreign-made consumer routers to its restricted Covered List, citing major cybersecurity risks. Find out what it means for your current devices.
  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 3, March 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 3, March 2026           New Threat Actor CipherForce Claims Cyberattack on South Korean Job Portal New Threat Actor Loki Emerges, Leaks US Citizens’ Personal Data Cybercrime Forum LeakBase Shut Down Again by Russian Authorities
     

Ransom & Dark Web Issues Week 3, March 2026

Por:ATCP
18 de Março de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 3, March 2026           New Threat Actor CipherForce Claims Cyberattack on South Korean Job Portal New Threat Actor Loki Emerges, Leaks US Citizens’ Personal Data Cybercrime Forum LeakBase Shut Down Again by Russian Authorities

Iran-Linked Handala Hackers Claim Major Hacks on Stryker and Verifone

Iran-linked Handala hackers claim cyberattacks on Stryker and Verifone. Stryker confirms network disruption while Verifone says no breach evidence found.
  • ✇bellingcat
  • Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran Trevor Ball
    New video footage shows a US Tomahawk missile hitting an Islamic Revolutionary Guard Corps (IRGC) facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area. The footage, released by Mehr News and geolocated by Bellingcat, also shows smoke already rising from the vicinity of the girls’ school where 175 people were reportedly killed, including children. New video footage shows a US Tomahawk missile hitting an IRGC facility in Minab, Iran, on Feb 28, showing
     

Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran

8 de Março de 2026, 16:08

New video footage shows a US Tomahawk missile hitting an Islamic Revolutionary Guard Corps (IRGC) facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area.

The footage, released by Mehr News and geolocated by Bellingcat, also shows smoke already rising from the vicinity of the girls’ school where 175 people were reportedly killed, including children.

New video footage shows a US Tomahawk missile hitting an IRGC facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area. The footage also shows smoke already rising from the vicinity of the girls’ school, where 175 people were reportedly killed. pic.twitter.com/4jBXrNcRJO

— Trevor Ball (@Easybakeovensz) March 8, 2026

The footage would appear to contradict US President Donald Trump’s claim that it was an Iranian missile that hit the school.

Left: Image showing a Tomahawk missile from the airstrike in Minab. Right: A Tomahawk missile flying over Tehran earlier in the conflict.

The US is the only participant in the war that is known to have Tomahawk missiles. Israel is not known to have Tomahawk missiles.

The red cone superimposed over this image shows the estimated area of impact of the missile visible in the footage. The graphic also shows the position of a clinic, the school and other damaged buildings.

Geolocation by Bellingcat showing the strike’s estimated area of impact.

Planet Labs satellite imagery shows that only two structures within this red cone were damaged, including a clinic.

The other structure appears to be an earth-covered magazine or bunker.

Imagery showing two damaged structures. Source: PlanetLabs.

Giancarlo Fiorella and Merel Zoet contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran appeared first on bellingcat.

  • ✇bellingcat
  • The Incendiary Bomb Never Seen in Israel Before Trevor Ball
    The Israeli Air Force (IAF) has dropped 5,000 bombs on Iran since the United States and Israel launched an attack last week, according to a statement by the IAF on March 4. Bellingcat has monitored weapons used in the first few days of the war, and strikes across the region, including those that caused civilian harm. Some weapons, such as the US Precision Strike Missile, have seen their first use in combat. A variant of the Tomahawk missile, previously unknown to the public, was also used.
     

The Incendiary Bomb Never Seen in Israel Before

7 de Março de 2026, 14:46

The Israeli Air Force (IAF) has dropped 5,000 bombs on Iran since the United States and Israel launched an attack last week, according to a statement by the IAF on March 4.

Bellingcat has monitored weapons used in the first few days of the war, and strikes across the region, including those that caused civilian harm. Some weapons, such as the US Precision Strike Missile, have seen their first use in combat. A variant of the Tomahawk missile, previously unknown to the public, was also used.

On March 3, the IAF posted three images in three separate posts showing a bomb not publicly seen in Israeli service before. The Israel Air Force released these photos accompanied with claims they were of jets participating in the strikes on Iran. Experts told Bellingcat that this bomb appears to have an incendiary component, and may be one intended to destroy chemical or biological warfare agents.

Photo of an Israeli Air Force jet purportedly participating in strikes, equipped with two of these bombs (far left and far right). Source: Israeli Air Force.

The images appear to show 2,000-pound-class air-delivered bombs fitted with Joint Direct Attack Munition (JDAM) guidance kit with a red band around the nose. Red is commonly used to denote an incendiary, while yellow indicates high explosive effect.

Image of a bomb with the body of a MK 84 2,000-pound-bomb, but with a red band near the nose, and a US JDAM guidance kit. The image is cropped by Bellingcat to focus on the bomb. Source: Israeli Air Force.

We identified key details about the munition and shared the images with two weapons experts.

Apparent Similarities to the MK 84

Dr N.R. Jenzen-Jones, the director of Armament Research Services (ARES), a weapons intelligence consulting company, told Bellingcat these images show a 2,000-pound-class air-delivered bomb fitted with a Joint Direct Attack Munition (JDAM) guidance kit.

Frederic Gras, an Explosive Remnants of War (ERW) expert, also told Bellingcat that the bomb could be of the US MK 80 series, or an Israeli copy, and has a JDAM guidance kit.

Left: 2,000-pound bomb with red band and US JDAM guidance kit posted by the IAF. Right: Standard MK 84 2,000-pound bombs with US JDAM guidance kits. Sources: IAF and SrA Karalyn Degraffenreed/DVIDS.

The US JDAM bomb guidance kit is designed for use with bombs that use the MK 80 series bomb bodies, and the closely related BLU-109 “bunker buster” body. 

The Open Source Munitions Portal added the munition to their website on March 3, describing it as “visually similar to a MK 84 general purpose aerial bomb”, while noting that “the marking scheme is distinctly different”. The War Zone also reported on these distinct markings, and possible munitions it could be.

Open Source Munitions Portal’s (OSMP) entry on the bomb, with an analyst note. The OSMP is jointly run by Airwars and ARES, and entries undergo a review by at least two experts. Source: Open Source Munitions Portal.

