Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback
The Lebanon-linked cyber espionage group targets Venezuela with a new malware.
1Dark Caracal's New Malware
Dark Caracal used a new malware called GoCaracal in a cyber attack targeting a communications organization in Venezuela. This malware works alongside an advanced Bandook toolkit and includes an Ethereum-based command and control (C2) fallback. Research by Arctic Wolf Labs links this attack to a cyber espionage group associated with Lebanon.
2GoCaracal's Functions
GoCaracal has two distinct build profiles: lightweight and extended. The lightweight profile handles basic functions like host profiling, encrypted C2, remote shell, payload download, and execution. The extended profile offers more comprehensive features such as file management, browser credential and cookie theft, keylogging, targeted file search, and WebRTC remote desktop.
3Ethereum-Based C2 Fallback
GoCaracal's most notable feature is its use of Ethereum smart contracts for C2 fallback. This method kicks in when the malware cannot reach its primary C2 server. The new C2 address is retrieved from the contract via an Ethereum JSON-RPC endpoint, allowing the malware to connect to the updated address. This enables attackers to change the C2 server without releasing a new version.
4Distribution via Phishing
GoCaracal is distributed through phishing emails with financial or tax themes. These emails contain weaponized SVG files that redirect victims via URL shorteners to attacker-controlled sites. These sites deliver malicious payloads and install GoCaracal on victims' systems. Arctic Wolf notes that this method was also used in Dark Caracal's previous campaigns.
5Parallel Operation with Bandook
GoCaracal complements Dark Caracal's existing toolkit but does not fully replace Bandook. Arctic Wolf states that both malwares operate in parallel, with GoCaracal potentially reducing future reliance on Bandook. The June 2026 Bandook sample includes anti-analysis tweaks, weakening signature-based detection based on older naming conventions.
6Dark Caracal's Past Campaigns
Dark Caracal has previously targeted organizations in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany. The group is known for cyber espionage activities against governments, businesses, journalists, and activists. It is believed to be linked to Lebanon's General Directorate of General Security.
7GoCaracal's Development Process
GoCaracal was analyzed across 249 samples from January to July 2026, revealing a clear development arc. Initially designed as an access implant, GoCaracal became modular over time and gained extended features. The addition of an Ethereum-based C2 fallback increased attackers' flexibility. This evolution shows continuous updates to the malware.
8Importance for Cybersecurity
GoCaracal stands out in the cybersecurity world with innovative features like Ethereum-based C2 fallback. Such malware makes it easier for attackers to sustain their operations and harder to detect them. Organizations need to be more vigilant against phishing attacks and update their cybersecurity measures.