GoCaracal, a malware framework tied to Dark Caracal, stores a fallback C2 address on the Ethereum blockchain.