GoCaracal is a malware framework not seen before, deployed in June 2026 during a breach involving an (unnamed) organization in Venezuela. Arctic Wolf’s analysis shows that the attackers used this Go-based tool not only to gain remote shell access and execute payloads, but also to enable additional functionality such as keylogging, browser data theft, and remote desktop control.
What makes GoCaracal especially interesting for defenders is the way its command-and-control (C2) network communications can “switch over.” If the primary C2 address is unreachable, the malware queries a replacement C2 address via a public Ethereum JSON-RPC endpoint, pulling it from the status of a smart contract. This allows the operator to provide a new address without having to distribute a new binary build. In this article, we summarize the key characteristics and provide concrete leads to help you hunt for related traces.
What is GoCaracal, and what is it meant to do?
According to Arctic Wolf, GoCaracal is a Go-based malware framework that enables operators to deploy it using two profiles: a lightweight profile and an extended profile. Both profiles support core capabilities, but the extended profile expands the functionality further.
In general terms, GoCaracal helps carry out malicious actions on the compromised host—such as interactive shell access and fetching and executing payloads. In addition, the framework is used for more advanced information collection and control, depending on which profile is used.
Lightweight profile: core C2 and shell functions
The lightweight profile includes host profiling, an encrypted command-and-control channel, and interactive shell access. The profile also supports retrieving additional payloads, and loading and injecting shellcode.
Arctic Wolf links this profile to a previously observed pattern in the campaign, and therefore publishes a YARA rule for defenders. With that rule and the associated indicators of compromise (IoCs), teams can search more specifically for the traits of this lightweight behavior.
Extended profile: browser data, keylogging, remote desktop, and proxying
While the lightweight profile sets up the “basics,” the extended profile adds extra options for data collection and control.
The analysis lists, among other features, the following:
- System and file discovery to understand what is present on the host.
- File-targeted actions, such as searching for files of interest.
- Browser cookie and login database collection (focused on credentials and sessions).
- Keylogging to capture keystrokes.
- WebRTC remote desktop and interaction with the browser in the background (hidden browser interaction).
- SOCKS5 proxying to redirect network traffic through the compromised machine.
- Functionality related to persistence to maintain control longer.
This combination fits intrusions where attackers don’t just want access, but also want to actively surveil and move laterally.
The connection to Dark Caracal: why Arctic Wolf makes this assessment
Arctic Wolf states that the activity, medium confidence, is linked to Dark Caracal (via the “Dark Caracal / ‘Bandook’-history” associated with the actor). The reasoning is multi-factor: it references the use of Bandook, recurring Delphi-loader characteristics, financially and tax-driven lures in Spanish, malicious SVG files, the use of URL shorteners, and preferences in hosting infrastructure.
The report also mentions that the intrusion started in June 2026 with phishing as the likely delivery route. At the same time, Arctic Wolf says the original phishing email and the specific SVG attachment were not found on the victim.
For timeline and context: there was earlier (in 2018) attention for a first disclosure about Dark Caracal. Later updates followed with modified Bandook malware (including around 2020) and Bandook activity in Venezuela in 2021.
Bandook and GoCaracal side by side: which replaces which?
Arctic Wolf describes that during the investigated intrusion, Bandook was used alongside GoCaracal. In that case, it involved parallel usage with the lightweight profile. However, Arctic Wolf concludes that the available evidence does not show that GoCaracal fully replaces Bandook.
In other words, GoCaracal appears here to be an additional framework (or a component of a broader toolkit), not necessarily the “new standard” that immediately replaces existing malware.
GoCaracal C2 address via an Ethereum smart contract
The most distinctive aspect of the framework is the C2 fallback tied to Ethereum. The extended profile first tries to connect to its configured primary C2 server. If those attempts repeatedly fail, GoCaracal switches to a mechanism that uses public Ethereum JSON-RPC endpoints.
Specifically, the malware sends an eth_getStorageAt request to a public RPC endpoint. The result contains the replacement value—a C2 address—stored in the state of a smart contract. The malware then writes that replacement address into an in-memory configuration and attempts the “off-chain” C2 communication again using the replacement address.
Arctic Wolf highlights two key points:
- Ethereum is not used as a full C2 transport layer. The chain is mainly intended to replace an address reference or pointer.
- Multiple public RPC endpoints can be used to read the same contract state. This reduces reliance on a single fallback access point.
The practical impact is that the operator can adjust the C2 instruction simply by changing the smart-contract value. That means there’s no need to distribute a new GoCaracal binary every time the C2 address changes.
Why this makes detection harder
If an attacker gains control over a fallback mechanism, it becomes more difficult for defensive teams to rely solely on fixed C2 domains or fixed IP addresses. Instead, network behavior can vary based on the contract state on Ethereum.
Arctic Wolf also notes that the public report does not show which host in the investigated intrusion invoked the fallback path and then successfully reconnected using the replacement address. As a result, the exact “observation rate” in the public context cannot be fully verified.
IoCs and YARA: what defenders can hunt for
Arctic Wolf publishes multiple types of indicators in the report. These include:
- A YARA rule for the lightweight GoCaracal profile.
- Representative SHA-256 hashes along with associated domains and IP addresses (reference IoCs).
- Ethereum contract and wallet indicators (such as contract and wallet details that help link the C2 fallback to the smart-contract state).
- Host paths that align with the malware behavior.
Arctic Wolf also states that the public indicators are reference only, and that the full set is available for Arctic Wolf customers.
Practical tips: how to recognize GoCaracal-related behavior
Even though exact implementation details vary per incident, these points give teams guidance when hunting:
- Combine file and behavioral signals: match hashes and YARA to malware characteristics, but also look at runtime behavior such as shellcode injection, interactive shell patterns, and encrypted C2 communications.
- Watch for browser and credential activity: the extended profile includes cookie and login data collection as well as keylogging. Detect anomalies in access to browser databases and unusual sources of remote desktop traffic.
- Monitor network reconnections after C2 failure: if the primary C2 repeatedly fails, a new C2 address may be used later. Set alerting around the pattern “first failed connections, then a new target domain/IP.”
- Check Ethereum-related context: because the fallback state comes from smart contract storage, it can be useful for threat hunting to look for correlations with the contract and wallet indicators mentioned in the report (to the extent relevant in your environment).
For additional context on C2 and malware chains, you can also review earlier incident write-ups on this site—for example, about FTP banners as dead drops for malware commands. Mechanisms like these act as a comparable “infrastructure layer,” allowing attackers to translate commands or configuration without everything being directly visible from a single fixed point.
Focus on Latin America and scope uncertainty
Arctic Wolf associates the related artifacts and infrastructure with multiple countries in Latin America, including Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay. At the same time, the organization states that those locations should not be treated as confirmed victim countries; they are associations with infrastructure and artifacts.
Additionally, the public report lacks a broad, confirmed count of the number of organizations compromised with GoCaracal. That means you can only estimate the real-world impact by using additional internal logging, threat hunting, and external enrichment.
Conclusion: Ethereum as a flexible key for C2 addresses
GoCaracal demonstrates how modern malware combines more than attack techniques (remote shell, payload execution, keylogging, and proxying)—it also makes the command-and-control layer smarter. The GoCaracal C2 address fallback via an Ethereum smart contract allows operators to activate replacement addresses without having to roll out new binaries each time.
For defenders, the key takeaway is to broaden detection: move beyond a single fixed C2 list and combine indicators (YARA, IoCs, hashes) with behavioral observations on endpoints and across the network. With this approach, it becomes harder for attackers to work undetected through contract state and fallback routes.
Source: https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html
