That assessment anchors a compact but technically notable intrusion disclosed in August 2026, in which researchers observed a previously undocumented Go-language malware family — dubbed GoCaracal — used against an unnamed communications organization in Venezuela. Arctic Wolf’s public report documents the malware’s capabilities, a novel fallback mechanism that leverages a public Ethereum smart contract to publish a replacement command-and-control address, and a set of indicators defenders can use to hunt for infections.
Arctic Wolf’s attribution and campaign context
Arctic Wolf linked the activity to Dark Caracal with medium confidence, citing multiple forensic and operational markers: prior use of Bandook malware, recurring Delphi-loader characteristics, Spanish-language financial lures, malicious SVG files, use of URL shorteners, document-themed infrastructure, preferred hosting providers, and a pattern of targeting in Latin America. The firm also noted related artifacts and infrastructure associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay and assessed broader regional activity with moderate confidence — while explicitly declining to name those locations as confirmed victims.
GoCaracal’s runtime profiles and capabilities
Arctic Wolf observed GoCaracal operating in two distinct profiles during the June 2026 intrusion: a lightweight profile and an extended profile. The lightweight profile implements host profiling, an encrypted command-and-control channel, interactive shell access, payload retrieval and execution, and shellcode loading/injection. An extended profile builds on that baseline with system and file discovery, command execution, collection of browser cookies and login databases, keylogging, targeted file search, WebRTC-based remote desktop control, hidden browser interaction, SOCKS5 proxying, and persistence-related functions.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEthereum smart contract fallback for C2
A striking technical detail in Arctic Wolf’s analysis is an off-chain C2 fallback that uses the public Ethereum execution environment as a resilient signaling channel. When the extended GoCaracal profile fails to reach its primary C2 host after repeated attempts, it issues an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint. The response contains a replacement address stored in a configured smart contract; the malware writes that address into its in-memory configuration and retries conventional off-chain C2 communication using the new address.
Arctic Wolf emphasized that multiple public RPC endpoints can be queried to read the same contract state, reducing dependence on a single fallback access point, and that the technique does not place the malware’s full command-and-control channel on Ethereum. The smart-contract mechanism provides operators with the ability to change the replacement C2 address without shipping a new GoCaracal binary.
Arctic Wolf’s report notes, however, that the public disclosures do not document a host in the June intrusion invoking the fallback and successfully reconnecting through the replacement address.
Bandook observed running alongside GoCaracal
In the same intrusion, adversaries also deployed Bandook. Arctic Wolf reports that Bandook was used in parallel with the lightweight GoCaracal profile; current evidence does not support the conclusion that GoCaracal replaced Bandook. The coexistence of these tools in a single operation is a prominent element of Arctic Wolf’s incident narrative.
Indicators of compromise and defensive steps
Arctic Wolf published a collection of representative indicators and detection artefacts intended to aid defenders. The publicly released materials include a YARA rule for the lightweight GoCaracal profile, representative SHA-256 hashes, related domains and IP addresses, Ethereum contract and wallet indicators, and host paths associated with the malware. Arctic Wolf said those public indicators are referential and that the full set of indicators is available to its customers.
The firm assessed phishing as the delivery vector for the intrusion but did not recover the original phishing e-mail or the SVG attachment from the victim. That delivery assessment was based on financial- and tax-themed artifact naming, an established campaign pattern, and more than 100 related SVG files that contacted the same malicious hosting infrastructure.
What this means for technologists, Venezuelan communications firms, and incident responders
- Technologists and security teams: Use the YARA rule and the representative SHA-256 hashes, domains, IPs, and Ethereum indicators Arctic Wolf published to hunt for lightweight-profile GoCaracal activity and related artifacts; pay attention to attempts to query public Ethereum JSON-RPC endpoints for eth_getStorageAt calls as a possible sign of the fallback mechanism.
- Communications providers in Venezuela and the region: Be aware that Arctic Wolf observed this malware during an intrusion at a Venezuelan communications organization and that related infrastructure has ties to multiple Latin American countries; validate mail defenses and inspect document-handling pipelines for malicious SVGs that have been associated with this campaign.
- Incident responders and investigators: Note the parallel use of Bandook and GoCaracal in the observed intrusion and consider both toolsets during triage. Where available, consult Arctic Wolf’s customer-only indicators for a fuller IoC set.
Arctic Wolf’s analysis documents a compact but technically creative adaptation: a lightweight Go-based remote access tool accompanied by an extended build that can reach into browsers and desktops, and an operator-friendly fallback channel that uses a public Ethereum contract to publish a replacement C2 address. The report leaves a practical, observable question unresolved — while the fallback mechanism is implemented in the code, Arctic Wolf did not report seeing it trigger successfully in the examined intrusion — and that gap will likely be the focus of follow-up detections and investigations.
