GoCaracal malware uses Ethereum as a C2 fallback

Arctic Wolf Labs has documented GoCaracal, a previously undocumented Go malware framework whose extended build can pull a replacement command-and-control address out of an Ethereum smart contract when its normal C2 goes dark, per its research report published August 26. The researchers assess with medium confidence that the activity links to Dark Caracal, the espionage cluster historically tied to Lebanon's General Directorate of General Security, and they say plainly that attribution "may evolve with new evidence." Treat this as vendor research on a new tool and an analytical judgment on the actor, not a government finding.

Name the instrument

This is a threat-research report, not a CVE and not a mass ransomware outbreak. Arctic Wolf found GoCaracal during a June 2026 intrusion at a communications organization in Venezuela, then mapped it back across 249 related samples collected from January through July 2026. The framework ships in two build profiles from a shared codebase: a lightweight build for access and payload delivery, with host profiling, encrypted C2, a remote shell and shellcode injection; and an extended build for collection, with browser data theft, keylogging, SOCKS proxying, WebRTC remote desktop and persistence. Both were present in the same June intrusion, and the extended build exposed 34 command handlers across internal versions v1.0.1 through v1.0.6.

The Ethereum part is a dead-drop, not the channel

The blockchain twist is narrow, and getting it right matters. GoCaracal does not run its C2 on Ethereum and has nothing to do with crypto mining. Instead, after repeated failures reaching its primary C2, the extended build sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint, reads a value stored in a configured smart contract, and writes that value into its in-memory host configuration to retry. Ethereum is a resilient dead-drop for a replacement C2 address, so the operators can rotate infrastructure without touching the implant.

Arctic Wolf names the Solidity contract BulletproofC2, at configured address 0x03D605f13A74Bfb6149078122FcF62BD6d8799d8, deployed May 20, 2026, with a management wallet at 0x7D321FE277f8c25aaC14aF1BA3Fc34953242052F. Some identical contracts appeared first on the Sepolia testnet and then on mainnet, and the stored values included public IP addresses alongside private RFC 1918 addresses that look like development and testing. The transaction history tells the researchers this was tested and operationalized rather than dormant code, but Arctic Wolf does not claim the fallback actually fired during the June intrusion.

Alongside Bandook, not instead of it

GoCaracal did not arrive alone. It was deployed next to an updated Bandook variant delivered by a Delphi loader, the long-running staple of this cluster. Arctic Wolf frames GoCaracal as augmenting Bandook, with two families running in parallel and the newer tool possibly reducing future reliance on the old one, so this is not a case of the actor abandoning Bandook. The infrastructure split reinforces the pairing: 23 of 24 unique GoCaracal C2 addresses sat on networks operated by AEZA Group, while the Bandook C2s used AlexHost, a host previously associated with Dark Caracal.

Delivery leaned on Spanish-language financial and tax lures carrying weaponized SVG attachments, which routed victims through URL shorteners to a staging site at getpdfdigital[.]cloud that served a 7-Zip archive holding the lightweight implant. Arctic Wolf confirms Venezuela and assesses activity across several other Latin American countries with only moderate confidence, so the geographic spread is a lead, not a proven regional campaign.

What to do

Hunt the on-chain behavior first, because it is the cheapest tell to catch and the hardest for the operators to change: alert on outbound eth_getStorageAt calls to public Ethereum JSON-RPC endpoints from hosts that have no business touching a blockchain, and watch for reads against the BulletproofC2 contract address above. Pair that with checks for the SVG-to-shortener-to-7-Zip delivery chain and for beacons to the AEZA-hosted C2 range. The lure language and the Bandook pairing are consistent enough to build detections around now, before the next infrastructure rotation lands from the smart contract.

For related threat coverage, see our reporting on the CISA KEV additions for ownCloud, Linux and Artifactory and the OpenAI and Hugging Face incident report.