Back Ground.News

Dark Caracal's New Malware GoCaracal: From SVG Phishing to Ethereum Backup C2

Ground.News • August 27, 2026

GoCaracal malware represents a new step in the evolution of threats directed to Latin America. Discovered by Arctic Wolf Labs during an intrusion investigation against a communications organization in Venezuela, the framework combines traditional remote access capabilities with an unusual technique: using blockchain Ethereum as a contingency source to discover new addresses of command and control servers (C2). The case draws attention to why it …

1. Basic Information Article Title: Dark Caracal Reloaded: New Malware, Same Hunting Grounds Publisher: Arctic Wolf Labs Publication Date: 2026-08-26 Source: Arctic Wolf Labs Related Sources: Dark Reading, Kaspersky Dark Caracal campaign report Related Malware, Threat Groups, CVEs, Products: GoCaracal, Bandook, AsioGate, Dark Caracal, Microsoft Windows, Ethereum JSON-RPC Severity: High 2. Executive Summary Dark Caracal delivers a lightwei…

A new malware framework in two different versions and an evasive mechanism via the Ethereum blockchain: Arctic Wolf Labs has discovered the previously undocumented malware "GoCaracal" in an investigation of a targeted attack on an organization from the communications sector in Venezuela. Arctic Wolf assigns the attack with medium-security to the cyberspionage group Dark Caracal. The most important findings [...] Arctic Wolf Labs discovers new ma…

Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Dark Caracal Unveils GoCaracal Malware for Cyber Espionage The Lebanon-linked Dark Caracal threat group has introduced a new malware framework named GoCaracal, enhancing its cyberespionage capabilities. Discovered by Arctic Wolf during an intrusion investigation in Venezuela, GoCaracal features two versions: a lightweight implant for initial access and a robust version for intelligence gathering. This malware employs a novel technique by using Ethereum blockchain as a backup for command-and-control (C2) server discovery. Dark Caracal has been active since at least 2012, targeting military, government, and various organizations across Latin America. The group continues to utilize established tactics, including phishing and malicious websites, to deliver malware. The current campaign is focused on Spanish-speaking countries, with potential victims identified in Brazil, Ecuador, and Colombia. The sophistication of GoCaracal poses a significant risk of persistent access for intelligence gathering. 13 sources 76

Extracted Entities

Dark Caracal's New Malware GoCaracal: From SVG Phishing to Ethereum Backup C2

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

Malware (4)

MITRE ATT&CK (2)

Platforms (1)