“The combination of yellow and red bands probably indicates both a high explosive and incendiary payload, which would be consistent with a 2,000-pound-class bomb of MK 84 form factor known as the BLU-119/B Crash Prompt Agent Defeat (CrashPAD),” Dr Jenzen-Jones told Bellingcat.

Frederic Gras, an Explosive Remnants of War (ERW) expert said that the US and Israel both use red markings to indicate an incendiary payload, or effect. The bomb could be a full incendiary payload, with the yellow band indicating a bursting charge, or it could be a bomb primarily with a high explosive component, and a secondary incendiary effect, Gras added.

Red Bands on Israeli Weapons

It’s not the first time the Israeli Air Forces has published weapon images with red bands marking the warhead or payload section of a munition. Shortly after the start of the Gaza War in 2023, the IAF posted a photo which included an Apache attack helicopter with a Hellfire missile with a red band. The IAF deleted the post and replaced it with a similar photo of an Apache without this missile.

Israeli Air Force AH-64 Apache with Hellfire missiles, including one with a red band. Source: Israeli Air Force.

This fueled speculation online that this could be an incendiary or the thermobaric variant of the Hellfire missile, the AGM-114N. It has been approved by the US for sale to Israel.

M825A1 155mm white phosphorus artillery projectiles, munitions designed to create smoke, used by Israel also have a red band and a yellow band around the nose. 

Israeli munitions which are not incendiary have also been spotted with light red bands over the fuel tanks for munitions with jet engines, such as the Delilah cruise missile.

Israeli Delilah Cruise Missile. Source: KGyST, Wikimedia.

Designed To Target Chemical or Biological Weapon Stockpiles

The markings are consistent with the US-produced CrashPAD, but “given the possible CBW [chemical and biological warfare] threats Israel has long faced from Iran, it is entirely plausible that an Israeli analogue was developed,” Dr Jenzen-Jones told Bellingcat.

The CrashPAD contains white phosphorus and high explosives, and is designed to destroy biological and chemical warfare agents according to US government documents.

Components of a BLU-119/B (CrashPAD). Source: US Department of Defense.

Dr Jenzen-Jones told Bellingcat that the CrashPAD is the only publicly known weapon of this type utilising a MK 84 bomb body although there are several programs producing similar munitions. A penetrating variant is known as the Shredder but it uses a modified BLU-109 bomb body, which is visually different from the MK 84 bomb body visible in the IAF photos.

BLU-109 2,000-pound “bunker buster” bombs equipped with JDAM guidance kits. Source: OSMP.

CrashPAD has been in the US inventory for nearly two decades. “Chemical Agent Defeat weapons, such as Crashpad, are not illegal”, and they must undergo a legal review to ensure compliance with US domestic and international law, Michael Meier, former Senior Advisor to the Army Judge Advocate General for Law of War and current Adjunct Professor at Georgetown University Law Center, told Bellingcat.

“The express purpose for the reservation is that these weapons, such as Crashpad, are the only weapons that can effectively destroy certain targets such as biological weapons facilities, for which high heat would be required to eliminate bio-toxins,” Meier said.

Dr Arthur van Coller, Professor of International Humanitarian Law at the STADIO Higher Education, told Bellingcat that “if the CrashPAD is used as designed, i.e. to target chemical or biological weapon stockpiles sufficiently removed from civilian populations, then its use is consistent with IHL [International Humanitarian Law] and treaty law, even under CCW [Certain Conventional Weapons], Protocol III.”

Dr Arthur van Coller also said that the “United States and Israel are State Parties to the CCW itself,” but only the US is also a party to Protocol III on incendiary weapons, albeit with reservations, which means that Israel “is not legally bound by Protocol III’s restrictions on incendiary weapons (including those applying to CrashPAD) under treaty law”. Iran is not a party to the CCW at all.

The US is a major supplier of weapons to Israel, and has sent thousands of MK 80 series and BLU-109 bombs to the country. Israel also produces some MK 80 series bombs.

Israel and US Responses

The US Defense Security Cooperation Agency, which publishes details of some major arms sales, does not mention any transfers of the CrashPAD. Bellingcat asked the Department of State if the CrashPAD or weapons with similar capabilities were transferred to Israel. Bellingcat also asked the Department of State if they assessed that Iran had a chemical weapons program. A State Department Spokesperson told Bellingcat that “The Trump administration backs Israel’s right to self-defense” and referred Bellingcat to the IDF for questions about procurement and munitions used.

The US Department of Defense did not respond to requests for comment by the time of publication. 

Bellingcat asked the IDF what the bomb was, if it was supplied by the US, if it contained white phosphorus, thermobaric or fuel air explosives, and if the IDF assessed that Iran had a chemical weapons program. The IDF told Bellingcat that it “will not be able to provide details regarding the types of munitions it uses. With that said the IDF uses only legal weapons and ammunition.”


Bellingcat’s Carlos Gonzales contributed research to this article. Livio Spaini from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post The Incendiary Bomb Never Seen in Israel Before appeared first on bellingcat.

  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 1, March 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 1, March 2026         Morpheus Launches Ransomware Attack on South Korean Plating Company Ailock Resumes Activity and Republishes Previous Ransomware Victims Pro-Iranian and Pro-Islamist Hacktivist Groups Launch Cyber Attacks on Middle Eastern and Pro-Western Targets [1], [2]
     

Ransom & Dark Web Issues Week 1, March 2026

Por:ATCP
4 de Março de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 1, March 2026         Morpheus Launches Ransomware Attack on South Korean Plating Company Ailock Resumes Activity and Republishes Previous Ransomware Victims Pro-Iranian and Pro-Islamist Hacktivist Groups Launch Cyber Attacks on Middle Eastern and Pro-Western Targets [1], [2]
  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 1, Fabruary 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 1, Fabruary 2026         Qilin Targets South Korean Public Broadcaster with Ransomware Confidential Military Data from U.S. Aerospace Composites Manufacturer Sold on BreachForums ShinyHunters Leaks Data from Two Prestigious U.S. Private Universities
     

