Arctic Wolf Labs has uncovered a new Go-based malware framework, named GoCaracal, used in a targeted intrusion against a communications organization in Venezuela.
The activity has been linked with medium confidence to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security.
The campaign shows that Dark Caracal is updating its long-running operations across Latin America while retaining familiar phishing and malware-delivery methods.
Researchers identified 249 related GoCaracal samples and found that the framework evolved rapidly between January and July 2026.
The group previously used financial-themed phishing emails, malicious SVG attachments, URL-shortening services, and a Delphi loader to target Spanish-speaking victims.
The latest activity continues that approach but introduces GoCaracal alongside an updated version of the Bandook remote-access trojan.
Arctic Wolf said the malware was likely delivered through weaponized SVG files carrying Base64-encoded shortened URLs.
Victims who opened the attachment were redirected to attacker-controlled websites, including getpdfdigital[.]cloud, which delivered a 7-Zip archive containing a lightweight GoCaracal executable.
Dark Caracal Debuts GoCaracal
GoCaracal has two main build profiles, a lightweight version for initial access and payload delivery, and an extended version for long-term control and intelligence collection.
The lightweight implant collects basic details from infected systems, including the username, hostname, operating system, uptime, active window, and installed security tools.
It communicates with its command-and-control server using a custom AES-GCM-encrypted protocol.
Once active, the malware can download and execute files, retrieve content from URLs, run interactive command shells, load shellcode, and inject code into other processes.
Arctic Wolf found that this version acted as an entry-point tool during the Venezuelan intrusion.
After the lightweight implant established access, attackers deployed a Delphi loader carrying Bandook and the more capable GoCaracal variant.
This suggests Dark Caracal is using GoCaracal as part of a layered toolkit rather than as a single standalone payload.
The extended version contains 34 command handlers and supports file management, system discovery, process enumeration, keylogging, browser credential theft, file searches, remote desktop access, hidden browser sessions, SOCKS5 proxying, and persistence-related registry modifications.
Researchers also found internal version strings from v1.0.1 to v1.0.6, indicating that the framework is under active development. One of GoCaracal’s most notable features is its Ethereum-based fallback mechanism.
If the malware cannot contact its primary C2 server, it can query a public Ethereum JSON-RPC endpoint and retrieve a replacement C2 address from a smart contract, arcticwolf said.
Indicators of Compromise
| SHA-256 | File Name | Malware / Role |
|---|---|---|
1e499c815146124c4a6d2b48c99068b980ad74e1a2cfd16013f8d75a9425a0ca | TF-OFICINA004A9.exe | GoCaracal lightweight variant |
77f7ad29f4a8037ee5f38d3d87fb91cfd97cb8f7fa7883edf3fce506df5200c0 | TF-OFICINA004A9.exe |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
