GoCaracal malware uses Ethereum as a C2 fallback

Arctic Wolf Labs documented GoCaracal, a previously undocumented Go malware framework whose extended build can pull a replacement command-and-control address out of an Ethereum smart contract when its normal C2 goes dark, per its research report published August 26. The researchers assess with medium confidence that the activity links to Dark Caracal, the espionage cluster historically tied to Lebanon's General Directorate of General Security, and they say plainly that attribution "may evolve with new evidence."

Arctic Wolf found GoCaracal during a June 2026 intrusion at a communications organization in Venezuela, then mapped it back across 249 related samples collected from January through July 2026. The framework ships in two build profiles from a shared codebase: a lightweight build for access and payload delivery, with host profiling, encrypted C2, a remote shell and shellcode injection; and an extended build for collection, with browser data theft, keylogging, SOCKS proxying, WebRTC remote desktop and persistence. Both were present in the same June intrusion, and the extended build exposed 34 command handlers across internal versions v1.0.1 through v1.0.6.

GoCaracal does not run its C2 on Ethereum and has nothing to do with crypto mining. After repeated failures reaching its primary C2, the extended build sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint, reads a value stored in a configured smart contract, and writes that value into its in-memory host configuration to retry. Ethereum is a resilient dead-drop for a replacement C2 address, so the operators can rotate infrastructure without touching the implant.

Arctic Wolf names the Solidity contract BulletproofC2, at configured address 0x03D605f13A74Bfb6149078122FcF62BD6d8799d8, deployed May 20, 2026, with a management wallet at 0x7D321FE277f8c25aaC14aF1BA3Fc34953242052F. Some identical contracts appeared first on the Sepolia testnet and then on mainnet, and the stored values included public IP addresses alongside private RFC 1918 addresses that look like development and testing. The transaction history tells the researchers this was tested and operationalized rather than dormant code, but Arctic Wolf does not claim the fallback actually fired during the June intrusion.

GoCaracal was deployed next to an updated Bandook variant delivered by a Delphi loader, the long-running staple of this cluster. Arctic Wolf frames GoCaracal as augmenting Bandook, with two families running in parallel and the newer tool possibly reducing future reliance on the old one. The infrastructure split reinforces the pairing: 23 of 24 unique GoCaracal C2 addresses sat on networks operated by AEZA Group, while the Bandook C2s used AlexHost, a host previously associated with Dark Caracal.

Delivery leaned on Spanish-language financial and tax lures carrying weaponized SVG attachments, which routed victims through URL shorteners to a staging site at getpdfdigital[.]cloud that served a 7-Zip archive holding the lightweight implant. Arctic Wolf confirms Venezuela and assesses activity across several other Latin American countries with only moderate confidence, so the geographic spread is a lead, not a proven regional campaign.

Some offers on this page may be paid placements or contain affiliate links.