Ransom & Dark Web Issues Week 1, Fabruary 2026

Por:ATCP
4 de Fevereiro de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 1, Fabruary 2026         Qilin Targets South Korean Public Broadcaster with Ransomware Confidential Military Data from U.S. Aerospace Composites Manufacturer Sold on BreachForums ShinyHunters Leaks Data from Two Prestigious U.S. Private Universities
  • ✇bellingcat
  • Alex Pretti: Analysing Footage of Minneapolis CBP Shooting Bellingcat Investigation Team
    To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here On January 24, Alex Pretti, a 37-year-old intensive care unit nurse at the Minneapolis Veterans Affairs Health Care System, was shot and killed by federal agents on Nicollet Avenue in Minneapolis, Minnesota. The shooting comes just over two weeks after Renee Good was shot and killed by a federal agent in the same city.  The United States Department of Homeland Security claimed Pretti was killed after a
     

Alex Pretti: Analysing Footage of Minneapolis CBP Shooting

25 de Janeiro de 2026, 16:48

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On January 24, Alex Pretti, a 37-year-old intensive care unit nurse at the Minneapolis Veterans Affairs Health Care System, was shot and killed by federal agents on Nicollet Avenue in Minneapolis, Minnesota. The shooting comes just over two weeks after Renee Good was shot and killed by a federal agent in the same city. 

The United States Department of Homeland Security claimed Pretti was killed after an “armed struggle” with DHS officers and that it seemed he had wanted to “do maximum damage”. Yet video footage shared online, showing shortly before and during the incident, appears to contradict that claim.

Some of the earliest available footage of the encounter was posted to Instagram and shows an agent crossing the street to talk to Pretti who appears to be filming with his phone, which he is holding in his right hand. According to DHS, agents were conducting an immigration arrest in the area. 

The agent can be seen placing his hand on Pretti’s torso to push him back and away from the middle of the road towards the sidewalk. 

Another video shared on Reddit shows what happened after this initial contact, as well as the lead-up to the shooting. Pretti appears to put himself between two women after they were both shoved by a DHS agent. He is holding a cellphone, held sideways in his right hand.

A video shows Pretti recording federal agents roughly a minute before he is shot. Pretti’s right hand is holding a cellphone, filming. Source: Neuroscissus/Reddit

An agent can then be seen spraying Pretti with a substance from a canister, and continuing to spray him as he turns his back to him. At least five additional federal agents approach and attempt to force Pretti to the ground while one appears to strike him with a spray can. 

Twenty-five seconds after Pretti is first sprayed, a shot is heard followed by nine more shots in the span of about six seconds. Additional video from the scene shows Pretti lying motionless on the ground.

Video Analysis

Bellingcat further analysed the Reddit video, a separate video posted to Facebook and others taken at the scene to break down the key moments of the shooting, splicing them together (see Bluesky post below) to view in more granular detail.

We’ve placed the available videos of the shooting of Alex Pretti by federal agents in Minneapolis today into the same synchronised timeline and are continuing to analyse further.

[image or embed]

— Bellingcat (@bellingcat.com) 24 January 2026 at 20:39

Closer inspection of the videos shows that an agent appears to remove a weapon from the melee before the first shots are fired. 

In both the Reddit and Facebook video, a federal agent wearing a grey jacket can be seen approaching federal agents who are on top of and struggling with Pretti. Notably, the agent’s hands are empty as he approaches. He can be seen reaching into and rummaging amid the bodies. About twelve seconds later, he is seen carrying a handgun away from the scene. 

Another video, also posted to Reddit, shows the agent removing a gun from a holster in Pretti’s waistband before he is shot.

Federal Agent in grey jacket can be seen reaching to pull the gun out of Pretti’s holster. Brightness increased by Bellingcat. ChaseTacos/Reddit. Annotations by Bellingcat.

Several aspects of the gun the federal agent is seen moving away with appear to match the gun DHS claim belonged to Pretti (and which they posted to X), a Sig Sauer P320, chambered in 9mm. Some posts online mistakenly claimed the photo of the gun was old due to a misunderstanding of Google Reverse Image Search.

While some law enforcement agencies issue Sig Sauer P320 guns to their agents, the gun that DHS claims Pretti had is customized, and visually distinct from those that are standard issue. 

These distinct features include a white pistol grip, black pistol frame, brown slide, and a red dot sight mounted atop the slide. The red dot sight and these various colours are visible on the gun the federal agent is seen leaving with.

Left: Screenshot showing a federal agent retreating with a gun retrieved from Pretti’s rear waistband, as Pretti is shot by another federal agent. Right: Photo released by DHS of the gun they say belonged to Pretti. Sources: Philophon/Reddit and Department of Homeland Security Annotations by Bellingcat.

Before the agent who takes the gun leaves the scene, it appears someone shouts “gun”, as can be heard in this video that was posted to X, and another video posted to Reddit

This Reddit video also shows that almost immediately after the agent in the grey jacket leaves with the gun, a single gunshot can be heard, followed by nine other shots.

Slowing it down, the same video shows that as the federal agent in the grey jacket removes Pretti’s gun, an agent in a black beanie, who appears to have a line of sight on the gun being removed, begins to draw his own weapon. As soon as the agent in the grey jacket moves away with the gun and leaves, the agent in the black beanie steps to where the agent in the grey jacket had been with his finger on the trigger and fires the first shot. 

Two agents appear to fire their weapons from the footage available, one wearing a black beanie and another wearing a brown beanie, as can be seen in this video.

A screengrab from a Facebook video shows the agent in the brown beanie (left) and the agent in the black beanie (right), both in white box, who fired the shots. Annotations by Bellingcat.

At the same time as the first shot is fired, the agent in the grey jacket is leaving with the gun taken from Pretti’s holster. An alternate angle appears shows that the slide of this firearm does not move to the rear. This would indicate that it was not fired. Multiple agents, including the agent in the grey jacket, look towards the man in the black beanie immediately after the first shot. Despite some online speculation, there is as yet no evidence that Pretti’s gun was fired.

Bellingcat synced and slowed three videos to show where the agent in the black beanie, and grey jacket, with both drawn guns are when the first shot occurs. What some commenters have suggested is impact marks appear to be snow, that is visible before any shots occur. 

Three-way video sync and slow+zoom showing the moment of the first shot before Alex Pretti was killed by DHS agents in Minneapolis yesterday. There’s some claims that Pretti’s gun was the source of the first shot after it was taken from him, though in these videos it doesn’t appear that’s the case.

[image or embed]

— Jake Godin (@godin.bsky.social) 25 January 2026 at 18:33

What’s more, the agent with the black beanie’s right arm that was seen holding the gun moves backwards as the first shot is heard, likely due to the recoil from firing.

