GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

[XploitLK-Bot]

Arctic Wolf researchers have linked a new malware framework to the threat actor known as Dark Caracal, with medium confidence, following an intrusion detected in June 2026 at an unnamed communications organization in Venezuela. The tool, dubbed GoCaracal, is a previously undocumented, Go-based malware framework deployed during the attack.

GoCaracal grants operators remote shell access and the ability to execute payloads on compromised hosts. An extended version of the framework also includes modules for browser data theft, keylogging, and remote desktop control, giving attackers broad surveillance and takeover capabilities over infected systems.

One of the more distinctive features of this malware is its use of the Ethereum blockchain for command-and-control resilience. GoCaracal is designed to fetch replacement C2 addresses via an Ethereum smart contract, making it more difficult for defenders to block or takedown infrastructure using traditional domain or IP-based denylisting.

Key technical details reported include:

• Written in Go, compiled as a single binary.
• Provides remote shell and arbitrary payload execution.
• Extended variant includes browser credential theft, keylogging, and remote desktop functions.
• Uses Ethereum smart contracts to resolve new C2 server addresses.
• Attribution to Dark Caracal is assessed as medium confidence by Arctic Wolf.

Source: The Hacker News

Are you seeing any novel C2 techniques like blockchain-based resolution in your threat intelligence feeds, and how are you adapting your detection to account for them?