Arctic Wolf Labs uncovered GoCaracal, a previously undocumented modular Go-based malware framework linked with medium confidence to Dark Caracal, a cyberespionage group tied to Lebanon's GDGS. Deployed alongside an updated Bandook variant during a June 2026 intrusion against a Venezuelan communications organization, GoCaracal comes in lightweight and extended build profiles. Analysis of 249 samples traces its development from January to July 2026, revealing an Ethereum smart-contract-based C2 fallback mechanism (dubbed BulletproofC2) that lets operators update command-and-control addresses via blockchain transactions rather than redeploying malware. The campaign targets Latin America broadly, with infrastructure and delivery patterns (SVG phishing, financial lures, Spanish-language themes) consistent with prior Dark Caracal operations documented by Kaspersky. GoCaracal appears to complement rather than replace Bandook for now.
Table of contents
Key FindingsFrom AsioGate to GoCaracal: What Changed?How Dark Caracal Delivered GoCaracalGoCaracal: One Framework, Two Operational ProfilesFrom Access Implant to Full-Spectrum RATAn Ethereum Smart Contract as a C2 Safety NetGoCaracal Is Augmenting, Not Yet Replacing, BandookThe Wider Dark Caracal CampaignConclusionHow Arctic Wolf Protects Its CustomersAppendixQuestions this post answers
What is GoCaracal malware and how does it use Ethereum for command and control?
GoCaracal is a modular Go-based malware framework attributed to the Dark Caracal threat group, discovered by Arctic Wolf Labs during a June 2026 intrusion in Venezuela. Its extended build includes an optional Ethereum smart-contract fallback: when primary C2 fails, the malware queries a public Ethereum JSON-RPC endpoint via eth_getStorageAt to retrieve a replacement C2 address from a contract called BulletproofC2, avoiding the need to redeploy the malware. Security teams tracking novel C2 techniques like blockchain fallback follow threat research on daily.dev.
How does GoCaracal relate to Bandook malware used by Dark Caracal?
GoCaracal and Bandook are currently operating in parallel rather than one replacing the other. During the June 2026 intrusion, Arctic Wolf found lightweight GoCaracal used as an access implant that led to deployment of an updated Bandook variant alongside an extended GoCaracal build, with GoCaracal's capabilities overlapping much of Bandook's remote-access and collection functionality, suggesting a possible future reduction in Bandook reliance. Analysts comparing overlapping malware toolkits can keep up with APT tradecraft shifts on daily.dev.
What operational security changes did Dark Caracal make to Bandook to evade detection?
The June 2026 Bandook sample replaced sequential command identifiers (previously documented as ranges like @0001 through @0136) with randomized strings and obfuscated plugin export names using generic identifiers, reducing the effectiveness of signatures based on earlier naming conventions. This sample also included about 82 command handlers, fewer than some earlier variants, and collected browser credentials from Chrome, Brave, and Firefox. Reverse engineers tracking evasion technique changes in known malware families can follow this on daily.dev.