Dark Caracal Expands Cyber Espionage with GoCaracal Malware Framework

The Lebanon-linked Dark Caracal threat group has introduced a new malware framework called GoCaracal, enhancing its cyber espionage capabilities. Discovered by Arctic Wolf during an investigation into a targeted intrusion in Venezuela, GoCaracal comprises two versions: a lightweight implant for initial access and a more robust version for data harvesting and control. The malware uses a blockchain-based Ethereum database for backup command-and-control server access. Dark Caracal has a history of targeting military personnel, journalists, and activists across 21+ countries since 2012. The group employs phishing and malicious websites to deliver malware, with recent telemetry indicating potential targeting in Latin America, including Brazil and Colombia. The ongoing campaign leverages Spanish-language lures to distribute malicious SVG files. Arctic Wolf researchers are monitoring the situation closely.

Key Points: • Dark Caracal has launched GoCaracal, a new modular malware framework for espionage. • The group targets military, journalists, and activists in over 21 countries since 2012. • Phishing attacks are the primary method for delivering the malware.