Dark Caracal's New Malware GoCaracal: From SVG Phishing to Ethereum Backup C2

1. Basic Information

• Article Title: Dark Caracal Reloaded: New Malware, Same Hunting Grounds
• Publisher: Arctic Wolf Labs
• Publication Date: 2026-08-26
• Source: Arctic Wolf Labs
• Related Sources: Dark Reading, Kaspersky Dark Caracal campaign report
• Related Malware, Threat Groups, CVEs, Products: GoCaracal, Bandook, AsioGate, Dark Caracal, Microsoft Windows, Ethereum JSON-RPC
• Severity: High

2. Executive Summary

Dark Caracal delivers a lightweight GoCaracal malware via malicious SVGs, deploys Bandook and an extended 34-feature build, and implements data theft, remote control, SOCKS5, and a backup C2 via Ethereum smart contracts.

3. Attack Flow

From SVG Phishing to Multi-Stage Payloads

1. Arctic Wolf assesses that phishing using Spanish-language financial and tax themes delivered malicious SVGs. The original emails were not recovered.
2. URLs inside the SVG use Base64 encoding and URL shorteners to redirect victims to attacker-controlled sites.
3. The sites distribute a lightweight GoCaracal executable inside a 7-Zip archive.
4. The lightweight build collects host information, registers with the C2 using a custom protocol encrypted with AES-GCM, and provides shell access, file downloads, execution, and shellcode injection.
5. A Delphi loader deploys an updated version of Bandook and an extended GoCaracal build.
6. The extended build performs browser cookie and login database theft, keylogging, file searching, WebRTC remote desktop, hidden browsers, SOCKS5 proxying, and registry persistence.
7. If the primary C2 fails, it uses Ethereum JSON-RPC (eth_getStorageAt) to retrieve an alternative C2 address from smart contract storage.

4. Threat Actor Position and Execution Location

• External attackers who contact targets via email and web.
• After execution, the malware runs in the Windows user context. The extended build provides interactive shells, remote desktop, and proxy features.

5. Visibility for Victims and Administrators

Victims

• Tricked into opening SVGs and archives that look like financial or tax documents.
• After execution, hidden browsers or remote desktop sessions may separate normal screen use from attacker activity.

Administrators

• Can observe the chain: SVG -> shortener -> redirector -> archive download, Go executable, Delphi loader, and concurrent Bandook execution.
• Browser database access, keylogging, process injection, Run-key artifacts, and Ethereum JSON-RPC traffic serve as key indicators.

6. Success and Failure Conditions

Success Conditions

• The target opens the malicious SVG/archive and runs the executable.
• The endpoint does not block payload downloads, GoCaracal execution, or C2 communication.
• The system reaches the primary C2 or the alternative C2 obtained via Ethereum.

Failure Conditions / Risk Mitigation

• Block the multi-stage transition of SVGs and archives at the mail and web gateways.
• Use application control to block unauthorized executables and script/shellcode injection.
• Restrict unnecessary outbound traffic, including Ethereum JSON-RPC, and block C2 IOCs.

7. What Happens Upon Success

• Theft of browser cookies, login databases, keylogs, and target files.
• Remote control via interactive shells, WebRTC remote desktop, and hidden browsers.
• Use of the compromised host as a relay via SOCKS5 proxy.
• Persistence via registry artifacts and takedown resistance via Ethereum backup C2.

8. Observable Logs

• Email: Financial and tax themes, SVG attachments, and prompts to download 7-Zip archives.
• Proxy/SWG/DNS: URL shorteners, redirectors, distribution infrastructure like getpdfdigital[.]cloud, and C2 traffic. Correlation of Ethereum public JSON-RPC calls (eth_getStorageAt) with endpoint context.
• Endpoint/EDR: Browser navigation from SVGs, archive extraction, Go executables, Delphi loaders, and concurrent execution of Bandook and GoCaracal. Shellcode injection, browser DB access, keylogging, hidden browsers, and registry hive / NTUSER.MAN modifications.
• Identity/IdP: Subsequent sign-ins using stolen browser cookies or login information.
• SaaS/Cloud: SaaS access using stolen sessions or credentials.
• Network: AES-GCM custom packet protocol, WebRTC, SOCKS5, and primary/backup C2 traffic.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Confirmed contact with malicious SVGs, shorteners, and archives, but payload execution is unconfirmed.
• User Action Confirmed: Confirmed user action opening the SVG/archive and launching the executable.
• Initial Execution Confirmed: Confirmed execution of the lightweight GoCaracal or loader and C2 registration.
• Data Theft or Session Compromise Confirmed: Confirmed access or transmission of browser databases, cookies, keylogs, or files.
• Post-Compromise Confirmed: Confirmed presence of extended builds, Bandook, remote desktop, SOCKS5, persistence, and additional payloads.

