# GoCaracal: Dark Caracal and New Advances in the Art of C2 Resilience ## **Executive Summary** In June 2026, cyber security researchers recorded a sophisticated espionage raid that took down a large telecommunications corporation in Venezuela: the APT Dark Caracal group officially launched a new spy weapon called GoCaracal. Not only did the attackers switch to the Go language to bypass traditional EDR solutions, but they also activated a completely new evasion weapon — turning the Ethereum Blockchain network into an impregnable Dead-Drop Resolver channel. Every time the main control server (C2) is taken down or blocked by the Firewall, GoCaracal does not lose contact; Instead, it silently sends eth\_getStorageAt queries to public Ethereum nodes to decrypt the alternate IP/Domain stored directly in the Smart Contract. What is the secret that allows attackers to change C2 infrastructure right before the eyes of network security monitoring systems without changing even a single byte of binary source code? How can GoCaracal's Lightweight and Extended configurations work together seamlessly with Trojan Bandook to establish a "low-and-slow" spy network that lasts for years? In-depth technical analysis, ATT&CK matrix and emergency Hunting toolkit (YARA, Sigma, KQL, VQL) for SOC Team will be decoded in detail in the next sections below. ## Dark Caracal Attack Group Profile ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/29e8e4d6-9b66-4df1-84b7-a0eb54e664ee.png align="center") ### Origin & Identification Dark Caracal (also known through Operation Manul, Crosswalk) is a cyber espionage group with a long history of operations, first announced by cybersecurity research organizations (such as Lookout, EFF) in 2018. The group is assessed with average reliability as originating or operating for geopolitical interests related to the Middle East / Lebanon region. ### Objectives & Geographic Influence Dark Caracal does not spread malware widely for financial purposes but focuses entirely on strategic intelligence. The group targeted more than 21 countries with thousands of victims across key industries: * Target industries: Telecommunications Infrastructure, Government & Diplomatic Agencies, Military & Defense Contractors, Financial Institutions - Banks, Press - Media, Energy Enterprises, and Non-Governmental Organizations (NGOs). * Surveillance of individuals: Human rights activists, lawyers, politicians, and dissident individuals. * Focus geographical scope: * Latin America region: Venezuela, Brazil, Ecuador, Chile, Colombia, El Salvador, Uruguay (especially increasing in frequency from 2020 to present). * Middle East & North Africa region: Lebanon, Qatar, Saudi Arabia, UAE, Egypt, Jordan. * Other regions: North America, Europe, and some Asian countries. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/ac9028a2-d445-401f-94e5-7985cfbbdafa.png align="center") ### Evolution in technology 1. **Pallas RAT & Mobile Implants period (2012 – 2018):** * Pallas (Windows): Specialized encryption malware written in C/C++, capable of taking screenshots, collecting documents (.doc, .pdf, .xls), keylogging and environmental recording. * Android Trojans (Mobile): Dark Caracal is one of the pioneering APT groups that abuse mobile applications. They create a series of fake versions of secure messaging applications such as Signal, WhatsApp, SecureChat, ChatSecure. This mobile malware allows call recording, reading encrypted messages, real-time GPS positioning and camera access. 2. **Bandook Trojan Restructuring Phase (2020 – 2024):** * When Pallas was widely identified, the group switched to using an improved commercial version of Bandook RAT (which had been sold commercially on underground forums). * Evasion techniques: Bandook is signed with valid digital signatures (valid digital certificates) purchased from reputable vendors or stolen, helping the malware easily bypass Windows SmartScreen filters and traditional AV software in the attack campaigns against Venezuela in 2020–2021. 3. **GoCaracal Framework Era (2026 – Present):** * Migration to Golang (Go): Marked an infrastructure turning point when the team completely abandoned the old C/C++/.NET implants to build the GoCaracal module. * New technical features: 2-layer modular architecture (Lightweight & Extended), cross-platform compilation support (Windows/Linux/macOS), integrated WebRTC remote control technology, SOCKS5 Proxy and C2 Fallback mechanism via Ethereum Smart Contract. ### Notable Major Offensive Campaigns * Operation Manul campaign (Announced 2018): Infiltrating thousands of devices in more than 21 countries. Collect over hundreds of Gigabytes of sensitive data including audio recordings, military documents, and personal location data. * Operation Bandook Reloaded in Latin America (2020 – 2021): Targeting the government and energy infrastructure in Venezuela. Attackers combine financial-themed spear-phishing emails with a Bandook template with a digital signature to set up an espionage operation that lasts for months. * Operation GoCaracal (June 2026): Large-scale attack on Venezuelan telecommunications corporation. This is the first time Ethereum Blockchain technology has been discovered in real combat use as a C2 Dead-Drop Resolver for a national espionage malware framework. ## Detailed Technical Analysis of GoCaracal Malware ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/4af98412-c91a-4959-ba21-6d9a31e2a679.png align="center") ### Phase 1: Initial Outreach * Attack vector: Attackers send spear-phishing emails specifically targeting employees of telecommunications/financial organizations. Personalized email content in Spanish with subject lines related to tax notices, business invoices, or banking information. * Malicious files (.SVG): Instead of attaching .EXE or .ZIP files that are vulnerable to Email Gateway censorship, Dark Caracal attaches SVG vector graphic image files (more than 100 SVG samples were recorded in the campaign). This SVG file contains embedded script/HTML redirect code that automatically triggers the download of the stage 2 malicious package from the intermediate server infrastructure. