A newly identified malware framework called GoCaracal deployed Ethereum smart contracts to retrieve backup command-and-control server addresses, according to a technical report published by Arctic Wolf covering a June 2026 intrusion at a communications organization in Venezuela. The previously undocumented Go-based framework gives attackers remote shell access and payload execution capabilities, with an extended version adding browser data theft, keylogging, remote desktop control, and SOCKS5 proxying. Arctic Wolf links the activity to the Dark Caracal threat group with medium confidence.

The malware appeared in two configurations during the investigated breach: a lightweight profile and an extended profile, with the Bandook malware deployed alongside the lightweight version. The lightweight profile supports host profiling, an encrypted command-and-control channel, interactive shell access, payload retrieval and execution, and shellcode loading and injection. The extended profile adds system and file discovery, command execution, browser cookie and login-database collection, keylogging, targeted file search, WebRTC remote desktop, hidden browser interaction, SOCKS5 proxying, and persistence-related functionality. Arctic Wolf recovered more than 100 related SVG files that communicated with the same malicious hosting site, though investigators didn't recover the original phishing email or SVG attachment from the victim.

According to Arctic Wolf, the extended GoCaracal profile first attempts to communicate with its configured primary C2 server, then after repeated failures sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint to retrieve a replacement address stored in a configured smart contract. "This mechanism does not place the malware's full command-and-control channel on Ethereum," the report states. The firm assessed phishing as the delivery mechanism based on financial and tax-themed artifact naming, the established campaign pattern, and the volume of related SVG files. Arctic Wolf based its medium-confidence attribution to Dark Caracal on Bandook use, recurring Delphi-loader characteristics, Spanish-language financial lures, malicious SVGs, URL shorteners, document-themed infrastructure, hosting-provider preferences, and Latin American targeting.

The smart-contract fallback mechanism allows operators to change the replacement C2 address without distributing a new GoCaracal binary, and multiple public RPC endpoints can read the same contract state, reducing dependence on a single fallback access point. The report notes that current evidence does not establish GoCaracal as a replacement for Bandook, as the two were used in parallel during the intrusion. Related artifacts and infrastructure were associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay, though Arctic Wolf does not identify those locations as confirmed victim countries and provides no broader confirmed count of organizations compromised with GoCaracal. Dark Caracal has a documented history operating in Latin America, with The Hacker News covering the original Dark Caracal disclosure in 2018, retooled Bandook malware in 2020, and Bandook attacks in Venezuela in 2021.

Arctic Wolf published a YARA rule and representative indicators of compromise including SHA-256 hashes, related domains and IP addresses, Ethereum contract and wallet indicators, and host paths associated with the malware, noting the public indicators are referential and that the full set is available to Arctic Wolf customers. Organizations concerned about blockchain-based fallback mechanisms face a structural challenge: the same public infrastructure that makes Ethereum useful for legitimate applications also makes contract state globally readable and effectively impossible to block without severing access to the entire network. Regional defenders may need to weigh the operational trade-offs between broad blockchain access and the narrow risk posed by adversaries who embed failover logic in immutable ledgers.