Cyberespionage group Dark Caracal has resurfaced with a new malware framework designed to help maintain access to compromised systems even after security teams disrupt the group’s command-and-control infrastructure.
Researchers linked the activity to a June 2026 intrusion involving a Venezuelan communications organization, where attackers deployed a previously unfamiliar Go-based malware framework known as GoCaracal alongside the group’s established Bandook backdoor. The campaign relied on Spanish-language phishing messages containing financial and tax-related themes to lure victims into opening malicious attachments.
Security researchers at Arctic Wolf identified GoCaracal while examining the breach and attributed the activity to Dark Caracal. Their investigation of 249 samples uncovered two versions of the malware, with one focused on gaining initial access and another providing broader surveillance and remote-control capabilities.
The most notable development is GoCaracal’s ability to retrieve a replacement command-and-control server address from an Ethereum smart contract, allowing infected systems to reconnect even if the primary server is taken offline.
The technique changes the role of blockchain infrastructure in malware operations. Rather than using Ethereum to transmit commands directly to compromised devices, the attackers use the blockchain as a persistent storage location for configuration data. An infected machine can query an Ethereum service, retrieve the updated server address stored in a smart contract, and attempt to establish another connection.
Ethereum smart contract provides backup for command infrastructure
Researchers identified a Solidity smart contract named BulletproofC2 during the investigation. Activity associated with the contract showed that its stored value had been modified to contain a publicly accessible address.
The infrastructure appeared on Ethereum’s Sepolia test network before activity was later observed on Ethereum mainnet. Researchers also found private addresses in some testing activity. The progression indicates that the blockchain fallback mechanism may have developed from experimentation into an operational resilience feature.
The approach could make infrastructure takedowns less effective because operators would not necessarily need to distribute a new malware sample after changing their command server. Instead, they could update the blockchain-stored value through a transaction, allowing infected systems to discover a new destination.
Multiple Ethereum access services can also provide access to the stored information. As a result, taking down a single server or domain may not be sufficient to sever communications with all compromised systems.
The blockchain-based fallback gives Dark Caracal a way to separate malware delivery, command infrastructure and recovery mechanisms, making disruption more difficult for defenders.
SVG phishing remains central to the campaign
Despite the new infrastructure technique, the initial infection process continued to rely on familiar phishing tactics. Attackers distributed SVG image files containing concealed shortened links. When opened, the files directed victims through redirects before reaching websites hosting the malicious payload.
SVG files can contain active web content, allowing attackers to disguise malicious links within what may appear to be an ordinary image attachment. The campaign then delivered an archive containing a small implant capable of establishing the initial foothold and retrieving additional tools.
The lighter GoCaracal variant was designed to profile compromised systems, communicate with the attackers and download further components. The more capable version added functions for searching files, collecting browser information and keystrokes, creating proxy connections and enabling concealed remote desktop access. It also included mechanisms intended to maintain persistence after system restarts.
Bandook was deployed during the same intrusion, indicating that Dark Caracal has not abandoned its established malware. Instead, the newer Go-based framework appears to supplement the group’s existing toolkit while providing additional flexibility.
Wider Latin American activity under investigation
Arctic Wolf also identified related artifacts associated with Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay. However, the researchers indicated that the broader regional scope remains under investigation, meaning the confirmed Venezuelan incident provides the clearest evidence of the campaign’s activity.
The campaign highlights why defenders need to monitor phishing attachments, endpoint activity and network connections together, particularly when failed command-server connections are followed by unexpected Ethereum RPC requests.
Security teams can reduce exposure by treating unsolicited SVG attachments as potentially active content rather than harmless images. Organizations should also monitor unusual archives, suspicious redirects, and unexpected remote-access behavior while reviewing endpoint and network telemetry for signs of repeated connection attempts.
The operation demonstrates that disrupting a conventional command server may no longer be enough to end an intrusion. By incorporating blockchain-based recovery mechanisms into malware infrastructure, attackers can create additional paths for compromised systems to regain contact, requiring defenders to identify and disrupt each stage of the attack chain.
