--- title: Dark Caracal Reloaded: New Malware, Same Hunting Grounds description: Arctic Wolf Labs uncovered GoCaracal, a previously undocumented modular Go-based malware framework linked with medium confidence to Dark Caracal, a... canonical: https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Dark Caracal Reloaded: New Malware, Same Hunting Grounds | daily.dev og:description: Arctic Wolf Labs uncovered GoCaracal, a previously undocumented modular Go-based malware framework linked with medium confidence to Dark Caracal, a... og:url: https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq og:image: https://api.daily.dev/og/posts/anLuzRNzq.png og:image:alt: Dark Caracal Reloaded: New Malware, Same Hunting Grounds og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Dark Caracal Reloaded: New Malware, Same Hunting Grounds **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 15 min read · 0 upvotes · 0 comments ## Summary Arctic Wolf Labs uncovered GoCaracal, a previously undocumented modular Go-based malware framework linked with medium confidence to Dark Caracal, a cyberespionage group tied to Lebanon's GDGS. Deployed alongside an updated Bandook variant during a June 2026 intrusion against a Venezuelan communications organization, GoCaracal comes in lightweight and extended build profiles. Analysis of 249 samples traces its development from January to July 2026, revealing an Ethereum smart-contract-based C2 fallback mechanism (dubbed BulletproofC2) that lets operators update command-and-control addresses via blockchain transactions rather than redeploying malware. The campaign targets Latin America broadly, with infrastructure and delivery patterns (SVG phishing, financial lures, Spanish-language themes) consistent with prior Dark Caracal operations documented by Kaspersky. GoCaracal appears to complement rather than replace Bandook for now. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is GoCaracal malware and how does it use Ethereum for command and control? GoCaracal is a modular Go-based malware framework attributed to the Dark Caracal threat group, discovered by Arctic Wolf Labs during a June 2026 intrusion in Venezuela. Its extended build includes an optional Ethereum smart-contract fallback: when primary C2 fails, the malware queries a public Ethereum JSON-RPC endpoint via eth_getStorageAt to retrieve a replacement C2 address from a contract called BulletproofC2, avoiding the need to redeploy the malware. _Security teams tracking novel C2 techniques like blockchain fallback follow threat research on daily.dev._ ### How does GoCaracal relate to Bandook malware used by Dark Caracal? GoCaracal and Bandook are currently operating in parallel rather than one replacing the other. During the June 2026 intrusion, Arctic Wolf found lightweight GoCaracal used as an access implant that led to deployment of an updated Bandook variant alongside an extended GoCaracal build, with GoCaracal's capabilities overlapping much of Bandook's remote-access and collection functionality, suggesting a possible future reduction in Bandook reliance. _Analysts comparing overlapping malware toolkits can keep up with APT tradecraft shifts on daily.dev._ ### What operational security changes did Dark Caracal make to Bandook to evade detection? The June 2026 Bandook sample replaced sequential command identifiers (previously documented as ranges like @0001 through @0136) with randomized strings and obfuscated plugin export names using generic identifiers, reducing the effectiveness of signatures based on earlier naming conventions. This sample also included about 82 command handlers, fewer than some earlier variants, and collected browser credentials from Chrome, Brave, and Firefox. _Reverse engineers tracking evasion technique changes in known malware families can follow this on daily.dev._ ## Similar posts on daily.dev - [Malicious Go Module Exposes GitHub Malware Lure Network Span...](https://daily.dev/posts/malicious-go-module-exposes-github-malware-lure-network-span--fqwgrwl88) · Socket · 14 upvotes · 0 comments - [Graphalgo Malware Spreads to Terraform and Go](https://daily.dev/posts/graphalgo-malware-spreads-to-terraform-and-go-hqi2wj8y7) · Aikido Security · 5 upvotes · 1 comments - [Expanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection](https://daily.dev/posts/expanding-the-castle-new-campaigns-new-tooling-and-the-needlestealer-connection-5m93ci1j9) · Arctic Wolf · 0 upvotes · 0 comments - [Chinese hackers target telcos with new Linux, Windows malware](https://daily.dev/posts/chinese-hackers-target-telcos-with-new-linux-windows-malware-ql0h0a4gw) · BleepingComputer · 2 upvotes · 0 comments - [LABScon25 Replay \| Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine](https://daily.dev/posts/labscon25-replay-gamaredon-x-turla-unveiling-a-2025-espionage-alliance-targeting-ukraine-pmt7xj70f) · SentinelLABS · 0 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#malware](https://daily.dev/tags/malware), [#ethereum](https://daily.dev/tags/ethereum) [View this post on daily.dev](https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Dark Caracal Reloaded: New Malware, Same Hunting Grounds","url":"https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq"},"datePublished":"2026-08-26T12:02:25.531Z","dateModified":"2026-08-26T12:02:55.365Z","description":"Arctic Wolf Labs uncovered GoCaracal, a previously undocumented modular Go-based malware framework linked with medium confidence to Dark Caracal, a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0eda558f0b1787b3cae8379031e2720a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,malware,ethereum","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"Dark Caracal Reloaded: New Malware, Same Hunting Grounds"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/dark-caracal-reloaded-new-malware-same-hunting-grounds-anluzrnzq#faq","mainEntity":[{"@type":"Question","name":"What is GoCaracal malware and how does it use Ethereum for command and control?","acceptedAnswer":{"@type":"Answer","text":"GoCaracal is a modular Go-based malware framework attributed to the Dark Caracal threat group, discovered by Arctic Wolf Labs during a June 2026 intrusion in Venezuela. Its extended build includes an optional Ethereum smart-contract fallback: when primary C2 fails, the malware queries a public Ethereum JSON-RPC endpoint via eth_getStorageAt to retrieve a replacement C2 address from a contract called BulletproofC2, avoiding the need to redeploy the malware. Security teams tracking novel C2 techniques like blockchain fallback follow threat research on daily.dev."}},{"@type":"Question","name":"How does GoCaracal relate to Bandook malware used by Dark Caracal?","acceptedAnswer":{"@type":"Answer","text":"GoCaracal and Bandook are currently operating in parallel rather than one replacing the other. During the June 2026 intrusion, Arctic Wolf found lightweight GoCaracal used as an access implant that led to deployment of an updated Bandook variant alongside an extended GoCaracal build, with GoCaracal's capabilities overlapping much of Bandook's remote-access and collection functionality, suggesting a possible future reduction in Bandook reliance. Analysts comparing overlapping malware toolkits can keep up with APT tradecraft shifts on daily.dev."}},{"@type":"Question","name":"What operational security changes did Dark Caracal make to Bandook to evade detection?","acceptedAnswer":{"@type":"Answer","text":"The June 2026 Bandook sample replaced sequential command identifiers (previously documented as ranges like @0001 through @0136) with randomized strings and obfuscated plugin export names using generic identifiers, reducing the effectiveness of signatures based on earlier naming conventions. This sample also included about 82 command handlers, fewer than some earlier variants, and collected browser credentials from Chrome, Brave, and Firefox. Reverse engineers tracking evasion technique changes in known malware families can follow this on daily.dev."}}]} ```