Dark Caracal's New Malware GoCaracal: From SVG Phishing to Ethereum Backup C2

1. Basic Information

• Article Title: Dark Caracal Reloaded: New Malware, Same Hunting Grounds
• Publisher: Arctic Wolf Labs
• Publication Date: 2026-08-26
• Original Source: Arctic Wolf Labs
• Related Sources: Dark Reading, Kaspersky Dark Caracal campaign report
• Related Malware, Threat Groups, CVEs, Products: GoCaracal, Bandook, AsioGate, Dark Caracal, Microsoft Windows, Ethereum JSON-RPC
• Severity: High

2. Executive Summary

Dark Caracal distributed a lightweight version of GoCaracal via malicious SVGs, and deployed Bandook alongside a feature-rich, expanded version of GoCaracal. The expanded version includes information stealing, remote control, SOCKS5 proxy capabilities, and a backup C2 retrieval mechanism using Ethereum smart contracts.

3. Attack Flow

From SVG Phishing to Multi-Stage Payloads

1. Arctic Wolf assesses that malicious SVGs were distributed via Spanish-language financial and tax-themed phishing. The original phishing email and SVG attachment have not been recovered.
2. URLs embedded in the SVG using Base64 direct victims to attacker sites via URL shortener services and redirectors.
3. A lightweight GoCaracal executable is distributed inside a 7-Zip archive.
4. The lightweight version collects host information and registers with the C2 using a custom protocol encrypted with AES-GCM. It includes an interactive shell, file download and execution capabilities, and shellcode loading/injection.
5. A Delphi-based loader deploys an updated version of Bandook and the expanded version of GoCaracal.
6. The expanded version collects browser cookies and login databases, performs keylogging, searches for files, runs a WebRTC remote desktop, executes a hidden browser, operates a SOCKS5 proxy, and establishes persistence via the registry.
7. If the primary C2 is unreachable, it uses the Ethereum JSON-RPC method eth_getStorageAt to retrieve a backup C2 address from smart contract storage.

4. Attacker Position and Execution Context

• External attackers reaching targets via email and the web.
• Operates under the privileges of the Windows user after execution. The expanded version provides the attacker with an interactive shell, remote desktop, and proxy capabilities.

5. Visibility for Victims and Administrators

Victims

• Induced to open SVGs or compressed files disguised as financial or tax documents.
• After execution, hidden browser and remote desktop features may allow attackers to perform actions independently of what the user sees.

Administrators

• The attack can be observed as a sequence: SVG -> URL shortener -> redirector -> compressed file download -> Go executable -> Delphi loader -> Bandook / GoCaracal.
• Clues include access to browser databases, keylogging, process injection, Run key-related artifacts, and Ethereum JSON-RPC traffic.

6. Success and Failure Conditions

Success Conditions

• The target opens the malicious SVG or compressed file and launches the executable.
• Endpoint controls do not block payload download, GoCaracal execution, or C2 communication.
• The host reaches the primary C2 or the backup C2 obtained via Ethereum.

Failure Conditions / Risk Mitigation

• Block the multi-stage delivery path from email/web through SVGs to compressed files.
• Prevent unauthorized executables and scripts using application control, and detect/block shellcode injection.
• Restrict unnecessary outbound traffic, including Ethereum JSON-RPC, and communications with known C2 IOCs.

7. What Happens Upon Success

• Theft of browser cookies, login databases, keylogs, and target files.
• Remote control via interactive shell, WebRTC remote desktop, and hidden browser.
• Relay use of the compromised host via SOCKS5 proxy.
• Persistence through registry modifications and improved takedown resistance via Ethereum-based backup C2.

8. Observable Logs

• Email: Financial and tax-themed lures, SVG attachments, and redirection to 7-Zip archives.
• Proxy/SWG/DNS: URL shorteners, redirectors, distribution infrastructure such as getpdfdigital[.]cloud, and C2 communications. Correlation of eth_getStorageAt calls directed at public Ethereum JSON-RPC endpoints within the context of the originating endpoint.
• Endpoint/EDR: Browser navigation from opened SVGs, archive extraction, Go executables, Delphi loaders, and concurrent execution of Bandook and GoCaracal. Shellcode injection, access to browser databases, keylogging, hidden browser activity, and modifications to registry hives or NTUSER.MAN.
• Identity/IdP: Subsequent sign-ins using stolen browser cookies or login credentials.
• SaaS/Cloud: Access to SaaS applications using stolen sessions or credentials.
• Network: Custom packet protocol encrypted with AES-GCM, WebRTC, SOCKS5, and communication with primary/backup C2s.

9. Attack Success Assessment

• Attack Attempt Observed (Success Unconfirmed): Contact with malicious SVGs, URL shorteners, or compressed files is confirmed, but payload execution is unconfirmed.
• User Action Confirmed: Actions leading to opening SVGs or compressed files and launching executables are confirmed.
• Initial Execution Confirmed: Execution of the lightweight GoCaracal or loader and registration with C2 are confirmed.
• Information Theft or Session Compromise Confirmed: Collection or transmission of browser databases, cookies, keylogs, or files is confirmed.
• Subsequent Compromise Confirmed: Expanded GoCaracal, Bandook, remote desktop, SOCKS5, persistence, or additional payloads are confirmed.

