GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
AI-summarised brief · reviewed before publication
Threat actors tied to Dark Caracal with medium confidence deployed a new Go‑based malware framework, GoCaracal, in a June 2026 intrusion of an unnamed communications firm in Venezuela. The lightweight profile offers remote shell access, encrypted C2, payload execution and shellcode injection, while the extended profile adds browser data theft, keylogging, WebRTC remote desktop, SOCKS5 proxying and persistence functions. After initial C2 failures, the extended profile queries a public Ethereum JSON‑RPC endpoint with an eth_getStorageAt request to retrieve a replacement C2 address stored in a smart contract, then resumes off‑chain communication. This on‑chain fallback lets operators change the C2 address without updating the binary. Arctic Wolf released YARA rules, IoCs and noted similar activity across Latin America, though the exact victim count remains unknown.
💡 Why It Matters
- · Leveraging a public Ethereum contract as a dynamic C2 fallback gives attackers a resilient, low‑cost way to re‑point malware without redeployment, complicating detection and takedown efforts.