After firing once, the agent in the black beanie repositions, and then quickly fires three more shots at Pretti’s back at close range while he appears to try to stand up.

Left: Federal agent in grey jacket reaching for Pretti’s holster as the agent in the black beanie stands over him and begins drawing his gun. Right: Federal agent in the grey jacket begins to retreat, with Pretti’s holster now visibly empty, shortly before the agent in the black beanie fires. Bellingcat increased the brightness of the screenshots. Source: ChaseTacos/Reddit. Annotations by Bellingcat.

In this video, multiple agents are piled on top of Pretti while his hands can be seen in front of him, on the ground. His hands remain in front of him as the agent in the grey jacket recovers the gun and moves away.

Pretti on the ground moments before the first shot is fired, while the agent in the grey jacket removes his gun. We see that both of his hands are on the ground in front of him (white box) and not near his holstered weapon near his back. Source: Reddit Annotations by Bellingcat.

Pretti collapses onto the ground after the first shots and the agents back away. A second agent (the one wearing the brown beanie hat) then draws his gun and fires at least one shot. This is the fifth shot that is heard. The agent in the black beanie can be seen and heard firing more shots. Shots five through ten all fired at Pretti’s motionless body.

Left: Pretti on the ground (white box) and the two federal agents who have fired, one with a black beanie, and one with a brown beanie. Right: Federal agent firing at Pretti’s motionless body. Source: Social Media. Annotations by Bellingcat.

The agents can be seen from another angle, with the agent in the black beanie visibly firing into Pretti’s motionless body.

Two federal agents with guns drawn pointing at Pretti, whose body has been blurred by Bellingcat. The federal agent in the black beanie can be seen firing. Source: Neuroscissus/Reddit.

A video taken shortly after the shooting shows two agents searching Pretti’s body with one appearing to be heard asking: “Where’s the gun?”.

Bellingcat contacted the Department of Homeland Security to ask why Pretti was shot and killed and whether he was in possession of his gun when the first shots were fired.

DHS did not respond by time of publication.

DHS and CBP statements have so far only stated that one agent fired shots, identifying them as an eight year veteran of Customs and Border Patrol who fired “defensive shots”. It is not known which of the two agents who appeared to fire shots in the videos analysed by Bellingcat is an eight year veteran of CBP. 

Border Patrol Commander Greg Bovino, on CNN the day after the shooting, when shown video of the gun being removed before the shooting and asked why border patrol agents shot an unarmed man said, “You don’t know he was unarmed. I don’t know he was unarmed.” Deputy Attorney General Todd Blanche, when asked if Pretti was unarmed, said on Meet the Press, “I do not know and nobody else knows either, which is why we’re doing an investigation”. 

In the same CNN interview, Bovino also said that “The victims are the Border Patrol agents.” and that “The suspect [Pretti] put himself in that situation.”

Minneapolis Police Chief Brian O’Hara said that Pretti was a legal gun owner with a permit to carry and did not have a criminal record.


Jake Godin, Trevor Ball, Kolina Koltai and Carlos Gonzales contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Alex Pretti: Analysing Footage of Minneapolis CBP Shooting appeared first on bellingcat.

  • ✇ASEC BLOG
  • Ransom & Dark Web Issues Week 3, January 2026 ATCP
    ASEC Blog publishes Ransom & Dark Web Issues Week 3, January 2026           Qilin Ransomware Targets Korean Specialist in Semiconductor/Display Components & Surface Treatment U.S. DOJ: Access Broker “r1z” Pleads Guilty Qilin Ransomware Targets Vietnam’s National Airlines
     

Ransom & Dark Web Issues Week 3, January 2026

Por:ATCP
21 de Janeiro de 2026, 12:00
ASEC Blog publishes Ransom & Dark Web Issues Week 3, January 2026           Qilin Ransomware Targets Korean Specialist in Semiconductor/Display Components & Surface Treatment U.S. DOJ: Access Broker “r1z” Pleads Guilty Qilin Ransomware Targets Vietnam’s National Airlines
  • ✇bellingcat
  • Five Shots in Five Minutes: Analysing One Federal Agent’s Use of Less-Lethal Launcher in Minneapolis Trevor Ball
    This investigation is part of a collaboration between Bellingcat and Evident Media. You can watch Evident’s video here. The fatal shooting of Renee Nicole Good by Immigration and Customs Enforcement (ICE) agent Jonathan Ross in Minneapolis on Jan. 7 sparked nationwide protests, with often violent clashes breaking out between protesters and federal agents. Some of the most intense protests took place in Minneapolis itself, with an agent using a less-lethal launcher in ways that experts told B
     

Five Shots in Five Minutes: Analysing One Federal Agent’s Use of Less-Lethal Launcher in Minneapolis

16 de Janeiro de 2026, 13:30

This investigation is part of a collaboration between Bellingcat and Evident Media. You can watch Evident’s video here.

The fatal shooting of Renee Nicole Good by Immigration and Customs Enforcement (ICE) agent Jonathan Ross in Minneapolis on Jan. 7 sparked nationwide protests, with often violent clashes breaking out between protesters and federal agents. Some of the most intense protests took place in Minneapolis itself, with an agent using a less-lethal launcher in ways that experts told Bellingcat were “punitive” and “questionable at best”.  

This agent, an elite Border Patrol officer who was masked but identifiable through the uniform number patch EZ-17, was captured on camera firing his B&T GL06 40mm less-lethal launcher at protesters five times in five minutes as he travelled down a street adjacent to where Good was killed.

EZ-17 on the streets of Minneapolis on Jan. 8. Source: Michael Nigro/Sipa USA via Reuters Connect

While “less-lethal” weapons are not designed to kill, they can still result in serious injuries and even death when misused. In California, a protester said he was permanently blinded in one eye after he was shot with a less-lethal weapon at a protest on Jan. 13. Footage shows a DHS officer firing a PepperBall gun at his face at close range, causing him to bleed. 

Last year, a judge in Illinois ordered an injunction limiting federal agents’ use of force in the state due to what she described as aggressive use of force against peaceful protesters that “shocks the conscience”. However, Bellingcat found multiple examples of force and riot control weapons being used during immigration raids and in apparent violation of that order in the weeks immediately after.

