Arctic Wolf Labs exposes Dark Caracal’s evolving tradecraft, linking 249 samples to two operational build profiles and a resilient Ethereum-based C2 architecture targeting Latin America.
In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists.
The intrusion used delivery methods consistent with the SVG-based Dark Caracal campaign previously documented by Kaspersky, but the malware deployed after initial access was different. Arctic Wolf Labs identified a previously undocumented, modular Go-based framework that we call GoCaracal, deployed alongside an updated variant of Bandook.
Analysis of 249 related samples revealed two GoCaracal build profiles: a lightweight implant designed to establish access and deliver additional payloads, and an extended build intended for sustained intelligence collection and interactive control. The extended build also supports an Ethereum smart-contract fallback that allows operators to retrieve replacement command-and-control (C2) infrastructure without redeploying the malware.
These findings show that Dark Caracal is modernizing the malware and infrastructure behind its established operations and tradecraft.
Key Findings
- A new modular malware framework: GoCaracal supports separate lightweight and extended build profiles derived from a shared architecture. Both were observed in the same intrusion.
- A framework under active development: Analysis of 249 related samples traces GoCaracal’s evolution from early access functionality to a mature post-compromise framework between January and July 2026.
- Blockchain-backed C2 resilience: An extended GoCaracal variant uses Ethereum smart contracts as a fallback source for replacement C2 addresses. Blockchain activity indicates that the capability was tested and operationalized rather than merely included as dormant code.
- New and established malware operating together: Dark Caracal deployed GoCaracal alongside an updated Bandook variant, suggesting that the new framework currently complements, rather than definitively replaces, the actor’s established tooling.
From AsioGate to GoCaracal: What Changed?
In February 2026, Kaspersky reported a Dark Caracal campaign that used financial-themed phishing emails, malicious SVG attachments, URL-shortening services, a Delphi loader, and a newly identified C++ backdoor named AsioGate. That activity primarily targeted Venezuela, with related components observed in Chile and Brazil.
The June intrusion investigated by Arctic Wolf retained several recognizable elements of that delivery ecosystem, including Spanish-language financial themes, weaponized SVG content, redirect services, document-themed hosting infrastructure, and a Delphi loader. However, the activity introduced GoCaracal and deployed it alongside Bandook, broadening the actor’s post-compromise capabilities and increasing its infrastructure resilience.
| Dimension | Earlier public reporting | Arctic Wolf findings |
| Delivery | Financial lures, SVG attachments, URL shorteners | Continued SVG-based delivery and expanded document-themed infrastructure |
| Access malware | AsioGate | Lightweight GoCaracal |
| Post-compromise tooling | AsioGate and related delivery components | Extended GoCaracal plus updated Bandook |
| Development view | Analysis of a campaign and backdoor | 249-sample framework and development timeline |
| C2 | Hardcoded AsioGate server | Primary C2 plus Ethereum-based fallback |
| Geographic picture | Venezuela, Chile, and Brazil | Confirmed Venezuelan intrusion and assessed activity across additional Latin American countries |
Arctic Wolf has not identified evidence that GoCaracal is a direct code-level successor to AsioGate. Rather, the two implants likely represent similar access roles within overlapping Dark Caracal delivery and infrastructure ecosystems.
How Dark Caracal Delivered GoCaracal
While Arctic Wolf did not recover the original phishing email or SVG attachment associated with the intrusion, the artifact’s financial and tax-themed filename, the campaign’s established delivery pattern, and more than 100 related SVG files found communicating with the same malicious hosting site support our assessment that the file was delivered through phishing. A similar SVG recovered from the same infrastructure and timeframe showed how the actor embedded a Base64-encoded shortened URL inside the file, connecting the observed artifact to a broader Dark Caracal delivery campaign.
Figure 1: Progression of GoCaracal delivery via phishing (Click to enlarge).
When a recipient opened one of these weaponized SVG files, the embedded content directed the browser to a shortened URL. That URL resolved through an intermediate redirector before sending the recipient to getpdfdigital[.]cloud, a known attacker-controlled site used to stage malicious payloads. The site then delivered a 7-Zip archive containing tf-oficina004a9.exe, a lightweight Go-based implant that Arctic Wolf Labs identified as part of the previously undocumented GoCaracal framework.