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/e8308fb6-bbee-4425-a1bd-a10fcc9a61fa.png align="center") ### Phase 2: Decoding * Using the Delphi Loader: After the file is downloaded, the first execution phase is handled by a Delphi Loader — a traditional loader that has been optimized by Dark Caracal over the years. * Evade detection: Delphi Loader decodes obfuscated data blocks (obfuscated payload) right in RAM memory, helping to avoid writing unencrypted malicious files to the hard disk, thereby bypassing the static signature scanning step of Antivirus solutions. ### Phase 3: Dropping Malware & Initializing Go Runtime * Delphi Loader decompresses and drops the main GoCaracal executable file into temporary directories with user-write permissions (User-Writable Directories): * `%APPDATA%\Microsoft\Vault\sysdriver.exe` * `%LOCALAPPDATA%\Temp\go_runner.tmp.exe` * `C:\Users\Public\Documents\svchost_update.exe` * Launch Go Runtime: The GoCaracal executable file is large (from 8MB - 14MB) because it is statically compiled and contains the entire Go Runtime library. Upon launch, the malware decrypts the Embedded Configuration Block containing the initial C2 IP/Domain list, AES encryption key, and Ethereum Smart Contract address information. ### Phase 4: Set Up Residency & Load Shellcode * Set up Persistence: To ensure survival through computer restarts, GoCaracal performs Registry Run Keys recording or creates Windows Scheduled Task: * *Registry Key:* `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SysServiceCheck` * *Value Data:* `"C:\Users\\AppData\Local\Temp\go_runner.tmp.exe"` * Shellcode Injection (Lightweight Profile): In Lightweight profile, GoCaracal acts as an intermediate loader. It initializes a valid Windows process (such as svchost.exe or explorer.exe) in a suspended state, then uses Windows API functions (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) to inject Trojan Bandook shellcode into that process's memory. ### Phase 5: Intelligence Collection, Log Data & File Collection When the GoCaracal Extended Profile version is activated, the malware automatically executes a series of extensive espionage actions: ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/1336a28b-fd4d-404d-87fc-12d4092c29a2.png align="center") * Extract browser information: Directly access the user data folder of Chrome, Edge, Firefox to copy Login Data and Cookies files, decrypt saved passwords with Windows DPAPI (CryptUnprotectData). * Keylogging & Screen Capture: Initiates a background thread that monitors keystrokes and periodically takes screenshots of the victim's computer. * Targeted file collection: Scan the entire C:, D:\\ drive to search for document files containing sensitive keywords. * Data compression: Malicious code silently calls available compression tools on the system (or compresses using the Go source code library) to package collected data into temporary compressed files stored at %TEMP%~data\_staged.zip. ### Phase 6: C2 Communication & Activation of Ethereum Smart Contract Fallback Mechanism This is GoCaracal's key control channel maintenance phase: * Initial C2 Off-chain connection: The malicious code sends victim computer identification data to the main C2 IP/Domain via encrypted HTTP/HTTPS protocol. * Enable Ethereum Fallback: If the connection to the primary C2 is down or blocked by the SOC's Firewall/DNS Sinkhole: * GoCaracal enters C2 recovery mode. It initiates a standard JSON-RPC HTTP POST query to a list of public Ethereum node gateways (like https://cloudflare-eth.com or Infura/Alchemy nodes). * The query content calls the eth\_getStorageAt function, specifying the Attacker's Smart Contract address (0x742d...) and memory location (storage slot). * Decryption & Reconnection: The Ethereum Node returns a Hex string (e.g. 0x0000...414243...). GoCaracal decodes this Hex string to the latest alternative IP/Domain C2 address, updates the configuration directly in RAM, and reinitiates the control connection channel without restarting the process or changing the hard disk. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/83ca7f2b-bb19-456e-9cfe-e922cb5b0830.png align="center") ### Phase 7: Peer-to-Peer Transfer, Remote Desktop Control & Data Withdrawal * WebRTC Remote Desktop: Extended Profile integrates the WebRTC library, allowing attackers to control the victim's computer screen in real time (Real-time Remote Desktop) via P2P/WebRTC data stream without interrupting the user's session. * SOCKS5 Proxy: Initialize the SOCKS5 Proxy module on the victim machine, turning the victim machine into a springboard (Pivot Point) for attackers to gain deeper access to internal network partitions (Lateral Movement). * Data Extraction (Exfiltration): All sensitive data packets compressed at Stage 5 are pushed out to the new C2 infrastructure through small encrypted connection streams (chunked upload) to evade the traffic anomaly detection system (DLP/NTA). ## Breakthrough C2 Fallback Mechanism Through Ethereum Smart Contract The most unique technical feature of GoCaracal Extended Profile lies in the mechanism to restore the C2 channel when interrupted. Normally, when the IP address or C2 domain name is blocked by the Firewall/DNS Sinkhole, the malware will completely lose contact. GoCaracal solves this problem by embedding the Ethereum Blockchain query algorithm: 1. Initialize connection: GoCaracal attempts to connect to the default off-chain C2 servers encrypted in the configuration. 2. Enable Fallback: If the connection continuously fails more than the specified number of times, the malware initiates a JSON-RPC HTTP POST query carrying the eth\_getStorageAt function to the list of public Ethereum RPC endpoints. 3. Read data from Smart Contract: Data returned from Smart Contract storage contains a hex string representing the latest alternative IP or C2 domain name. 4. In-memory update: GoCaracal decodes this hex string, overwrites the new C2 address into the process's RAM, and reconnects the traditional off-chain C2 channel. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/a2a183b6-c8cf-4685-9a0d-8af069bc6590.png align="center") This mechanism does not put the entire C2 transmission channel on the Blockchain (because of high costs and latency), but only uses Ethereum as an invulnerable Dead-Drop Resolver. An attacker can change the C2 address at any time by executing a Smart Contract state update transaction without changing the binary template file on the victim machine. ## **MITRE ATT&CK Mapping**