Experts told Bellingcat that most of the less-lethal shots fired by EZ-17 after arriving at the site of Good’s shooting with Border Patrol Commander Gregory Bovino on Jan. 7, also appear to breach CBP’s use-of-force policy. 

Bellingcat analysed videos from news outlets and social media and mapped out all five shots the agent fired.

Five shots EZ-17 fired in five minutes near the location of Good’s shooting, numbered by the order they occurred with approximate locations. The general path of travel of EZ-17 and the location of where Renee Good was shot and killed is marked. Sources: Status Coup News, Dymanh and Google Earth. Graphic: Evident Media / Jennifer Smart

Four of these shots appeared to be aimed directly at protesters’ faces at close range, while a fifth was fired from a distance towards a crowd after tear gas had already been deployed. A sixth shot, captured at another location on the same day, also shows EZ-17 firing a shot from the same launcher at someone at head-level.

As of publication, DHS had not responded to Bellingcat’s requests for comment.

The Agent

In footage captured by independent news outlet Mercado Media, EZ-17 is seen inside the crime scene tape perimeter, standing near Bovino, with eight 40mm munitions on his belt. 

EZ-17 with eight visible munitions on his belt, including a 40mm CS “Muzzle Blast” (red box), and three sponge-nosed direct impact munitions (blue box) approximately 30 minutes before he fires his first shot. Annotations by Bellingcat. Source: Mercado Media @ 36:28 Annotations by Bellingcat

These included three sponge-nose impact rounds, which are designed for “pain compliance” through the direct force of impact, and five cylindrical munitions that can be filled with different payloads and chemical irritants. “BLAST” in blue text is visible on one munition, indicating a “Muzzle Blast” munition with a CS gas fill – commonly known as tear gas. At least three additional 40mm munitions are visible in his plate carrier. 

Another video by independent news network Status Coup News showed uninterrupted footage capturing five shots from the time the agent exited the crime scene perimeter (at 5:02) shortly before firing the first shot, to when he left in a truck with other agents (9:23) immediately after firing the fifth shot. 

The back of EZ-17’s vest shows that he belongs to CBP’s Border Patrol Tactical Unit (BORTAC). BORTAC is a specialised and highly trained unit that, according to the CBP, has a selection process “designed to mirror aspects of the US Special Operations Forces’ selection courses”. 

The patch on the back of EZ-17’s vest (centre) shows that he belongs to BORTAC. Source: Status Coup News

Members of BORTAC have regularly accompanied Bovino as he leads Trump’s immigration raids, including EZ-17 and EZ-2, another CBP agent that was frequently seen beside EZ-17 in the footage from Jan. 7. Both agents have continued to accompany Bovino on raids in Minnesota in subsequent days.

EZ-17 was also spotted alongside Bovino at an incident in Illinois, where a CBP agent in front of him appeared to shoot a protester at close range.

Five shots EZ-17 fired in five minutes near the location of Good’s shooting, numbered by the order they occurred. Sources: Status Coup News and Dymanh

First Shot

In the Status Coup Media video, EZ-17, and three other CBP agents, including EZ-2, can be seen leaving the crime scene tape perimeter set up after Good’s death, pushing protesters who are physically blocking them. Snowballs are thrown at the CBP agents. 

EZ-17 and EZ-2 push a man to the ground who is blocking them. The video shows a clear view of his belt, and the eight munitions visible on his arrival at the scene are still loaded at this point.

EZ-17’s belt is visible after he and EZ-2 push a man who was physically blocking them to the ground, seconds before EZ-17 fires his first shot, at 5:15. Source: Status Coup News

EZ-17 initially aims at the man he had pushed to the ground, but then turns and aims at the face of another nearby protester who did not appear to be involved in any previous physical contact with the agents. As EZ-17 aims at the face of this protester, the man raises his arms to shield himself before EZ-17 fires. 

EZ-17 fires his first shot, at 5:19. Source: Status Coup News. Blurring by Bellingcat

The large cloud of chemical irritant appears to disperse from the barrel immediately on firing for this shot as well as the next three shots EZ-17 fires.

This is consistent with the “Muzzle Blast” 40mm munitions produced by Defense Technology, which were seen in images of the agent’s belt.  Defense Technology says in its product specifications for 40mm “Muzzle Blast” munitions that these rounds provide “instantaneous emission” of a chemical agent in the immediate area (30 feet) of the person shooting them. 

Second Shot

Seconds later, after EZ-17 is hit by a snowball, he turns and fires towards the face of a man who is filming in the direction the snowball came from. It is unclear if this man is the intended target or someone else in the crowd behind him. 

EZ-17 firing the second shot. This shot can be heard and partially seen at 5:37 in the Status Coup News video. Left: Screenshot before firing. Centre and Right: Screenshots taken after firing. Source: Dymanh/TikTok at 0:22

Third Shot

The third shot is at a man who was seen on video throwing a snowball that hits EZ-2.

Man throwing snowballs at CBP agents after the second shot. Source: Mercado Media; annotation by Bellingcat

EZ-17 and EZ-2 chase this man, with EZ-2 spraying him in the face with Oleoresin Capsicum (OC) spray, also known as pepper spray or mace. EZ-2, when leaving the perimeter, can be seen carrying a Vexor Professional-branded canister.

Vexor exclusively produces various types of OC spray, and does not list any chemical irritant sprays that do not contain OC on its website. 

Top: EZ-2 visibly deploys at least two streams of OC spray at the man. Bottom: EZ-2 is seen leaving the crime scene tape perimeter earlier with a “Vexor Professional” branded canister. Vexor manufactures various OC spray products. Source: Status Coup News. Annotations by Bellingcat

The man slowly walks closer to the agents, saying that he has been maced. EZ-17 pushes the man, then aims at the man’s face and fires. 

The seals that keep the chemical irritant inside the 40mm canister before it is fired can be seen hitting the man in this shot, with the smoke surrounding his face.

Seals from the 40mm Muzzle Blast munition. Source: Dymanh Chhoun. Annotations by Bellingcat

Fourth Shot

After the third shot, an unmarked white CBP truck turns off the street and tries to drive down an alley. Protestors begin physically blocking the vehicle, throwing snowballs and other objects at it. The windshield gets cracked, and the back window gets broken. EZ-17 and EZ-2 physically push the protesters blocking the truck out of the way, with EZ-2 also deploying what appears to be a canister of OC spray.

