2026-08-28 · view entry permalink →
GoCaracal: Dark Caracal's new Go-based malware framework uses an Ethereum smart contract as a resilient fallback channel to deliver replacement C2 addresses without redeploying the implant
Arctic Wolf Labs identified GoCaracal, a previously undocumented Go-based modular malware framework, deployed during a June 2026 intrusion at an unnamed communications organisation in Venezuela alongside an updated Bandook variant delivered via a Delphi loader. Analysis of 249 samples traces the framework's development across four phases from January through July 2026 and identifies two operational build profiles: a lightweight implant for initial access and payload delivery, and an extended build for sustained intelligence collection adding browser data theft, keylogging, remote desktop control and SOCKS5 proxying to the lightweight build's remote-shell and payload-execution core.
The extended variant's most notable feature is a blockchain-based C2 resilience mechanism: "after repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract's storage" (Arctic Wolf Labs, 2026-08-26) — reading a replacement C2 address from a smart contract's storage slot when a valid one is returned. "Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary" (Arctic Wolf Labs, 2026-08-26) — a takedown-resilient fallback channel that rides on infrastructure no defender or ISP is going to block wholesale.
"Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal", a cyberespionage group associated with Lebanon's General Directorate of General Security (Arctic Wolf Labs, 2026-08-26). "Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group's established focus on Latin America" (Arctic Wolf Labs, 2026-08-26).
Latin America is the confirmed victim region for this specific intrusion, but the technique class — blockchain smart-contract storage as a dead-drop resolver for C2 address rotation — is a genuinely novel resilience pattern transferable to any actor's infrastructure and worth a detection concept regardless of region. Triage: outbound JSON-RPC calls (eth_getStorageAt or similar Ethereum node RPC methods) from endpoint or server processes that have no legitimate business reason to talk to a blockchain node are a high-signal, low-noise behavioural indicator — most enterprise endpoints never make direct Ethereum RPC calls at all, so a query to any public Ethereum RPC endpoint from a non-blockchain-application process is the discriminator, rather than requiring a specific contract-address blocklist that the operator can trivially rotate away from.
After repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract's storage.
Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary.
Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal.
Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group's established focus on Latin America.