Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback
Dark Caracal targeted a Venezuelan communications organization with new Go-based GoCaracal malware and an updated Bandook backdoor using Ethereum smart-contract C2 fallback.
Arctic Wolf Labs linked a June 2026 intrusion against a communications organization in Venezuela to Dark Caracal, an espionage group associated with Lebanon's General Directorate of General Security (GDGS). The group deployed a previously undocumented Go-based framework called GoCaracal in lightweight and extended builds alongside a Delphi-loaded Bandook backdoor, with delivery via phishing emails carrying weaponized SVG attachments through URL shorteners. The extended build uses a custom Solidity contract, BulletproofC2, on Ethereum to retrieve replacement C2 addresses without redeploying malware, and Arctic Wolf traced 249 related samples from January to July 2026 showing a modular evolution arc.
- GoCaracal lightweight build handles host profiling, encrypted C2, remote shell, and payload delivery
- Extended build adds credential theft, keylogging, WebRTC remote desktop, and SOCKS5 proxy
- BulletproofC2 Ethereum smart contract lets operators swap C2 addresses without redeploying
- Phishing with tax/financial lures delivers weaponized SVGs via URL shorteners to getpdfdigital[.]cloud
- Bandook updated with randomized command IDs and obfuscated export names to evade signatures
- ATT&CK
- T1566.001 Spearphishing AttachmentT1055 Process InjectionT1056.001 KeyloggingT1539 Steal Web Session CookieT1573 Encrypted Channel
- Vendors
- Arctic Wolf Labs
- Products
- GoCaracalBandookBulletproofC2
- Threat actors
- Dark Caracal
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | getpdfdigital.cloud | er to a shortened URL that resolves through a redirector to getpdfdigital[.]cloud, a known attacker site used to stage malicious payloads. |
From the original article
4 min read at securityaffairs.com
Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.