During the investigated intrusion, this access-focused implant was associated with the subsequent deployment of a Delphi loader containing Bandook and an extended GoCaracal build with broader post-compromise capabilities. These observations indicate that Dark Caracal used lightweight GoCaracal as an entry point into a layered malware toolkit, rather than relying on it as the final payload.
GoCaracal: One Framework, Two Operational Profiles
Arctic Wolf Labs assesses that the Go-based samples form a common modular framework rather than multiple unrelated malware families. Shared package structures, reusable components, common communications, and recurring execution workflows connect lightweight access implants with substantially more capable extended builds.
| GoCaracal Profile | Operational Role | Representative Capabilities |
| Lightweight | Establish access and deliver tooling | Host profiling, encrypted C2, remote shell, payload download, execution, and shellcode injection |
| Extended | Maintain control and collect intelligence | File management, browser collection, keylogging, proxying, WebRTC remote desktop, hidden browser sessions, persistence, and resilient C2 |
The lightweight and extended profiles allow an operator to match capability to operational needs. A smaller implant can establish a foothold and deliver additional payloads, while the extended build supports sustained access, credential collection, covert interaction, and intelligence gathering.
We have not identified evidence that GoCaracal is a direct successor to AsioGate at the code level. Rather, the frameworks occupy similar access roles within overlapping Dark Caracal operations and delivery ecosystems.
Lightweight Build: Access and Payload Delivery
The lightweight sample establishes C2 communication using a custom packet protocol protected by AES-GCM encryption. During initialization, it gathers basic host information, including user, hostname, operating-system, uptime, active-window, and security-product data, and makes that information available for registration with the C2 server.
Tasking utilizes numeric packet identifiers mapped to a compact set of routines. The retrieved sample saves and executes files, retrieves content from URLs, controls an interactive command shell, loads shellcode, and injects code into another process. These functions are consistent with an access-focused implant that allows an operator to establish control and introduce additional tooling rather than perform the full range of collection activities itself.
During the June intrusion, the lightweight build formed part of the initial execution chain and was followed by deployment of a Delphi loader containing Bandook and an extended GoCaracal build. This use supports our assessment of the lightweight profile as a foothold and delivery mechanism. The complete packet-code reference and sample metadata should be published in the accompanying technical appendix rather than in the main report.
Extended Build: Sustained Access and Collection
The extended GoCaracal sample contained internal version strings ranging from v1.0.1 through v1.0.6, indicating active maintenance during the analyzed period. Unlike the lightweight build’s compact numeric dispatcher, the extended build used readable command strings and exposed 34 handlers.
The capabilities cluster into six operational categories:
- Host discovery: system profiling, process enumeration, drive discovery, directory listing, and recursive file search.
- Execution and lifecycle management: interactive command shells, program execution, self-update, termination, file deletion, and renaming.
- Collection: file download, browser-cookie and login-database collection, keylogging, and targeted file search.
- Remote interaction: WebRTC-based desktop access, hidden virtual-network-computing behavior, and cloning of a local Chrome profile into a separate hidden browser session.
- Network enablement: an in-band SOCKS5 proxy that can tunnel operator traffic through the compromised host.
- Persistence-related behavior: registry-hive manipulation and creation of a concealed NTUSER.MAN artifact associated with a Run-key workflow.
The extended implant also contained Spanish-language operator-facing status messages, while package and function naming remained primarily English.
From Access Implant to Full-Spectrum RAT
Arctic Wolf Labs analysis of hundreds of related samples dating back to January 2026 reveal an arc of maturation of the framework (see Figure 2, below). We uncovered shared package structures, reusable modules, and common execution workflows across various samples with significantly different capability sets, indicating an architecture that supports modular feature inclusion based on operational requirements.
Phase 1: Foundation, January 2026
Core communications, host profiling, encrypted tasking, and code execution appeared in the earliest substantial sample set.
Phase 2: Modularization, February to April
The developer reorganized the framework into reusable network, core, and execution components, then added active C2 support, antivirus discovery, and interactive shell functionality.
Phase 3: Capability expansion, May to June
The extended build introduced broad post-compromise functionality. Both lightweight and extended profiles were subsequently observed during the June intrusion.
Phase 4: Operational resilience, June to July
Ethereum-based C2 fallback appeared in configured extended builds, while both profiles were maintained.