10. Investigation Playbook

• Trigger: Detection of Dark Caracal-related SVGs/domains/hashes, Go executables, Ethereum JSON-RPC C2 fallback, or coexistence with Bandook.
• Initial Triage: Preserve email, download paths, browser history, compressed files, executable hashes, and process trees. Determine whether the lightweight or expanded version ran, if Bandook coexisted, and identify the C2 address.
• Endpoints: Investigate browser database access, keyloggers, shellcode injection, registry hives, NTUSER.MAN, and artifacts of hidden browsers or remote desktops.
• Identity & Cloud: Check IdP and SaaS sessions associated with credentials or cookies stolen from browsers, and revoke them if necessary.
• Post-Exploitation: Examine SOCKS5 traffic, internal reconnaissance, additional payloads, data exfiltration, and connections to other hosts.
• Containment: Isolate endpoints, block IOCs, revoke credentials/sessions, remove persistence, or reimage hosts. Do not treat Ethereum JSON-RPC traffic as malicious by default; evaluate it by combining the relevant process and contract address context.
• Confidence Levels: Differentiate between lure engagement, user execution, lightweight execution, expanded execution, data theft, and proxy relay usage.

11. Defense and Detection Ideas

• Single Events: Office applications or browsers triggering a Go executable inside an archive that performs shellcode injection or accesses browser databases.
• Time-Series Correlation: Correlate the chain from SVG -> redirect path -> compressed file -> lightweight GoCaracal -> Delphi loader -> Bandook/expanded GoCaracal -> C2.
• Hunting: Broadly search not only for GoCaracal hashes and domains, but also for C2 fallback using Ethereum smart contracts, 34 specific handlers, hidden browsers, and SOCKS5 proxies.
• Log Gaps: If email attachments, browser URL navigations, process injection, browser file access, and network flows are siloed, the multi-stage attack chain cannot be reconstructed.
• Priority Mitigations: Implement delivery controls for SVGs and compressed files alongside application control. Protect saved browser credentials and monitor sessions. Conduct IOC- and behavior-based threat hunting across endpoints and networks.

12. Facts / Inference / Hypothesis

Facts

• Arctic Wolf identified GoCaracal at a telecommunications organization in Venezuela in June 2026, assessing a medium confidence link to Dark Caracal.
• Identified two GoCaracal builds (lightweight and expanded) across 249 samples.
• The expanded version features 34 handlers, including browser data collection, keylogging, WebRTC remote desktop, SOCKS5 proxying, and persistence mechanisms.
• Ethereum-based C2 fallback was evaluated as not only existing in code but also tested and put into active operation via blockchain activity.
• GoCaracal was deployed alongside Bandook, with no evidence indicating it is a direct code successor to AsioGate.

Inference

• Using the lightweight version keeps initial capabilities and exposure low, deploying the expanded version only when necessary to expand functionality while minimizing detection opportunities.
• Blockchain-based C2 address resolution makes it harder to disrupt operations solely via domain or server takedowns.

Hypothesis

• Targeting of additional Latin American countries is based on telemetry assessments, and not all observed activity is attributed to Dark Caracal with the same level of confidence.

13. MITRE ATT&CK Mapping

• T1566.001 Phishing: Spearphishing Attachment (Medium): Original phishing emails and SVG attachments were not recovered, but delivery via SVG attachments is assessed based on campaign distribution patterns and related artifacts.
• T1204.002 User Execution: Malicious File (High): Victims are induced to open malicious SVGs, extract archives, and launch executables.
• T1055 Process Injection (High): The lightweight GoCaracal includes shellcode injection capabilities.
• T1555.003 Credentials from Password Stores: Credentials from Web Browsers (High): Collects browser cookies and login databases.
• T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Medium): Persistence established via Run keys accompanied by registry hive operations and NTUSER.MAN traces.
• T1090.001 Proxy: Internal Proxy (High): Provides built-in SOCKS5 proxy functionality.
• T1102 Web Service (Medium): Uses Ethereum JSON-RPC and smart contract storage to retrieve backup C2 addresses.

14. Unknowns and Areas for Further Investigation

• The complete delivery chain including actual phishing emails and SVG attachments, the number of compromised organizations, and whether stolen data was actually weaponized.
• The relationship between Dark Caracal and General Directorate of General Security (GDGS) in Lebanon is based on existing assessments and is not a new piece of evidence specific to this case.

15. Impact on SOCs and Organizations

While the primary targets are in Latin America, delivery techniques involving SVGs, redirects, and archives, along with browser credential theft and Ethereum-based backup C2s, can be reused globally. SOCs must monitor multi-stage delivery paths, browser access, proxy features, and blockchain-related communications as a unified behavioral pattern rather than relying solely on hashes.

16. Summaries by Role

• For SOCs: Correlate events in chronological order, from SVGs to lightweight/expanded GoCaracal, Bandook, browser information theft, and Ethereum-based C2 fallback.
• For Administrators: Control SVG/archive delivery, unauthorized executables, access to browser credentials, and unnecessary Ethereum RPC traffic.
• For End Users: Do not open documents, SVGs, or archives that appear suspicious, and report immediately if led to launch an executable.