GoCaracal Turns Ethereum Contracts Into C2 Dead Drops

Arctic Wolf Labs traced a June 2026 intrusion at a Venezuelan communications organization to a previously undocumented Go malware framework called GoCaracal that reads replacement command-and-control addresses from an Ethereum smart contract after its primary server fails. The extended build uses the eth_getStorageAt method against public JSON-RPC endpoints, loads the new address into memory, and retries ordinary internet traffic.

Operators can update the stored value with a single blockchain transaction and avoid shipping a fresh binary. Arctic Wolf assesses the activity with medium confidence as the work of Dark Caracal, the Lebanon-linked group long associated with Bandook.

The design keeps recovery simple and durable. When the primary host stops answering, the implant does not need a new package or a hardcoded backup list. It asks the chain for one fresh value and continues.

How the Ethereum Fallback Runs

The extended GoCaracal profile carries a primary HOST and PORT plus an optional CONTRACT address. After repeated connection failures it issues an eth_getStorageAt call to any reachable public Ethereum JSON-RPC endpoint and reads storage from the configured contract. If the returned bytes form a valid address, the implant overwrites its in-memory configuration and resumes conventional C2 traffic.

Arctic Wolf stressed the design leaves the full command channel off-chain. The blockchain functions only as a resilient dead-drop for configuration.

This mechanism does not place the malware’s full command-and-control channel on Ethereum.

Arctic Wolf Labs, technical report

Researchers recovered a custom Solidity contract named BulletproofC2 that stores one mutable C2 value and restricts updates to the deploying owner. Transaction history shows the value was changed to a public IP, proving the path was exercised rather than left dormant. Identical contracts first appeared on the Sepolia test network from the same wallet before mainnet deployment, and some stored private RFC 1918 addresses consistent with testing.

Multiple public RPC providers can read the same contract state, so blocking one endpoint does not cut the fallback. The implant treats those endpoints as interchangeable sources of truth. A single successful read is enough to restore the session path.

Because the update lands in one owner-controlled storage slot, operators rotate the address without touching the binary on disk. Defenders who seize a domain or sinkhole an IP still face a live contract that any public node can query. The Arctic Wolf Labs full technical report documents the exact flow and sample metadata.

Two Builds Across 249 Samples

Analysis of 249 related samples spanning January to July 2026 shows a shared modular architecture supporting two operational profiles observed together in the Venezuela intrusion.

Internal version strings on extended samples ran from v1.0.1 through v1.0.6. Package structures, reusable modules and execution workflows link the two builds into one framework rather than separate families. Spanish-language operator status messages appear alongside English naming.

The lightweight profile opens the door and stages follow-on code. The extended profile then handles long-running collection and remote interaction. Shared modules keep both builds on the same development track.

Development moved in clear phases: core communications and profiling in January, modular network/core/execution components plus antivirus discovery by April, broad post-compromise features by June, and the Ethereum fallback in configured extended builds by July.

• January focused on encrypted C2, host profiling and basic code execution.
• By April the codebase had been split into reusable network, core and execution pieces, with antivirus discovery added.
• May and June brought the wide set of collection and remote-desktop handlers seen in the Venezuela case.
• June into July added the Ethereum fallback on extended builds after Sepolia rehearsals.

Dark Caracal Continuity and SVG Delivery

Delivery matched earlier Dark Caracal patterns documented by Kaspersky. Spanish-language financial and tax-themed lures, weaponized SVG attachments, URL shorteners and document-themed domains fed a 7-Zip archive containing the lightweight implant (tf-oficina004a9.exe). Arctic Wolf did not recover the original email or SVG from the victim, yet more than 100 related SVG files talked to the same malicious hosting infrastructure, supporting the phishing assessment.

A Delphi loader then dropped both an updated Bandook variant and the extended GoCaracal build. Bandook remains active; current evidence shows parallel use rather than replacement. The June Bandook sample randomized former sequential command IDs and obfuscated plugin exports, blunting older signatures while preserving core function.

1. January 2026: Foundation of encrypted C2, host profiling and code execution.
2. February-April 2026: Modular reorganization and interactive shell.
3. May-June 2026: Extended collection and remote-interaction features; both profiles in the Venezuela case.
4. June-July 2026: Ethereum fallback operationalized on mainnet after Sepolia tests.

Dark Caracal itself dates to at least 2012. Lookout and the Electronic Frontier Foundation publicly exposed it in 2018, linking infrastructure to a Beirut building used by Lebanon’s General Directorate of General Security. Bandook has been a long-standing Windows toolset for the group.

The SVG-to-archive path and the Delphi loader therefore connect a long-running toolkit to a new Go framework without discarding the older Windows implant. Operators keep the familiar lure language and hosting habits while adding a second post-compromise option.

Why Public Chains Change Defender Math

Traditional C2 takedowns target domains or IPs. An on-chain dead-drop survives those moves because any public RPC can still return the updated value. Operators gain binary-free rotation; defenders lose a clean kill switch and must now watch for outbound eth_getStorageAt (or similar) traffic that looks like ordinary Web3 activity.

The same public ledger that gives resilience also leaves a permanent transaction trail. Investigators can read the owner wallet, update history and test-network rehearsals. DFIR practitioners on X noted the practical hunt steps: many mail filters still pass SVGs without deep inspection, and outbound JSON-RPC calls to public Ethereum endpoints should raise alerts when they originate from unexpected hosts.

