Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela.
GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control, and SOCKS5 proxying.
Arctic Wolf also published a YARA rule and representative indicators of compromise (IoCs) that defenders can use to hunt for the malware.
“We assess with medium confidence that this activity is linked to Dark Caracal,” Arctic Wolf said.
Arctic Wolf based the assessment on Bandook use, recurring Delphi-loader characteristics, Spanish-language financial lures, malicious SVGs, URL shorteners, document-themed infrastructure, hosting-provider preferences, and Latin American targeting.
In its technical analysis of GoCaracal, Arctic Wolf said the malware appeared in lightweight and extended profiles during the investigated intrusion.
Bandook was subsequently deployed alongside the lightweight profile. It was used in parallel with GoCaracal, and Arctic Wolf said current evidence does not establish GoCaracal as a replacement for Bandook.
The lightweight profile supports host profiling, an encrypted command-and-control (C2) channel, interactive shell access, payload retrieval and execution, and shellcode loading and injection.
The extended profile adds system and file discovery, command execution, browser cookie and login-database collection, keylogging, targeted file search, Web Real-Time Communication (WebRTC) remote desktop, hidden browser interaction, SOCKS5 proxying, and persistence-related functionality.
Arctic Wolf assesses phishing as the delivery mechanism, although it did not recover the original phishing email or Scalable Vector Graphics (SVG) attachment from the victim. The firm based that assessment on financial and tax-themed artifact naming, the established campaign pattern, and more than 100 related SVG files that communicated with the same malicious hosting site.
The extended GoCaracal profile first attempts to communicate with its configured primary C2 server. After repeated failures, it sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint.
The response provides a replacement address stored in the configured smart contract. GoCaracal writes that address to its in-memory configuration. It then retries conventional off-chain C2 communication using the replacement address.
Multiple public RPC endpoints can be used to read the same contract state, reducing dependence on a single fallback access point. “This mechanism does not place the malware’s full command-and-control channel on Ethereum,” Arctic Wolf said.
The smart-contract mechanism lets the operator change the replacement C2 address without shipping a new GoCaracal binary.
Arctic Wolf’s public report does not show a host in the June intrusion that invoked the fallback and successfully reconnected through the replacement address.
Dark Caracal has a documented history of operating in Latin America. The Hacker News covered the original Dark Caracal disclosure in 2018, followed by retooled Bandook malware in 2020 and Bandook attacks in Venezuela in 2021.
Arctic Wolf said related artifacts and infrastructure were associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay, assessing that broader regional activity with moderate confidence. Arctic Wolf does not identify those locations as confirmed victim countries.
The public report provides no broader confirmed count of organizations compromised with GoCaracal.
The Hacker News contacted Arctic Wolf for clarification on whether the Ethereum fallback was observed executing on an infected host and on the confirmed scope of the campaign; Arctic Wolf had not responded at the time of publication.
Arctic Wolf shared the following indicators of compromise (IoCs) –
- A YARA rule for the lightweight GoCaracal profile.
- Representative SHA-256 hashes and related domains and IP addresses.
- Ethereum contract and wallet indicators.
- Host paths associated with the malware.
The company said the public indicators are referential and that the full set is available to Arctic Wolf customers.
