Ethical Hacking News
Arctic Wolf uncovers a sophisticated new malware framework known as GoCaracal, linked to the notorious Dark Caracal group, which provides operators with remote shell access and payload execution, as well as browser data theft and keylogging capabilities. The malware's use of an Ethereum smart contract to fetch a replacement C2 address makes it a more flexible and adaptable threat.
GoCaracal is a sophisticated new malware framework linked to the notorious Dark Caracal group. The malware provides remote shell access and payload execution, as well as extended profile capabilities such as browser data theft and keylogging. The malware uses an Ethereum smart contract to fetch a replacement C2 address, making it more flexible and adaptable. Arctic Wolf assesses phishing as the delivery mechanism for the malware. The malware's use of public RPC endpoints reduces dependence on a single fallback access point, making it more stealthy and adaptable. GoCaracal has been linked to multiple countries, including Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay.
The cybersecurity landscape has recently been hit with a sophisticated new malware framework known as GoCaracal, which has been linked to the notorious Dark Caracal group. According to recent reports from Arctic Wolf, a leading cybersecurity firm, GoCaracal has been deployed by threat actors during a June 2026 intrusion at an unnamed communications organization in Venezuela.
Arctic Wolf's assessment of the malware framework reveals that GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control, and SOCKS5 proxying. This is a significant escalation in the capabilities of the malware, which was previously linked to the Dark Caracal group.
The malware's use of an Ethereum smart contract to fetch a replacement C2 address is a notable feature of GoCaracal. This allows operators to change the replacement C2 address without shipping a new GoCaracal binary, making it a more flexible and adaptable malware framework. Arctic Wolf notes that this mechanism reduces dependence on a single fallback access point, making it more difficult for defenders to detect and mitigate the threat.
Arctic Wolf's technical analysis of GoCaracal reveals that the malware appeared in both lightweight and extended profiles during the investigated intrusion. Bandook was subsequently deployed alongside the lightweight profile, and Arctic Wolf notes that current evidence does not establish GoCaracal as a replacement for Bandook.
The lightweight profile of GoCaracal supports host profiling, an encrypted command-and-control (C2) channel, interactive shell access, payload retrieval and execution, and shellcode loading and injection. The extended profile adds system and file discovery, command execution, browser cookie and login-database collection, keylogging, targeted file search, Web Real-Time Communication (WebRTC) remote desktop, hidden browser interaction, SOCKS5 proxying, and persistence-related functionality.
Arctic Wolf assesses phishing as the delivery mechanism for the malware, although it did not recover the original phishing email or Scalable Vector Graphics (SVG) attachment from the victim. The firm based its assessment on financial and tax-themed artifact naming, the established campaign pattern, and more than 100 related SVG files that communicated with the same malicious hosting site.
The extended GoCaracal profile first attempts to communicate with its configured primary C2 server. After repeated failures, it sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint. The response provides a replacement address stored in the configured smart contract. GoCaracal writes that address to its in-memory configuration. It then retries conventional off-chain C2 communication using the replacement address.
Multiple public RPC endpoints can be used to read the same contract state, reducing dependence on a single fallback access point. Arctic Wolf notes that this mechanism does not place the malware's full command-and-control channel on Ethereum, making it a more stealthy and adaptable threat.
Arctic Wolf's public report provides no broader confirmed count of organizations compromised with GoCaracal. However, the firm notes that related artifacts and infrastructure were associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay, assessing that broader regional activity with moderate confidence.
In conclusion, the discovery of GoCaracal malware framework linked to Dark Caracal highlights the evolving nature of cyber threats and the importance of staying vigilant in the fight against malware. Arctic Wolf's analysis provides valuable insights into the capabilities and mechanisms of the malware, and its report serves as a warning to organizations and individuals alike.
Related Information:
https://www.ethicalhackingnews.com/articles/Arctic-Wolf-Uncovers-Sophisticated-GoCaracal-Malware-Framework-Linked-to-Dark-Caracal-ehn.shtml
https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html
Published: Sat Aug 29 21:53:46 2026 by llama3.2 3B Q4_K_M
