Cybersecurity firm **Arctic Wolf** has uncovered a previously undocumented Go-based malware framework, dubbed **GoCaracal**, deployed by threat actors with medium confidence linked to **Dark Caracal**. The malware was first observed during a June 2026 intrusion targeting an unnamed communications organization in Venezuela. **GoCaracal** is designed to provide operators with remote shell access and payload execution. An extended profile of the malware significantly expands its capabilities, incorporating browser data theft, keylogging, remote desktop control, and SOCKS5 proxying. **Arctic Wolf** has released a **YARA** rule and representative Indicators of Compromise (**IoCs**) to assist defenders in detecting and mitigating this new threat. ### Linking to Dark Caracal **Arctic Wolf** assesses a medium confidence link to **Dark Caracal** based on several recurring characteristics. These include the use of **Bandook** malware, consistent **Delphi**-loader traits, Spanish-language financial lures, malicious **SVG** files, **URL** shorteners, document-themed infrastructure, specific hosting provider preferences, and a continued focus on Latin American targets. ### GoCaracal Profiles and Capabilities During the investigated intrusion, **GoCaracal** appeared in both a lightweight and an extended profile. The lightweight version supports host profiling, an encrypted Command-and-Control (**C2**) channel, interactive shell access, payload retrieval and execution, and shellcode loading and injection.  **Bandook** was deployed alongside the lightweight profile, operating in parallel with **GoCaracal**. Current evidence does not suggest **GoCaracal** is a replacement for **Bandook** but rather a complementary tool. The extended profile of **GoCaracal** further enhances its malicious functionality, adding system and file discovery, command execution, collection of browser cookies and login databases, keylogging, targeted file search, **Web Real-Time Communication (WebRTC)** remote desktop control, hidden browser interaction, **SOCKS5** proxying, and persistence mechanisms. ### Phishing and Novel C2 Fallback **Arctic Wolf** suspects phishing as the primary delivery mechanism, although the original phishing email or **SVG** attachment was not recovered. This assessment is based on artifact naming conventions (financial and tax themes), established campaign patterns, and over 100 related **SVG** files communicating with the same malicious hosting site. One of the most notable features of the extended **GoCaracal** profile is its **Ethereum**-based **C2** fallback mechanism. If initial attempts to communicate with the primary **C2** server fail, the malware sends an `eth_getStorageAt` request to a public **Ethereum JSON-RPC** endpoint. The response provides a replacement **C2** address stored within a configured smart contract, which **GoCaracal** then uses for retrying conventional off-chain **C2** communication. This smart contract mechanism allows the operator to dynamically change the replacement **C2** address without distributing a new **GoCaracal** binary, enhancing the malware's resilience and adaptability. **Arctic Wolf** clarifies that this does not place the full **C2** channel on **Ethereum**, but rather leverages it for redundancy.  While the **Ethereum** fallback mechanism was observed, **Arctic Wolf's** public report does not confirm its successful execution on an infected host or reconnection via a replacement address during the June intrusion. ### Dark Caracal's Ongoing Operations **Dark Caracal** has a well-documented history of targeting entities in Latin America. Previous reports have highlighted the group's activities, including its original disclosure in 2018, the use of retooled **Bandook** malware in 2020, and subsequent **Bandook** attacks in Venezuela in 2021. Related artifacts and infrastructure observed by **Arctic Wolf** were associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay, suggesting broader regional activity, though these are not confirmed victim countries. **Arctic Wolf** has provided a **YARA** rule for the lightweight **GoCaracal** profile, representative **SHA-256** hashes, related domains and **IP** addresses, **Ethereum** contract and wallet indicators, and host paths associated with the malware. The full set of indicators is available to their customers.