Full Report
Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control
Analysis Summary
# Tool/Technique: GoCaracal
## Overview
GoCaracal is a previously undocumented Go-based (Golang) malware framework identified by Arctic Wolf researchers. It functions as a modular remote access tool (RAT) and post-exploitation framework. Notably, it utilizes Ethereum smart contracts as a decentralized fallback mechanism to retrieve updated Command and Control (C2) infrastructure addresses, enhancing its resilience against domain takedowns.
## Technical Details
- **Type:** Malware Framework
- **Platform:** Windows (Cross-platform potential due to Go, but features like Delphi-loaders and Windows-specific targeting are noted)
- **Capabilities:** Remote shell, data theft, keylogging, and blockchain-based C2 fallback.
- **First Seen:** June 2026 (Intrusion at a Venezuelan communications organization)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment] (SVG files)
- **[TA0002 - Execution]**
- [T1059.006 - Command and Scripting Interpreter: Python/Go]
- [T1620 - Reflective Code Loading]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1083 - File and Directory Discovery]
- **[TA0009 - Collection]**
- [T1539 - Steal Web Session Cookie]
- [T1555.003 - Credentials from Web Browsers]
- [T1056.001 - Keylogging]
- **[TA0011 - Command and Control]**
- [T1102.003 - Web Service: One-Way Communication to Cloud Storage] (Ethereum JSON-RPC)
- [T1090.003 - Proxy: Multi-hop Proxy] (SOCKS5)
- [T1568.002 - Dynamic Resolution: Domain Generation Algorithms] (Blockchain-based address resolution)
## Functionality
### Core Capabilities
* **Modular Profiles:** Deployed in "Lightweight" and "Extended" versions.
* **Host Profiling:** Gathers basic system information upon infection.
* **Interactive Shell:** Provides operators with remote shell access for manual command execution.
* **Payload Execution:** Capability to retrieve and execute additional malicious binaries or shellcode.
### Advanced Features
* **Ethereum C2 Fallback:** Uses `eth_getStorageAt` requests to public Ethereum JSON-RPC endpoints to retrieve replacement C2 addresses stored in a smart contract.
* **Data Exfiltration:** Targeted theft of browser cookies, login databases, and specific files.
* **Remote Control:** Includes WebRTC-based remote desktop control and hidden browser interaction.
* **Network Tunneling:** Integrated SOCKS5 proxying to facilitate lateral movement or obfuscate traffic.
## Indicators of Compromise
* **File Hashes (SHA256):** *[Specific hashes not fully listed in text, but referenced as available via Arctic Wolf]*
* **File Names:** Associated with financial and tax-themed lures; malicious `.svg` attachments.
* **Network Indicators:**
* C2 Domains: `[defanged_example_domain].com`
* RPC Endpoints: Public Ethereum JSON-RPC gateways (e.g., `cloudflare-eth[.]com`, `infura[.]io`).
* **Behavioral Indicators:**
* Process spawning shellcode into memory.
* Unexpected outbound traffic to blockchain infrastructure.
* Creation of persistence-related registry keys or scheduled tasks.
## Associated Threat Actors
* **Dark Caracal** (Assessed with medium confidence).
## Detection Methods
* **Signature-based detection:** Monitoring for the specific Go-compiled patterns and strings identified in the Arctic Wolf YARA rule.
* **Behavioral detection:** Flagging internal hosts making unexpected JSON-RPC calls (`eth_getStorageAt`) to public Ethereum gateways.
* **Network Inspection:** Inspecting encrypted traffic patterns associated with GoCaracal’s custom C2 channel.
## Mitigation Strategies
* **Email Filtering:** Block or scrutinize Scalable Vector Graphics (.svg) attachments in email gateways.
* **Endpoint Protection:** Implement EDR solutions capable of detecting shellcode injection and Golang-based malware behaviors.
* **Network Policy:** Restrict access to public blockchain RPC endpoints unless required for legitimate business functions.
* **User Training:** Educate employees on identifying financial-themed phishing lures, especially those originating from Spanish-language sources.
## Related Tools/Techniques
* **Bandook:** A legacy RAT often deployed alongside GoCaracal.
* **Delphi-loaders:** Frequently used by this threat actor to deliver the primary payload.
* **Dead Drop Resolvers:** Similar to how malware uses Pastebin or social media to find C2s, but utilizing blockchain smart contracts for higher censorship resistance.