Tactic

Technique ID

GoCaracal Technical Description

Initial Access

T1566.001 / T1566.002

Spear-phishing with SVG attachment / Malicious URL

Execution

T1059.003 / T1055

Command Shell execution, Shellcode injection

Persistence

T1547.001 / T1053.005

Registry Run Keys, Windows Scheduled Tasks

Defense Evasion

T1027 / T1001.003

Code obfuscation, Dynamic C2 via Blockchain RPC

Credential Access

T1555.03 / T1056.001

Browser Login Data theft, Keylogging

Discovery

T1082 / T1083

System Information & File/Directory Discovery

Command & Control

T1090.003 / T1573.001

SOCKS5 Proxying, Encrypted C2 Channel (HTTP/HTTPS)

Exfiltration

T1041

Outbound C2 exfiltration via overlapping infrastructure

## **IOCs & Artifacts** ### SHA-256 Hashes (GoCaracal Samples & Delphi Loaders) 4a8f9c1b2e3d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a 7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2 ### Network Indicators (C2 Domains & Infrastructure) doc-update-service\[.\]com cdn-telecom-auth\[.\]net 185.220.101\[.\]45 45.142.214\[.\]12 ## Expert Comments & Real Battle Context in Vietnam 1. Trend of shifting to Go language (Go-compiled Malware): GoCaracal is the next proof that leading cyber espionage groups are converting their entire toolkits to Go. The static linking feature creates large binary files (from 5MB - 15MB) containing the entire runtime library, reducing the performance of dynamic analysis Sandbox systems and making it difficult for AV/EDR's static identification algorithms. 2. C2 Dead-Drop technique on Web3/Blockchain platform: Taking advantage of Ethereum's public RPC services (such as Cloudflare-eth, Infura) turns C2 decrypted traffic into completely valid Web3 queries. Secure Web Gateways (SWGs) that do not decrypt SSL/TLS or do not have rules to detect specific JSON-RPC functions (eth\_getStorageAt) will completely ignore this malicious traffic. 3. Risk assessment for organizations in Vietnam: Although Dark Caracal's most recent campaign is focused on Latin America, the intrusion technique via SVG attachments and the C2 Fallback mechanism via Ethereum can completely be applied or shared with other APT groups operating strongly in Southeast Asia. Organizations in the Telecommunications, Banking - Finance, and State Agencies sectors in Vietnam need to proactively review their infrastructure to face the risk of silent intrusion. ## Early Detection Rule Set ### Yara Rule ```plaintext rule APT_GoCaracal_Malware_Framework { meta: description = "Detection of the GoCaracal malware framework of the Dark Caracal group" author = "FPT IS SOC Team / Security Arsenal" date = "2026-09-02" reference = "Arctic Wolf Labs - Dark Caracal Reloaded" hash_sample = "4a8f9c1b2e3d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a" score = 85 strings: // Features Go Runtime $go_buildid = "Go build ID:" ascii // GoCaracal's signature module and function chains $s1 = "main.ethGetStorageAt" ascii $s2 = "main.webrtcRemoteDesktop" ascii $s3 = "main.browserStealerCookies" ascii $s4 = "main.socks5ProxyStart" ascii // JSON-RPC Ethereum format string $eth_rpc = "{\"jsonrpc\":\"2.0\",\"method\":\"eth_getStorageAt\"" ascii condition: uint16(0) == 0x5A4D and $go_buildid and (2 of ($s*) or ($eth_rpc and 1 of ($s*))) } ``` ### Detect Binary Go Without Execution Signature From Clipboard ```plaintext title: Executing Unsigned Go Binary from User-Writable Directory id: 3f8c2a71-9b4d-4e6a-b1c7-2d5e8f0a1b3c status: experimental description: Detect execution of unsigned process featuring Go runtime from temporary folder (AppData, Temp, Public), a sign of GoCaracal intrusion. references: - https://arcticwolf.com/resources/blog/dark-caracal-reloaded-new-malware-same-hunting-grounds/ author: FPT IS SOC Team date: 2026/09/02 tags: - attack.execution - attack.defense_evasion - attack.t1059 logsource: category: process_creation product: windows detection: selection_path: Image|contains: - '\AppData\Roaming\' - '\AppData\Local\Temp\' - '\Users\Public\' - '\ProgramData\' selection_unsigned: Signed: 'false' filter_known_good: Image|contains: - '\AppData\Local\Microsoft\Teams\' - '\AppData\Local\slack\' - '\AppData\Local\Discord\' - '\AppData\Roaming\Zoom\' condition: selection_path and selection_unsigned and not filter_known_good falsepositives: - A valid programmer tool or updater software does not have a allowlist configured. level: high ``` ## Recommendation GoCaracal shows a notable trend: malware not only seeks to maintain C2 connections but also has the ability to collect browser credentials, record keystrokes, search documents and package data for export. Therefore, users should not only focus on "removing malware files", but need to reduce the possibility of phishing, limit data that can be stolen and quickly handle credential if suspected of infection. ### Critical * Enable MFA for important accounts. * Do not open SVG/ZIP/7z/RAR from unknown sources. * Do not enter credentials on suspected infected machines. * Isolate endpoints when determining compromise. * Change password and revoke session/token from clean device if browser data is potentially stolen. ### High * Implement EDR. * Restrict local administrators. * Monitor process/network telemetry. * Control executable from %TEMP% and user-writable directories. * Monitor unusual Ethereum JSON-RPC traffic. * Inventory sensitive documents on the endpoint. ### Medium * Training on identifying phishing. * Control URL shortening. * Update browser/OS. * Reduce credential saving in the browser. * Build a threat-hunting playbook for GoCaracal and similar malware. ## Message for users The most important point from GoCaracal is not “let's block Ethereum”. The more practical lesson is: A seemingly harmless file can be the starting point of a whole chain of intrusions. Phishing → SVG → redirect → archive → GoCaracal → credential theft → keylogging → document discovery → data staging → C2. Therefore, the most effective defense begins before malware is executed. If users only need to remember 5 things, remember: 1. Do not open strange files, especially SVG and archives. 2. Do not click on shortened URLs from unknown sources. 3. Enable MFA for important accounts. 4. Do not enter password on suspected infected machine. 5. When you suspect compromise, isolate the machine and notify IT/SOC as soon as possible. ## References * **Arctic Wolf Labs – Dark Caracal Reloaded: New Malware, Same Hunting Grounds** [Arctic Wolf Labs research](https://arcticwolf.com/resources/blog/dark-caracal-reloaded-new-malware-same-hunting-grounds/?utm_source=chatgpt.com) * **The Hacker News – GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address** [The Hacker News article](https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html?utm_source=chatgpt.com) * **CyberPress – Dark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin America** [CyberPress article](https://cyberpress.org/dark-caracal-debuts-gocaracal/?utm_source=chatgpt.com) * **Security Arsenal – Dark Caracal's GoCaracal Espionage Framework: Detection, Hunting, and Defense Guide for SOC Teams** [Security Arsenal analysis](https://securityarsenal.com/blog/dark-caracals-gocaracal-espionage-framework-detection-hunting-and-defense-guide-for-soc-teams?utm_source=chatgpt.com)