Cybersecurity firm Arctic Wolf has uncovered a previously unknown Go-based malware framework dubbed “GoCaracal,” believed with medium confidence to be tied to the Dark Caracal group. The malware was used in a June 2026 breach at an unnamed communications company in Venezuela. GoCaracal offers remote shell access and payload execution; a more advanced version adds tools like browser data theft, keylogging, remote desktop control, and SOCKS5 proxying. It complements, rather than replaces, the Bandook malware seen in parallel during the intrusion.
Profiles, Delivery, and Capabilities
GoCaracal comes in two configurations: lightweight and extended. The lightweight profile includes features like host profiling, an encrypted command-and-control (C2) channel, shellcode loading and injection, payload retrieval, and execution. The extended profile builds on that by enabling system-wide reconnaissance, file discovery, keylogging, browsing credential theft, targeted file search, remote desktop control via WebRTC, hidden browser interaction, SOCKS5 proxy support, and persistence.
Phishing seems to be the infection vector, based on recurring artifact themes around finance and taxation, the involvement of more than 100 malicious SVG files hosted on related infrastructure, and other campaign patterns seen in past Dark Caracal activity. Although the original phishing email wasn’t recovered, these patterns and file types strongly suggest it served as the entry point.
Ethereum Smart Contract Used for Dynamic C2 Failover
A standout mechanism in GoCaracal’s architecture is its Ethereum-based fallback system for updating its C2 server address. When the malware’s extended profile fails to reach its primary C2 server after repeated attempts, it triggers an eth_getStorageAtrequest via a public Ethereum JSON-RPC endpoint. That request queries a smart contract’s storage slot, retrieving a replacement C2 address stored on-chain. GoCaracal then updates its in-memory config and retries connecting off-chain using the new address.
This method allows the operator to switch out C2 endpoints without distributing a new GoCaracal binary. Multiple public RPC endpoints can serve this contract state, reducing dependence on any single fallback path. Despite this, the full C2 channel does not operate on-chain. In the reported intrusion, there was no confirmation that a host actually used the fallback mechanism to successfully reconnect through a replacement address.
Geographic Reach and Attribution
Arctic Wolf ties GoCaracal’s infrastructure and tooling to prior Dark Caracal operations via similarities such as use of Spanish-language lures, loading techniques, infrastructure preferences, and targeting of Latin America. Countries like Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay are linked to artifacts and infrastructure, though not all are confirmed as victims.
The public report provides no definitive count of impacted organizations, but shares indicators of compromise (IoCs) including a YARA rule for the lightweight profile, SHA-256 hashes, domains and IPs, Ethereum contract and wallet IDs, and related file-paths. Full IoC data is reserved for Arctic Wolf clients.
This discovery reveals both increasing sophistication among threat actors and creative use of blockchain tech for operational flexibility. Tracking GoCaracal will be crucial for security teams, particularly in Latin America, where Dark Caracal has previously operated. Monitoring Ethereum contracts, public RPC endpoints, and related IoCs should be a priority. Adversaries using on-chain infrastructure underscores the need for defenders to broaden threat hunting beyond conventional endpoints and network traffic.
