GoCaracal eth_getStorageAt C2 fallback via BulletproofC2 contract

Arnold Chan@slaz

•updated Aug 27, 2026•0•0•5

This rule detects command and control (C2) communication patterns utilized by the GoCaracal malware family, specifically its fallback mechanism which leverages Ethereum blockchain RPC calls (eth_getStorageAt) to interact with known malicious smart contracts or wallet addresses.