60
30
60
60
30
60
57
55
60
30
57
30
30
57
30
30
42
GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Arctic Wolf links new Go-based GoCaracal malware with Ethereum smart-contract C2 fallback to Dark Caracal, targeting a Venezuelan communications organization.
Arctic Wolf assessed with medium confidence that a June 2026 intrusion at an unnamed Venezuelan communications organization used GoCaracal, a previously undocumented Go-based malware framework linked to Dark Caracal. The lightweight profile provides encrypted C2, interactive shell access, and shellcode injection; the extended profile adds browser data theft, keylogging, WebRTC remote desktop, and SOCKS5 proxying. When the primary C2 server is unreachable, the malware queries an Ethereum smart contract via eth_getStorageAt at public JSON-RPC endpoints to fetch a replacement C2 address. Bandook was deployed in parallel, and Arctic Wolf published a YARA rule and indicators of compromise.
52
57
55
55
60
30
57
55
30
57
55
30
30
60
60
30
30
30
30
55
The 12 Best Managed Detection & Response (MDR) Services, Compared and Priced
Buyer's guide compares 12 MDR services, naming Huntress best value, CrowdStrike Falcon Complete for response authority and Expel for transparency.
The article compares 12 managed detection and response providers across response authority, tool bundling and pricing, highlighting Huntress for published SMB pricing and CrowdStrike Falcon Complete for unilateral containment. It stresses the consolidation landscape: Sophos completed its acquisition of Secureworks in February 2025 for approximately $859 million, and Arctic Wolf closed its purchase of BlackBerry's Cylance endpoint assets the same month. It also warns that only full-response contract tiers isolate hosts and kill processes, while lower tiers only triage or guide.
15
55
60