A person begins banging on the windows of the truck, and EZ-17 rushes around the truck to fire his launcher towards this person’s face.

EZ-17 is seen firing his fourth shot at a person who was banging on the truck windows at 9:02. Source: Status Coup News 

University of St. Thomas School of Law professor Rachel Moran, who reviewed the videos at Bellingcat’s request, said that of the six shots we identified as being fired by EZ-17 this one appeared to be “the most reasonably related to carrying out the duty of helping the vehicle evacuate” as the person targeted was “still pounding aggressively” on the vehicle when EZ-17 fired the shot.

Fifth Shot

After EZ-17’s fourth shot, EZ-2 deploys a tear gas grenade, and the CBP truck moves down the alley, away from protesters. 

EZ-2 deploying a tear gas grenade at 9:09. Source: Status Coup News

EZ-17 can be seen reloading next to EZ-2, who is holding a canister that appears to be OC spray, and another CBP agent holding a PepperBall gun.

EZ-17 (in red box) reloading the 40mm launcher at 9:18. Source: Status Coup News. Annotations by Bellingcat

The CBP agent with the PepperBall gun appears to cross over to the other side of the truck, and EZ-2 appears to begin to enter the vehicle. 

CBP agent with PepperBall gun (yellow box) walking to the opposite side of the truck, EZ-2 standing in front of EZ-17 (red box) at 9:20. Source: Status Coup News. Annotations by Bellingcat

As soon as the back right door on the truck closes, gas from the muzzle can be seen from where EZ-17 was standing. 

Visible gas exiting the muzzle at 9:22. Source: Status Coup News

This fifth shot appears to be “skip-fired” or aimed towards the ground before ricocheting upwards, at close range, resulting in three visible projectiles going towards the crowd of people, narrowly missing some. 

Although the footage is blurry with the tear gas from the grenade EZ-2 threw still clouding the air, EZ-17 appears to be the only agent who could have fired this: EZ-2 was not armed with a projectile launcher, and PepperBall guns like the one carried by the other CBP agent do not have munitions that release multiple projectiles with a single shot.

Three different projectiles visible after the muzzle gas, at 9:22. Source: Status Coup News

Chemical irritant smoke was seen being released by the projectiles from this last shot as it travelled through the air. 

One projectile visibly emits chemical irritants as it travels through the air, at 9:23. Source: Status Coup News

The multiple projectiles are consistent with the 40mm “SKAT Shell” by Defense Technology, which ejects four separate submunitions upon firing, each dispensing chemical irritants. In one of the videos, a SKAT Shell is seen in EZ-17’s belt.

EZ-17’s belt before firing the second shot, with a visible SKAT-SHELL SAF-SMOKE to the right of the direct impact munitions on his belt. Source: Dymanh/TikTok at 0:21

Roosevelt High School

In another video from the same day, EZ-17 was filmed again alongside Bovino when CBP showed up at Roosevelt High School in Minneapolis at dismissal time

This video showed EZ-17 again firing his B&T GL06, apparently towards someone’s head, this time someone who threw a snowball at a CBP agent. 

EZ-17 after firing his B&T GL06 launcher at a high school student’s face. Source: Matthew Moore/Facebook

‘Punitive and Unlawful’

Patrick Wilcken, Amnesty International’s Researcher on Military, Security and Policing issues, said that while the overall situation shown in the videos was tense, with “verbal abuse, some shoving/throwing of snowballs and the attempted obstruction of a vehicle”, there did not seem to be any substantial physical threat to the agents that would have justified the use of less-lethal weapons. 

Wilcken, who reviewed the videos of all six shots fired by EZ-17 at Bellingcat’s request, said the actions of agents shown in these videos – pursuing fleeing protesters and in some instances firing at protesters who appeared to be trying to protect themselves – were “punitive and unlawful”. 

CBP’s use-of-force policy states that weapons such as 40mm launchers are only authorised for use against subjects offering “active” or “assaultive” resistance. Similarly, DHS’ use-of-force policy guidance says agents may use force “only when no reasonably effective, safe and feasible alternative appears to exist”, and may only use the level of force “objectively reasonable in light of the facts and circumstances” that they face at the time force is applied.

“Officers should only resort to less lethal weapons when faced by a serious physical violence posing a threat to themselves or others that is not possible to diffuse in any other way,” Wilcken said. “They must exercise force with restraint, to the minimum extent possible while respecting and enabling the right to peaceful assembly.”

University of St. Thomas School of Law professor Rachel Moran agreed that whether the use of less-lethal weapons is justified largely depends on the level of threat or aggression the agent faces from the person targeted. Although she said the fourth shot could be justified in helping the CBP vehicle evacuate, Moran said the justification for the other shots was “questionable at best” based on the footage. 

For example, Moran noted that although the man in the third shot had thrown a snowball at another officer, any threat had dissipated by the time EZ-17 shot him because the man had already run away and clearly had his hands up with nothing in them. “The shot appears to be more retaliatory than defensive”, she said. 

Similarly, for the incident at Roosevelt High School, Moran noted that EZ-17 did not appear to be in any danger from the snowball, as the person who threw it was already retreating before the agent fired.

Moran said that if EZ-17 was carrying a B&T GL06 40mm launcher, he did appear to violate CBP policy by directly aiming at people’s faces.

The weapon used by EZ-17 is visible as he points it towards a protester. Source: Status Coup News. Blurring by Bellingcat

CBP’s use-of-force policy states that agents using munitions launchers, including 40mm launchers “shall not intentionally target the head, neck, groin, spine, or female breast”. However, Bellingcat’s analysis of the six shots fired by EZ-17 showed that he appeared to be aiming at the head of targets in five of these cases. 

Travis Norton, a retired police lieutenant and use-of-force consultant, told Bellingcat that standard training and manufacturer guidance for 40mm launchers recommended aiming at “large muscle groups of the lower body” while avoiding “prohibited target areas” like the head, neck, chest, spine and groin. This helps to reduce the risk of significant injury, Norton said. 

Norton said that 40mm launchers are not intended for random or area fire: “Their use is limited to clearly identified individuals who are engaging in violent or dangerous behaviour and cannot be safely addressed by other means.”