• Block or deeply inspect SVG attachments in email, especially financial or tax-themed Spanish lures.
• Alert on processes issuing eth_getStorageAt or eth_call patterns to public RPC endpoints.
• Hunt Go binaries talking to AEZA Group-hosted ranges; 23 of 24 GoCaracal C2 addresses sat on those networks while Bandook preferred AlexHost, a deliberate split that limits single-provider blast radius.
• Apply the published YARA rule for the lightweight profile and expand coverage with the full customer IoC set.

Of the 24 unique C2 addresses pulled from samples, the provider separation and the AEZA Group network designations supply useful behavioral context beyond individual IPs.

Splitting providers across the two families reduces the chance that a single takedown removes every channel at once. Hunters therefore treat AEZA-linked Go traffic and AlexHost-linked Bandook traffic as related but distinct signals.

Published Indicators and Contracts

Arctic Wolf released a YARA rule covering the lightweight version plus representative hashes, domains, IPs, host paths and Ethereum indicators. The public list is referential; customers receive the complete set.

Representative lightweight hashes include 1E499C815146124C4A6D2B48C99068B980AD74E1A2CFD16013F8D75A9425A0CA. Delivery domains include getpdfdigital[.]cloud and several document-themed variants. Host paths such as %AppData%\Roaming\d30547514515\91ed375e.exe appeared in analysis. The contract itself is written in the Solidity contract language used for Ethereum.

Prior campaigns have already treated blockchains as dead-drops or payload stores (EtherRAT, Polygon-based Aeternum, npm packages reading transaction data, EtherHiding). GoCaracal’s owner-controlled mutable storage simply applies the pattern to C2 recovery inside an established espionage toolkit.

The published contract addresses, wallet and YARA rule give defenders immediate anchors. The customer IoC set extends those anchors with the fuller hash and infrastructure list reserved from the public page.

Regional Footprint and Parallel Tooling

Confirmed activity sits in the Venezuelan communications target. Related artifacts and infrastructure also touch Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay at moderate confidence; Arctic Wolf does not list those as confirmed victim countries. No broader confirmed victim count appears in the public report, and the June case did not show a host that successfully invoked the Ethereum fallback and reconnected.

GoCaracal currently augments rather than replaces Bandook. Functional overlap is clear, yet both families ran in the same intrusion with separate C2 footprints. The group is modernizing delivery and post-compromise tooling while keeping familiar Spanish-language phishing and Latin American focus.

Defenders now have concrete YARA, hashes, contracts and behavioral tells. Operators have a public, hard-to-kill configuration channel. The next observed use of the same BulletproofC2 pattern, or a close variant, will show whether the second-order effect spreads beyond this cluster.

Bandook and GoCaracal Share the Same Intrusion

The Venezuela case put both implants on the same host through one Delphi loader. That pairing matters because it shows deliberate dual-tooling rather than a clean handoff from an older family to a newer one.

Bandook kept its core Windows role after the June changes to command IDs and plugin exports. GoCaracal added the modular Go path, the wider handler set on the extended build, and the optional Ethereum recovery step. Each family kept its own C2 footprint and hosting preference.

Overlap in collection features does not collapse the two into one product. The lightweight Go build still handles initial profiling and payload delivery, while Bandook continues as a parallel Windows option. Operators can choose either channel after the loader runs, which complicates single-family signature strategies.

Continuity with Dark Caracal’s longer history reinforces the reading. Spanish financial and tax lures, SVG delivery, URL shorteners and document-themed domains all match earlier patterns. The new framework extends that line of work instead of breaking from it.

The Public Ledger Leaves Investigators a Trail

Resilience on the operator side creates visibility on the investigator side. Every owner update to BulletproofC2 is a permanent on-chain record. The same wallet that deployed the contract on Sepolia and then on mainnet also funded the work through Binance-linked infrastructure, giving analysts a durable starting point.

Test behavior remains visible as well. Identical contracts on Sepolia, RFC 1918 values written during rehearsal, and the later mainnet change to a public IP form a clear sequence. Analysts can line those transactions against sample compile times and intrusion dates without needing private telemetry.

1. Sepolia deployments: identical contracts from the same wallet used for rehearsal.
2. RFC 1918 storage values: private addresses written during testing.
3. Mainnet deployment: BulletproofC2 configured for live recovery, including the 20 May 2026 contract.
4. Live update: storage changed to a public IP, confirming the path was exercised.

That trail does not replace host-based forensics. It does give defenders a second, public plane to watch while they alert on eth_getStorageAt traffic and SVG lures. Combined with the YARA rule, representative hashes and provider split, the ledger record turns a hard-to-kill fallback into something that can still be hunted.

Frequently Asked Questions

How does GoCaracal retrieve a backup C2 address from Ethereum?

After primary C2 failures the extended build issues an eth_getStorageAt request to a public JSON-RPC endpoint, reads the value stored in a configured smart-contract slot, validates it as an address, writes it into active memory and retries ordinary TCP or HTTP communication to the new host.

What is the BulletproofC2 contract?

It is a custom Solidity contract that holds one mutable C2 value, allows updates only from the deploying owner address, and was observed both on Sepolia for testing and on mainnet with real public IP values written into storage.

Why does Arctic Wolf link GoCaracal to Dark Caracal?

The medium-confidence assessment rests on Bandook co-deployment, Delphi loader traits, Spanish financial SVG lures, URL shorteners, document-themed infrastructure, preferred hosting providers and Latin American targeting patterns that match the group’s established history since at least 2012.

What detection material did Arctic Wolf release?

A YARA rule for the lightweight profile, representative SHA-256 hashes, delivery domains, C2 IP addresses, host paths, three BulletproofC2 contract addresses and the managing wallet; the full set is reserved for customers while the public list remains referential.