Ethereum’s public ledger now doubles as a fallback address book for a malware family linked to Dark Caracal. Arctic Wolf researchers documented GoCaracal after finding it in a June intrusion at a communications organization in Venezuela, and they assess that attribution with medium confidence.
In its lightweight form the tool profiles the host, opens an encrypted command channel, and can fetch and run new payloads, with interactive shell access available to operators. The extended build layers on browser cookie and login database harvesting, keystroke logging, WebRTC-based remote desktop control, hidden browser interaction, SOCKS5 proxying, and persistence helpers.
Its most unusual feature is a blockchain-based C2 fallback. If the primary server stays unreachable, GoCaracal queries a public Ethereum JSON-RPC endpoint with an eth_getStorageAt call. The response contains a replacement C2 address stored in a configured smart contract, which the malware writes into its in-memory configuration before retrying conventional off-chain communication. Because multiple public RPC endpoints can read the same contract state, the operator can swap C2 addresses without shipping a new binary, and no single fallback access point exists.
Arctic Wolf said the mechanism does not put the malware’s full C2 channel on Ethereum, and the public report shows no host that actually reconnected through the fallback. Bandook was deployed alongside the lightweight profile, so GoCaracal is not yet a Bandook replacement.
Phishing is the likely delivery route, based on financial and tax-themed artifact names, more than 100 related SVG files, and the group’s established campaign patterns. Arctic Wolf published a YARA rule and indicators of compromise for defenders.
