As cited
Copy frozen at (site build).
threat intel
GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
Arctic Wolf identified a Go-based malware framework called GoCaracal, linked with medium confidence to Dark Caracal threat actors, deployed in a June 2026 intrusion at a communications organization in Venezuela. The malware provides remote shell access, payload execution, browser data theft, keylogging, and remote desktop control capabilities, and uses an Ethereum smart contract to retrieve replacement command and control addresses.
Why it matters: Communications providers and organizations in Venezuela face active targeting by this group; practitioners should monitor for GoCaracal indicators and review access logs for signs of remote shell activity, data theft, or unauthorized control.
- Source published
- First seen by Cybersecurity Tracker