Although he declined to comment on specific incidents based solely on video footage, Norton said that skip-firing – which was used in the fifth shot identified by Bellingcat, and the only shot where a person did not appear to be targeted at head-level – was generally not a standard or recommended practice in most law-enforcement training programs. 

“Because ground conditions, angles, and projectile behaviour are unpredictable, skip-firing reduces accuracy and control and increases the risk of unintended injury,” Norton said. 


Pooja Chaudhuri contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Five Shots in Five Minutes: Analysing One Federal Agent’s Use of Less-Lethal Launcher in Minneapolis appeared first on bellingcat.

  • ✇bellingcat
  • Analysing Footage of Minneapolis ICE Shooting Jake Godin
    To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here On Jan. 7 Renee Good, a 37-year-old mother of three, was shot and killed by a federal agent on Portland Avenue in Minneapolis, Minnesota. The incident was captured on several separate videos and spread rapidly on social media. The videos were soon accompanied by competing analysis and narratives as to what had happened. Bellingcat looked at five videos filmed during the incident, including one apparent
     

Analysing Footage of Minneapolis ICE Shooting

13 de Janeiro de 2026, 11:39

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On Jan. 7 Renee Good, a 37-year-old mother of three, was shot and killed by a federal agent on Portland Avenue in Minneapolis, Minnesota. The incident was captured on several separate videos and spread rapidly on social media. The videos were soon accompanied by competing analysis and narratives as to what had happened.

Bellingcat looked at five videos filmed during the incident, including one apparently from the phone of Jonathan Ross, the ICE agent who shot and killed Good.

While each video alone provides valuable information, the five together provide a fuller picture of the situation as it unfolded.

Synced Overview

One of the ways to visualise the full incident was by tracking the movements of the key players on an overview map, which Bellingcat did shortly after the incident on Jan. 7. 

Using eyewitness video shared by Daniel Suitor on Bluesky we tracked the movements of federal agents at the scene – including Ross as he moved around the street. The video also captured the position and movements of Good’s vehicle before, during and after the shots were fired.

We’ve also updated our animated map of the positions of agents and vehicles during the incident here with new footage published by @cnn.com that shows the shooter closer to a white SUV prior to the shootingbsky.app/profile/bell…

[image or embed]

— Bellingcat (@bellingcat.com) Jan 8, 2026 at 18:38

Close-Up View

Another video, filmed by a bystander and later shared by the Minnesota Reformer, shows a closer view of Ross’ movements in the moments immediately before the shooting. 

In the video, Ross can be seen with his phone in his left hand filming Good before he pulls his gun out of its holster with his right hand. Roughly one second elapses before he fires the first round through Good’s front window. Two more shots follow.

A still from that same video captures Ross as he walks past in the seconds after the shooting. A camera app appears open on his phone.

A still image in a video published by the Minnesota Reformer. A video app can be seen open in the federal agent’s phone.

Agent’s Phone

On Jan. 9, a video filmed by Ross was published on X by a conservative news outlet called Alpha News. 

By syncing this video up with the other four available videos, it was possible to observe more of what occurred, including from Ross’ rough perspective. However, it is important to note that Ross was holding the phone slightly away from his body, so what appears in the video would be marginally different to what would have been his line of sight. 

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

In the footage, Good can be seen backing up before veering to the right as Ross and the camera move to her left. It is not clear from this footage exactly how close the car came to Ross, as the cellphone points up and away as the vehicle moves forward. Someone can be heard saying “whoa” before gunshots are heard. 

An angle captured from down the street (middle lower right in the synchronised video below and in full view here) – which some have suggested shows Ross being hit by the vehicle – does appear to show the vehicle pass close to the agent as he fires. However, the close-up video shared by the Minnesota Reformer (middle top and in full view here) shows Ross moving out of the way and to the side of the vehicle as he fires.

Another video published by CNN (middle lower left) shows a head-on view of the incident from surveillance footage.

New footage from the ICE agent’s phone who shot at Renee Nicole Good in Minneapolis has emerged, posted by AlphaNews on X. We’ve placed that footage in a synced timeline with the other currently available footage.

[image or embed]

— Bellingcat (@bellingcat.com) Jan 9, 2026 at 21:23

Almost one week after the incident, protests have been held in Minneapolis and other cities in the US. 

US President, Donald Trump, and Department of Homeland Security, Kristi Noem, initially said that Good had tried to run over an ICE officer after blocking the road, labelling her a “domestic terrorist”. However, the Democratic mayor of Minneapolis, Jacob Frey, said that version of events was “garbage” and disproven by the video footage.

On Monday Jan. 12, Noem, told FOX News that more ICE agents would be sent to Minnesota.

Individual links to each of the five videos detailed above can be found here, here, here, here and here.


Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Analysing Footage of Minneapolis ICE Shooting appeared first on bellingcat.

  • ✇bellingcat
  • Inside the Strike: The US Munition That Hit a Residential Building in Venezuela gyula
    A Bellingcat investigation has identified remnants of an AGM-88 series missile inside a three-storey apartment complex that was hit in Catia La Mar during the US military raid on Venezuela on Jan. 3, 2026 that reportedly killed at least one civilian.  According to the Venezuelan independent media outlet, El Pitazo, Rosa Gonzalez, 79, was killed in this airstrike in the city of Catia La Mar in La Guaira State, 30 km north of the capital Caracas. The attack reportedly left a second individual s
     

Inside the Strike: The US Munition That Hit a Residential Building in Venezuela

Por:gyula
7 de Janeiro de 2026, 16:08

A Bellingcat investigation has identified remnants of an AGM-88 series missile inside a three-storey apartment complex that was hit in Catia La Mar during the US military raid on Venezuela on Jan. 3, 2026 that reportedly killed at least one civilian. 

According to the Venezuelan independent media outlet, El Pitazo, Rosa Gonzalez, 79, was killed in this airstrike in the city of Catia La Mar in La Guaira State, 30 km north of the capital Caracas. The attack reportedly left a second individual severely wounded.

Bellingcat asked the US Department of Defense to confirm our findings. However, they stated that “a Battle Damage Assessment is ongoing”. We also reached out to the Department of State but they did not respond to our questions at the time of publication.

