GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Summary: Arctic Wolf attributed with medium confidence a June 2026 intrusion at an unnamed Venezuelan communications organization to actors linked to Dark Caracal, who deployed a previously undocumented Go-based framework called GoCaracal that provides remote shell access and payload execution. The extended profile adds browser cookie and login-database collection, keylogging, WebRTC remote desktop, SOCKS5 proxying and persistence, and after repeated primary C2 failures it reads a replacement address from an Ethereum smart contract via an eth_getStorageAt request to a public JSON-RPC endpoint, writing that address to its in-memory configuration.
What's compelling: The smart-contract fallback lets the operator rotate the replacement C2 address without shipping a new binary, and multiple public RPC endpoints can read the same contract state - so blocking one address or one provider does not close the channel. Arctic Wolf's public report does not show a host in the June intrusion that invoked the fallback and successfully reconnected, leaving the mechanism's real-world use unconfirmed.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026