GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address

Summary

Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.