GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Arctic Wolf links new Go-based GoCaracal malware with Ethereum smart-contract C2 fallback to Dark Caracal, targeting a Venezuelan communications organization.
Arctic Wolf assessed with medium confidence that a June 2026 intrusion at an unnamed Venezuelan communications organization used GoCaracal, a previously undocumented Go-based malware framework linked to Dark Caracal. The lightweight profile provides encrypted C2, interactive shell access, and shellcode injection; the extended profile adds browser data theft, keylogging, WebRTC remote desktop, and SOCKS5 proxying. When the primary C2 server is unreachable, the malware queries an Ethereum smart contract via eth_getStorageAt at public JSON-RPC endpoints to fetch a replacement C2 address. Bandook was deployed in parallel, and Arctic Wolf published a YARA rule and indicators of compromise.
- GoCaracal's extended profile adds keylogging, browser theft, WebRTC remote desktop, and SOCKS5 proxying.
- On C2 failure, malware reads a replacement address from an Ethereum smart contract via eth_getStorageAt.
- Activity linked to Dark Caracal with medium confidence; Bandook deployed in parallel.
- Assessed delivery via phishing with financial lures and malicious SVG attachments.
- YARA rule and IoCs published for hunting; broader Latin American activity suspected.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1056.001 KeyloggingT1555.003 Credentials from Web BrowsersT1102 Web Service
- Vendors
- Arctic Wolf
- Threat actors
- Dark Caracal
- Organizations
- Arctic Wolf
From the original article
3 min read at thehackernews.com
Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal , during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control, and SOCKS5 proxying.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.