Figure 2. Framework development timeline.
The progression indicates a deliberate planned framework development rather than an isolated malware experiment. GoCaracal has evolved from a focused access implant into a modular platform supporting multiple stages of an intrusion.
An Ethereum Smart Contract as a C2 Safety Net
The extended GoCaracal profile implements an optional blockchain-based fallback C2 resolution. Alongside primary HOST and PORT values, the configuration can contain a CONTRACT address. After repeated failures to reach the primary C2, the malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint and reads a value from the configured contract’s storage. If the returned value resolves to a valid address, the implant updates its in-memory configuration and retries communication.
This mechanism does not place the malware’s full command-and-control channel on Ethereum. Instead, the blockchain functions as a resilient configuration or dead-drop channel. Operators can update the stored C2 value through a blockchain transaction, and deployed implants can retrieve the new address without receiving an updated binary. Public RPC services provide multiple routes to the same on-chain data, increasing the difficulty of disrupting the fallback through a single infrastructure takedown.
Based on a retrieved contract address, we identified a custom Solidity contract named BulletproofC2 that stored one mutable C2 value and limited updates to the deploying owner. Transaction history showed that the configured value was changed to a public IP address, providing evidence that the mechanism was not solely dormant code.
We identified additional deployments of identical contracts from the same wallet that deployed and updated related contracts on the Ethereum Sepolia test network before comparable mainnet activity. Some contract addresses appeared first on Sepolia and were later deployed on mainnet, while others remained confined to the test network. Stored values included public C2 addresses as well as private RFC 1918 addresses, which is consistent with development and validation activity.
GoCaracal Is Augmenting, Not Yet Replacing, Bandook
Arctic Wolf discovered a Bandook payload following execution of the lightweight GoCaracal variant in the June activity. Although Bandook remains an active component of Dark Caracal operations, the GoCaracal framework provides many of the remote-access, execution, payload-delivery, and intelligence-collection capabilities historically associated with Bandook. The functional overlap suggests that GoCaracal is augmenting the group’s established malware toolkit and could reduce its future reliance on Bandook. Current evidence, however, shows the two malware families operating in parallel and does not yet indicate that GoCaracal is replacing Bandook.
Comparison with Bandook samples previously documented in Dark Caracal operations identified changes intended to stifle malware analysis. The June 2026 sample replaced the sequential command identifiers documented in earlier variants, such as @0001 through @0136, with randomized strings. Its plugin export names were also obfuscated using generic identifiers. These changes preserve familiar Bandook functionality while reducing the value of signatures and analytical methods based on earlier naming conventions.
The sample also included functionality for collecting browser credentials from Chrome, Brave, and Firefox. Arctic Wolf Labs identified approximately 82 command handlers, fewer than documented in some earlier Bandook variants. A smaller command set does not necessarily indicate reduced operational capability, however, because the sample may represent a tailored build intended to operate alongside GoCaracal or other components of Dark Caracal’s toolkit.
The Wider Dark Caracal Campaign
The infrastructure associated with the June 2026 intrusion forms part of a broader cluster of Spanish-language, document-themed domains used to deliver malicious SVG files and downstream payloads. Arctic Wolf Labs identified seven related domains sharing characteristics such as naming conventions, hosting relationships, registration patterns, and recurring malware associations. Two of these domains had previously been linked to Dark Caracal activity, while subsequent analysis identified additional infrastructure, including a domain registered in July 2026 that was observed delivering GoCaracal. Together, these findings indicate that the threat actor has maintained and expanded a delivery ecosystem designed to appear relevant to Spanish-speaking recipients.
The campaign also shows separation between delivery infrastructure and malware-specific C2. Of the 24 unique C2 addresses extracted from GoCaracal samples, 23 were hosted on AEZA Group-operated networks. By contrast, the Bandook C2 addresses identified by Arctic Wolf were hosted on AlexHost, a provider previously associated with Dark Caracal operations. This separation may be intended to limit the effect of infrastructure disruption affecting one malware family, although it could also reflect different infrastructure acquisition or management practices. The repeated use of specific hosting providers, combined with the broader delivery cluster, supplies useful behavioral context beyond individual domains and IP addresses.
