Back Securityaffairs.Co

Dark Caracal Deploys New Go Malware With Ethereum

Securityaffairs.Co •Pierluigi Paganini • August 27, 2026

Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dark Caracal Unveils GoCaracal Malware for Cyber Espionage The Lebanon-linked Dark Caracal threat group has introduced a new malware framework named GoCaracal, enhancing its cyberespionage capabilities. Discovered by Arctic Wolf during an intrusion investigation in Venezuela, GoCaracal features two versions: a lightweight implant for initial access and a robust version for intelligence gathering. This malware employs a novel technique by using Ethereum blockchain as a backup for command-and-control (C2) server discovery. Dark Caracal has been active since at least 2012, targeting military, government, and various organizations across Latin America. The group continues to utilize established tactics, including phishing and malicious websites, to deliver malware. The current campaign is focused on Spanish-speaking countries, with potential victims identified in Brazil, Ecuador, and Colombia. The sophistication of GoCaracal poses a significant risk of persistent access for intelligence gathering. 7 sources 76

Extracted Entities

Dark Caracal Deploys New Go Malware With Ethereum

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (2)

Malware (3)

MITRE ATT&CK (1)

Tools (1)