CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

GoCaracal

malware · malware:gocaracal single-source

Previously undocumented Go-based modular malware framework with lightweight and extended build profiles (remote shell, payload execution, browser data theft, keylogging, RDP control, SOCKS5 proxying); the extended build uses an Ethereum smart contract as a fallback C2-address resolver via eth_getStorageAt JSON-RPC calls. Linked with medium confidence to Dark Caracal (Arctic Wolf Labs, 2026-08-26).

Coverage
1
first 2026-08-28 → last 2026-08-28
Latest activity
2026-08-28
A malware family reads its own next command-and-control address off the public blockchain; infrastructure no…
Peak priority
notable
1 notable
Targets
telco
sectors: telco · regions: latam
Sources cited
1
1 hosts

Defender insights

What each entry about GoCaracal tells a defender to do, newest first.

2026-08-28NOTABLEA malware family reads its own next command-and-control address off the public blockchain; infrastructure no defender or ISP is going to block wholesale

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

Story timeline

  1. 2026-08-28GoCaracal: Dark Caracal's new Go-based malware framework uses an Ethereum smart contract as a resilient fallback channel to deliver replacement C2 addresses without redeploying the implant
    active-threatsA malware family reads its own next command-and-control address off the public blockchain; infrastructure no defender or ISP is going to block wholesale

Hunting pivots

Tags
botnetespionage
ATT&CK techniques (3 across 2 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Command and ControlApplication Layer Protocol: Web Protocols · Web Service: Dead Drop Resolver
  • ExfiltrationExfiltration Over C2 Channel

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-08-28/gocaracal-dark-caracal-ethereum-smart-contract-c2 · ATT&CK page ↗

T1102.001Web Service: Dead Drop Resolver×1

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-08-28/gocaracal-dark-caracal-ethereum-smart-contract-c2 · ATT&CK page ↗

Exfiltration TA0010

T1041Exfiltration Over C2 Channel×1

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Evidence: 2026-08-28/gocaracal-dark-caracal-ethereum-smart-contract-c2 · ATT&CK page ↗

Entries about GoCaracal (1)

2026-08-28 · view entry permalink →

NOTABLENATOB2

GoCaracal: Dark Caracal's new Go-based malware framework uses an Ethereum smart contract as a resilient fallback channel to deliver replacement C2 addresses without redeploying the implant

Arctic Wolf Labs identified GoCaracal, a previously undocumented Go-based modular malware framework, deployed during a June 2026 intrusion at an unnamed communications organisation in Venezuela alongside an updated Bandook variant delivered via a Delphi loader. Analysis of 249 samples traces the framework's development across four phases from January through July 2026 and identifies two operational build profiles: a lightweight implant for initial access and payload delivery, and an extended build for sustained intelligence collection adding browser data theft, keylogging, remote desktop control and SOCKS5 proxying to the lightweight build's remote-shell and payload-execution core.

The extended variant's most notable feature is a blockchain-based C2 resilience mechanism: "after repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract's storage" (Arctic Wolf Labs, 2026-08-26), reading a replacement C2 address from a smart contract's storage slot when a valid one is returned. "Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary" (Arctic Wolf Labs, 2026-08-26), a takedown-resilient fallback channel that rides on infrastructure no defender or ISP is going to block wholesale.

"Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal", a cyberespionage group associated with Lebanon's General Directorate of General Security (Arctic Wolf Labs, 2026-08-26). "Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group's established focus on Latin America" (Arctic Wolf Labs, 2026-08-26).

Latin America is the confirmed victim region for this specific intrusion, but the technique class (blockchain smart-contract storage as a dead-drop resolver for C2 address rotation) is a genuinely novel resilience pattern transferable to any actor's infrastructure and worth a detection concept regardless of region. Triage: outbound JSON-RPC calls (eth_getStorageAt or similar Ethereum node RPC methods) from endpoint or server processes that have no legitimate business reason to talk to a blockchain node are a high-signal, low-noise behavioural indicator; most enterprise endpoints never make direct Ethereum RPC calls at all, so a query to any public Ethereum RPC endpoint from a non-blockchain-application process is the discriminator, rather than requiring a specific contract-address blocklist that the operator can trivially rotate away from.

After repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract's storage.

Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary.

Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal.

Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group's established focus on Latin America.

Arctic Wolf Labs 2026-08-26
threat28 Aug 06:25Zsingle-sourceOpen finding →
Sources: Arctic Wolf Labs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • arcticwolf.com1 (100%)
All cited sources (1)