Conclusion
Arctic Wolf Labs assesses with medium confidence that this intrusion was conducted by Dark Caracal. Our assessment is based on the convergence of multiple evidence types, including the use of Bandook, recurring Delphi loader characteristics, Spanish-language financial lures, malicious SVG files, URL-shortening services, document-themed infrastructure, provider preferences, and targeting consistent with the group’s established focus on Latin America. GoCaracal deployment alongside traditional Bandook tooling and infrastructure heavily suggests these operations are conducted by the same threat actor.
Arctic Wolf also identified related artifacts and infrastructure associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay, suggesting that the broader campaign may extend across the region. Arctic Wolf assesses the additional regional activity with moderate confidence while continuing to investigate its scope.
Taken together, the findings show Dark Caracal is preserving familiar targeting and delivery practices while modernizing their malware and infrastructure. Dark Caracal’s continued use of established tooling such as Bandook, combined with the introduction of GoCaracal and its separate C2 footprint, suggests an expanding and increasingly compartmentalized toolkit rather than a wholesale change in operational strategy.
Legal disclaimer: Attribution reflects Arctic Wolf Labs’ assessment as of the report period and may evolve with new evidence. References to threat actor identity, nexus, and intent are analytical judgments, not statements of legal fact. This alert is provided for informational purposes only and does not constitute a guarantee of detection or prevention. Defensive effectiveness varies by environment, configuration, and available telemetry.
How Arctic Wolf Protects Its Customers
Arctic Wolf has Aurora® Managed Detection and Response (MDR) detections in place for activity observed in this intrusion.
We have leveraged threat intelligence around this activity to enhance detections in the Aurora® Superintelligence Platform, subject to customer environment and available telemetry. As this campaign develops, Arctic Wolf may refine detections for additional indicators of compromise and techniques leveraged by this threat.
Appendix
Detection Opportunities
YARA Rules
rule targeted_DarkCaracal_GoCaracal_Lightweight_RAT { meta: id = "6e5e3b86-5ea6-499b-b418-cacd57254978" version = "1.0" description = "Detects a new Dark Caracal Golang toolkit (lightweight version) used in a campaign targeting LATAM" author = "Arctic Wolf" creation_date = "2026-07-13" hash = "c9da1b08a39491dfdbede6ff4c1a2d383f57cb29e2d3532aee08d6e0a5c1dda6" classification = "TLP:CLEAR" strings: $s1 = "main.cleanupShell" $s2 = "main.handleConnection" $s3 = "main.detectAntivirus" $s4 = "main.saveFile" $s5 = "main.openUrl" $s6 = "main.smartSleep" $s7 = "main.runModule" $s8 = "main.InjectShellcode" $s9 = "main.injectShellcodeWoW64" $s10 = "main.handlePipeClient" $s11 = "insensate" $s12 = "readSecurePacket" $s13 = "main.loadAPIs" $s14 = "SendSecurePacket" $s15 = "getRawOSVersion" $s16 = "RPCFallback" $s17 = "main.AntivirusProduct" $s18 = "main.lastInputInfo" condition: 5 of ($s*) }
Indicators of Compromise (IOCs)
NOTE: The IOCs mentioned below are referential. The full list has been provided to Arctic Wolf customers. These technical indicators are intended for defensive use. Do not use these indicators or techniques for offensive purposes.
