GoCaracal: Dark Caracal's new Go-based malware framework uses an Ethereum smart contract as a resilient fallback channel to deliver replacement C2 addresses without redeploying the implant
Arctic Wolf Labs identified GoCaracal, a previously undocumented Go-based modular malware framework, deployed during a June 2026 intrusion at an unnamed communications organisation in Venezuela alongside an updated Bandook variant delivered via a Delphi loader. Analysis of 249 samples traces the framework's development across four phases from January through July 2026 and identifies two operational build profiles: a lightweight implant for initial access and payload delivery, and an extended build for sustained intelligence collection adding browser data theft, keylogging, remote desktop control and SOCKS5 proxying to the lightweight build's remote-shell and payload-execution core.
The extended variant's most notable feature is a blockchain-based C2 resilience mechanism: "after repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract's storage" (Arctic Wolf Labs, 2026-08-26) — reading a replacement C2 address from a smart contract's storage slot when a valid one is returned. "Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary" (Arctic Wolf Labs, 2026-08-26) — a takedown-resilient fallback channel that rides on infrastructure no defender or ISP is going to block wholesale.
"Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal", a cyberespionage group associated with Lebanon's General Directorate of General Security (Arctic Wolf Labs, 2026-08-26). "Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group's established focus on Latin America" (Arctic Wolf Labs, 2026-08-26).
Latin America is the confirmed victim region for this specific intrusion, but the technique class — blockchain smart-contract storage as a dead-drop resolver for C2 address rotation — is a genuinely novel resilience pattern transferable to any actor's infrastructure and worth a detection concept regardless of region. Triage: outbound JSON-RPC calls (eth_getStorageAt or similar Ethereum node RPC methods) from endpoint or server processes that have no legitimate business reason to talk to a blockchain node are a high-signal, low-noise behavioural indicator — most enterprise endpoints never make direct Ethereum RPC calls at all, so a query to any public Ethereum RPC endpoint from a non-blockchain-application process is the discriminator, rather than requiring a specific contract-address blocklist that the operator can trivially rotate away from.
After repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract's storage.
Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary.
Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal.
Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group's established focus on Latin America.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1102.001Web Service: Dead Drop Resolver
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Exfiltration TA0010
T1041Exfiltration Over C2 Channel
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.