The Jan. 3 US attack on Venezuela targeted multiple locations across the country, including military installations and areas within and around the capital, Caracas. US military helicopters, jets and drones provided cover for an assault force that landed at Fort Tiuna,  the largest military complex in Caracas; captured President Nicolas Maduro and First Lady Cilia Flores, and flew them out of the country.

About 75 people, including civilians, were killed in the operation, US officials familiar with the matter told the Washington Post. Among the military fatalities were 32 Cuban and 21 Venezuelan soldiers, according to various media reports.

According to El Pitazo, a second woman, Yohana Rodríguez Sierra, 45, was killed, and her daughter wounded, in other strikes at a communications station at Cerro El Volcán. Multiple residential houses were also reportedly destroyed in the nearby area of La Boyera.

The military operation in Caracas follows a series of attacks on alleged drug boats which have reportedly killed at least 114 in the Caribbean Sea and the Eastern Pacific Ocean.

Identifying the Munition

Bellingcat has found videos showing the aftermath of the Catia La Mar attack and remnants of the munition filmed at the location. The strike destroyed some exterior walls of one apartment complex and caused extensive damage to at least two apartments.

Left: Screenshot from a video showing the destroyed exterior walls of the apartment building. Source: LaTrIncHEra/Instagram. Right: Screenshot from a video filmed inside the apartment complex showing an extensive fragmentation pattern on a neighbouring building. Source: Carlos Marea/Instagram.

Bellingcat geolocated the apartment complex to an area in Catia La Mar about 30 km north of Caracas (10.592796, -67.037721) and approximately 500 m east of a targeted air defence storage inside a military facility.

Top: Panoramic composite showing the damaged building hit in the strike. Credit: Youri van der Weide/Bellingcat. Bottom: Location where the residential building was hit in Catia La Mar, La Guaira, Venezuela. Source: Airbus/Google Earth.
Screenshot showing what appears to be weapon system remnants found at the apartment complex that was struck. Source: Carlos Marea/Instagram.

One video also reveals remnants of a munition. According to an analysis of visual evidence by Bellingcat, the remnants appear to show an AGM-88 series missile.

Top Left: Munition remnants recovered at Caita La Mar. Source: Carlos Marea/Instagram. Top Right: Reference Photo of AGM-88 Series Missile remnants in Ukraine. Source: Open Source Munitions Portal. Bottom: Reference Photo of AGM-88 Series missile before being loaded on an aircraft. Source: Senior Master Sgt. Glen Flanagan/DVIDS.

Another remnant of the AGM-88 series missile appears in a video published by Euronews. This remnant is a BSU-60 tail fin, that according to an analyst note on the Open Source Munitions Portal (OSMP), is used exclusively with the AGM-88 series missile.

Top Left: Remnant recovered at Catia La Mar. Source: Euronews. Top Right: BSU-60 fin from an AGM-88 missile in Ukraine. Source: Open Source Munitions Portal. Bottom Left: Remnant of an AGM-88 series missile with one visible fin. Source: Open Source Munitions Portal. Bottom Right: US Servicemember installs BSU-60 fins onto an AGM-88 series missile. Source: Airman 1st Class Leon Redfern/DVIDS.

The AGM-88 HARM/AARGM series are American-produced air-to-surface missiles that are designed to hit ground-based radar-emitting targets, such as air defence systems like the Buk-M2E used by Venezuela’s military, with several of them destroyed during the US military raid.

“Venezuela does not operate the AGM-88 HARM. Its F-16 acquisition occurred in 1983, when the US wouldn’t release anti-radiation tech to the region,” Dr Andrei Serbin Pont, International Analyst and President of the Regional Coordinating Centre for Economic and Social Investigations, CRIES, told Bellingcat. Later Israeli upgrades added guided munitions/AAMs, not ARMs, he said.

According to TheWarZone, Venezuela did not receive any precision air-to-surface munitions, such as the AGM-88 series missiles. The Stockholm International Peace Research Institute (SIPRI) Arms Transfer Database does not report any transfers of AGM-88 missiles to Venezuela.

US Navy aircraft were photographed in the region with AGM-88E AARGM missiles in the weeks before the operation. Chairman of the Joint Chiefs of Staff, General Caine, stated that jets of this type, designed to suppress and destroy air defences, took part in the operation.

Left: US Navy E/A-18 equipped with an AGM-88E AARGM missile photographed in Puerto Rico on Dec. 15. Source: Ricardo Arduengo/Reuters. Right: US Navy Jet aboard the USS Gerald R. Ford, equipped with an AGM-88E AARGM missile on Dec. 22. Source: Seaman Abigail Reyes/DVIDS.

Air Defence Systems Targeted

The US struck several air defence systems across Venezuela as part of the operation, with Buk-M2E launchers being destroyed at  La Guaira Port, and the Higuerote and La Carlota airbases. Satellite imagery from Vantor shows that the area near a BuK-M2E storage building at Fort Guaicaipuro was also struck, but no air defence systems can clearly be seen.

Jan. 5, 2026 satellite imagery showing several damaged buildings at Fort Guaicaipuro. Satellite image ©2026 Vantor

According to satellite imagery, Buk-M2E launchers appear to have been stored at the military base approximately 500m from the residential building that was hit.

Aug. 19, 2025, Airbus Satellite imagery of the site showing vehicles outside the buildings, including two Buk-M2Es with missiles loaded. Source: Airbus via Google Earth.
Jan. 6, 2026, satellite imagery showing several destroyed buildings and vehicles at Catia La Mar Air Defence Storage Buildings. Satellite image ©2026 Vantor

Bellingcat was not able to determine what caused the missile to strike the apartment building or if Buk-2ME launchers at Catia La Mar or a different system were the intended target. 

The AARGM variant is capable of having designated missile “impact zones” and “avoidance zones” programmed to determine where the missile can or can’t impact when used on missions, a feature added to “prevent collateral damage”.

Bellingcat asked the US Department of Defense if any weapons used in the operation transmitted a weapons impact assessment or other data that indicated they hit an unintended or civilian location. They said that a Battle Damage Assessment is ongoing.


Carlos Gonzales, Giancarlo Fiorella, Jake Godin, Trevor Ball and Youri van der Weide contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post Inside the Strike: The US Munition That Hit a Residential Building in Venezuela appeared first on bellingcat.

❌
❌