Skip to content

Back to the catalog

Dark Caracal Reloaded: GoCaracal — New Go Malware With Ethereum-Based C2 Fallback
arcticwolf.comwriteup

Dark Caracal Reloaded: GoCaracal — New Go Malware With Ethereum-Based C2 Fallback

Arctic Wolf Labs documents GoCaracal, a previously undocumented modular Go-based malware framework attributed with medium confidence to Dark Caracal (linked to Lebanon's GDGS), deployed alongside an updated Bandook variant in a June 2026 intrusion against a Venezuelan communications organization. The extended GoCaracal build features a novel Ethereum smart-contract (BulletproofC2) fallback that lets operators update C2 addresses via on-chain transactions without redeploying malware, and analysis of 249 samples traces the framework's four-phase development from January to July 2026. The report includes delivery-chain details (SVG phishing, URL shorteners, Delphi loader), infrastructure analysis (AEZA Group, AlexHost hosting), a YARA rule, and IOCs for detection.

TL;DR Arctic Wolf exposes GoCaracal, Dark Caracal's new Go malware framework with an Ethereum smart-contract C2 fallback, deployed alongside Bandook against Latin American targets.
Open original ↗
Document

What it is

GoCaracal, a modular Go malware framework Arctic Wolf Labs attributes with medium confidence to Dark Caracal (Lebanon GDGS nexus), found in a June 2026 intrusion at a Venezuelan communications org alongside an updated Bandook. Two build profiles share one codebase: a lightweight access/loader implant and an extended full-spectrum RAT. The extended build's notable feature is an Ethereum smart-contract C2 fallback (contract named BulletproofC2).

How the Ethereum fallback works

The mechanism is a dead-drop for a C2 address, not a full on-chain channel. The implant config carries HOST, PORT, and optionally a CONTRACT address. After repeated failures reaching the primary C2, the malware issues an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a storage slot from the configured contract. If the returned value resolves to a valid address, it updates in-memory config and retries. BulletproofC2 is a custom Solidity contract holding one mutable C2 value, updatable only by the deploying owner via a normal blockchain transaction — so operators rotate C2 without redeploying binaries, and public RPC providers give many redundant read paths, defeating single-point takedown.

Attribution/dev evidence: the same wallet deployed identical contracts on the Sepolia testnet before mainnet; stored values included both public IPs and RFC 1918 addresses (development traces), confirming the capability was operationalized, not dormant.

Detection opportunities the page gives

The lightweight-build YARA rule keys on Go symbol names, firing on 5 of its strings. Distinctive markers:

main.detectAntivirus   main.InjectShellcode
main.injectShellcodeWoW64   main.handlePipeClient
readSecurePacket   SendSecurePacket
RPCFallback   insensate   main.lastInputInfo

Behavioral hunts implied by the report:

  • Process making eth_getStorageAt calls to public Ethereum RPC endpoints (highly anomalous for most hosts).
  • Extended build (34 handlers) capabilities: WebRTC-based desktop access, hidden VNC, cloning a local Chrome profile into a hidden browser session, in-band SOCKS5 proxy, keylogging, browser cookie/login-DB theft; persistence via registry-hive manipulation and a concealed NTUSER.MAN Run-key artifact.
  • Delivery chain: financial/tax-themed SVG phishing → Base64 shortened URL → redirector → getpdfdigital[.]cloud → 7-Zip archive → tf-oficina004a9.exe.

Infrastructure split

23 of 24 GoCaracal C2 addresses were on AEZA Group networks; Bandook C2 sat on AlexHost — a deliberate separation so takedown of one family's infra doesn't disrupt the other. Seven related Spanish-language document-themed domains form the delivery cluster.

Caveats

Attribution is medium confidence. Arctic Wolf did not recover the originating phishing email/SVG (inferred from >100 related SVGs on the same host). The updated Bandook replaced sequential command IDs (@0001–@0136) with randomized strings and obfuscated plugin exports — earlier signature/naming-based detections for Bandook will miss it. The full IOC list and packet-code reference are gated to customers; the public page carries only the lightweight YARA rule and referential indicators.

Organisations named here

  • AEZA Group
  • AlexHost
  • BulletproofC2
  • GDGS

Technologies named here

  • Communications organization in Venezuela
  • Aurora Managed Detection and Response
  • Aurora Superintelligence Platform
  • Chrome, Brave, and Firefox browsers
  • Ethereum Sepolia test network and Ethereum mainnet
  • YARA
  • Go
  • Ethereum
  • Solidity
  • Kaspersky

Techniques named here

  • Phishing delivery via weaponized SVG attachments
  • URL shortening and redirection services
  • Payload staging via 7-Zip archive
  • AES-GCM encrypted custom C2 packet protocol
  • Host/system reconnaissance
  • Numeric packet-identifier tasking dispatcher
  • Process injection / shellcode loading
  • Command-string based dispatcher with 34 handlers
  • Keylogging and credential/browser data collection
  • WebRTC-based remote desktop access and hidden VNC
  • SOCKS5 proxy tunneling
  • Registry-hive manipulation and Run-key persistence
  • Blockchain-based C2 fallback
  • Malware analysis evasion via identifier randomization
  • Infrastructure compartmentalization

Threat actors named here

  • Dark Caracal
  • GoCaracal
  • Bandook
  • AsioGate

Related in Threat Intel