GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
This story is only covered by news sources that have yet to be evaluated by the independent media monitoring agencies we use to assess the quality and reliability of news outlets on our platform. Learn more here.4 Articles
4 Articles
GoCaracal malware represents a new step in the evolution of threats directed to Latin America. Discovered by Arctic Wolf Labs during an intrusion investigation against a communications organization in Venezuela, the framework combines traditional remote access capabilities with an unusual technique: using blockchain Ethereum as a contingency source to discover new addresses of command and control servers (C2). The case draws attention to why it …
Dark Caracal's New Malware GoCaracal: From SVG Phishing to Ethereum Backup C2
1. Basic Information Article Title: Dark Caracal Reloaded: New Malware, Same Hunting Grounds Publisher: Arctic Wolf Labs Publication Date: 2026-08-26 Source: Arctic Wolf Labs Related Sources: Dark Reading, Kaspersky Dark Caracal campaign report Related Malware, Threat Groups, CVEs, Products: GoCaracal, Bandook, AsioGate, Dark Caracal, Microsoft Windows, Ethereum JSON-RPC Severity: High 2. Executive Summary Dark Caracal delivers a lightwei…
A new malware framework in two different versions and an evasive mechanism via the Ethereum blockchain: Arctic Wolf Labs has discovered the previously undocumented malware "GoCaracal" in an investigation of a targeted attack on an organization from the communications sector in Venezuela. Arctic Wolf assigns the attack with medium-security to the cyberspionage group Dark Caracal. The most important findings [...] Arctic Wolf Labs discovers new ma…
GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control
Coverage Details
Bias Distribution
- There is no tracked Bias information for the sources covering this story.
Factuality
To view factuality data please Upgrade to Premium