File Indicators
Malware Hashes
| SHA-256 | Name | Type |
| 1E499C815146124C4A6D2B48C99068B980AD74E1A2CFD16013F8D75A9425A0CA | TF-OFICINA004A9.exe | GoCaracal Lightweight variant |
| 77F7AD29F4A8037EE5F38D3D87FB91CFD97CB8F7FA7883EDF3FCE506DF5200C0 | TF-OFICINA004A9.exe | GoCaracal Lightweight variant |
| 8C03D072DF2E1BF14B0C00A8AB99834138C8B69F301849BF09CB44394E916015 | VRJDL_21812.exe | GoCaracal Extended variant |
| 0A6DA70548F14834ACB8960689A589B48FF422F8385AE445A281AAB77045FE22 | 7676230602QQ.exe | Delphi Loader |
| a2cdf2fe741de4b13ad2298b387a6c32da4a94da180ae75bf8547386aee7376b | N/A | Bandook payload (decrypted) |
Network Indicators
Malicious C2 Domains:
| Domain | Purpose |
| getpdfdigital[.]cloud | Delivery Infrastructure |
| getpdf[.]digital | Delivery Infrastructure |
| visualizarpdf[.]online | Delivery Infrastructure |
| contabilidad[.]icu | Delivery Infrastructure |
| soportedigital[.]cloud | Delivery Infrastructure |
| documentodigital[.]cloud | Delivery Infrastructure |
| gestionadocs[.]me | Delivery Infrastructure & C2 Panel |
| IP Address | Purpose |
| 109[.]120[.]187[.]217 | GoCaracal C2 Infrastructure |
| 109[.]172[.]95[.]121 | GoCaracal C2 Infrastructure |
| 138[.]124[.]112[.]213 | GoCaracal C2 Infrastructure |
| 138[.]124[.]14[.]130 | GoCaracal C2 Infrastructure |
| 176[.]124[.]220[.]153 | GoCaracal C2 Infrastructure |
| 185[.]125[.]101[.]181 | GoCaracal C2 Infrastructure |
| 185[.]96[.]80[.]110 | GoCaracal C2 Infrastructure |
| 185[.]96[.]80[.]54 | GoCaracal C2 Infrastructure |
| 193[.]233[.]245[.]52 | GoCaracal C2 Infrastructure |
| 62[.]60[.]237[.]22 | GoCaracal C2 Infrastructure |
| 77[.]110[.]104[.]98 | GoCaracal C2 Infrastructure |
| 77[.]110[.]105[.]244 | GoCaracal C2 Infrastructure |
| 77[.]110[.]105[.]56 | GoCaracal C2 Infrastructure |
| 77[.]110[.]105[.]59 | GoCaracal C2 Infrastructure |
| 77[.]110[.]98[.]66 | GoCaracal C2 Infrastructure |
| 80[.]71[.]224[.]30 | GoCaracal C2 Infrastructure |
| 82[.]117[.]87[.]138 | GoCaracal C2 Infrastructure |
| 82[.]117[.]87[.]192 | GoCaracal C2 Infrastructure |
| 85[.]192[.]30[.]211 | GoCaracal C2 Infrastructure |
| 79[.]137[.]192[.]38 | GoCaracal C2 Infrastructure |
| 82[.]117[.]87[.]138 | GoCaracal C2 Infrastructure |
| 193[.]233[.]245[.]0 | GoCaracal C2 Infrastructure |
| 79[.]137[.]192[.]38 | GoCaracal C2 Infrastructure |
| 193[.]233[.]245[.]45 | GoCaracal C2 Infrastructure |
| 46[.]226[.]162[.]68 | GoCaracal C2 Infrastructure |
| 45[.]152[.]198[.]108 | GoCaracal C2 Infrastructure |
| 91[.]208[.]197[.]80 | Bandook C2 Infrastructure |
| 91[.]208[.]184[.]45 | Bandook C2 Infrastructure |
| 91[.]208[.]206[.]88 | Bandook C2 Infrastructure |
| 91[.]208[.]184[.]130 | Bandook C2 Infrastructure |
| 176[.]123[.]1[.]174 | Bandook C2 Infrastructure |
| User-Agent Strings |
| User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) |
| Type | Indicator | Purpose |
| Ethereum – Contract | 0x03D605f13A74Bfb6149078122FcF62BD6d8799d8 | Configured BulletproofC2 fallback contract; deployed 20 May 2026 |
| Ethereum – Contract | 0x04aB453494381E60171BE04Ea6BE6E7C44EafAfd, 0xD7635f31620772882a6712472a6278c53247Bc44, 0xf165F26300BF65DFaC78BC9557326bDbB3C6d33C | Three further identical BulletproofC2 deployments (first seen on Sepolia, then mainnet) by the same wallet |
| Ethereum – Wallet | 0x7D321FE277f8c25aaC14aF1BA3Fc34953242052F | Deployment/management wallet for the fallback contracts; funded via Binance-associated infrastructure |
Host Indicators
| File Paths |
| %AppData%\Roaming\d30547514515\91ed375e.exe |
| %AppData%\Roaming\e1d58f51c58a\5c0416e4.exe |
Additional Arctic Wolf Resources:
- Arctic Wolf’s free Threat Intelligence newsletter: ThreatPulse Community Edition
- Arctic Wolf Tech Den
- Arctic Wolf Blog