Executive Summary
Arctic Wolf Labs has identified a new modular Go-based malware framework, GoCaracal, attributed with medium confidence to the Dark Caracal cyberespionage group. Active since at least January 2026, this framework has been observed in a targeted intrusion against a Venezuelan communications organization, operating alongside an updated version of the Bandook RAT. The framework features two distinct operational profiles: a lightweight implant for initial access and an extended profile for deep intelligence collection.
A notable technical advancement is GoCaracal's use of Ethereum smart contracts (specifically a custom Solidity contract named 'BulletproofC2') as a fallback mechanism for retrieving command-and-control (C2) addresses. This allows operators to dynamically update infrastructure without redeploying binaries, increasing operational resilience against domain takedowns. The campaign continues Dark Caracal's historical focus on Latin America, utilizing Spanish-language financial lures and weaponized SVG attachments for initial delivery.
This activity signals a modernization of Dark Caracal's toolkit, transitioning from older C++ and Delphi implants to more modular, cross-platform languages like Go, while adopting decentralized infrastructure for C2 persistence. The group remains a significant threat to government, communications, and financial sectors within the LATAM region.