10. Investigation Playbook

• Trigger: Detection of Dark Caracal SVGs, domains, hashes, Go executables, Ethereum JSON-RPC fallback, or concurrent Bandook execution.
• Initial Verification: Preserve email, download chains, browser history, archives, executed file hashes, and process trees. Check whether the build is lightweight or extended, look for concurrent Bandook execution, and identify C2 addresses.
• Endpoints: Investigate browser DB access, keyloggers, shellcode injection, registry hives, NTUSER.MAN, and hidden browser/remote desktop artifacts.
• Identity & Cloud: Check and revoke IdP and SaaS sessions associated with credentials and cookies stolen from browsers.
• Post-Exploitation: Investigate SOCKS5 traffic, internal discovery, additional payloads, data exfiltration, and connections to other hosts.
• Containment: Isolate endpoints, block IOCs, revoke credentials and sessions, remove persistence, or reimage hosts. Do not treat Ethereum JSON-RPC traffic as malicious by default; evaluate it based on the specific process and contract address.
• Classification: Distinguish between lure contact, user execution, lightweight builds, extended builds, data theft, and pivoting.

11. Defense and Detection Ideas

• Single Events: Office or browser-initiated execution of Go executables from archives, followed by shellcode injection or browser database access.
• Timeline Correlation: Correlate SVGs -> redirect chains -> archives -> lightweight GoCaracal -> Delphi loader -> Bandook/extended build -> C2.
• Hunting: Search broadly for GoCaracal hashes and domains, Ethereum contract fallbacks, 34-handler capabilities, hidden browsers, and SOCKS5.
• Log Gaps: If email attachments, browser URL chains, process injection, browser file access, and network flows are missing, the multi-stage chain cannot be reconstructed.
• Priority Countermeasures: Control SVG/archive delivery and enforce application control. Protect browser credential stores and monitor user sessions. Conduct IOC and behavior hunting on endpoints and networks.

12. Facts / Inference / Hypothesis

Facts

• Arctic Wolf identified GoCaracal at a telecommunications organization in Venezuela in June 2026, assessing the link to Dark Caracal with medium confidence.
• Identified lightweight and extended builds out of 249 samples.
• The extended build includes 34 handlers with features for browser collection, keylogging, WebRTC remote desktop, SOCKS5, and persistence.
• The Ethereum fallback mechanism was evaluated as tested and operationalized based on blockchain activity, not just dead code.
• GoCaracal was deployed alongside Bandook. There is no evidence it is a direct code successor to AsioGate.

Inference

• Using lightweight builds keeps the initial footprint small. Deploying extended builds only when needed minimizes exposure while expanding capabilities.
• Blockchain-based C2 resolution makes it harder to disrupt operations by simply taking down domains or servers.

Hypothesis

• Targeting of additional Latin American countries is assessed from telemetry, and the attribution confidence to Dark Caracal may vary across different activities.

13. MITRE ATT&CK Mapping

• T1566.001 Phishing: Spearphishing Attachment (Medium): Original emails not recovered, but SVG attachment delivery assessed via campaign patterns and artifacts.
• T1204.002 User Execution: Malicious File (High): Victims tricked into running archives/executables from weaponized SVGs.
• T1055 Process Injection (High): Lightweight build includes shellcode injection capabilities.
• T1555.003 Credentials from Password Stores: Credentials from Web Browsers (High): Collects browser cookies and login databases.
• T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Medium): Run-key workflows involving registry hive manipulation and NTUSER.MAN artifacts.
• T1090.001 Proxy: Internal Proxy (High): Provides in-band SOCKS5 proxy capabilities.
• T1102 Web Service (Medium): Uses Ethereum JSON-RPC and smart contract storage to resolve backup C2 addresses.

14. Unknowns and Additional Investigation

• The full chain of original phishing emails and SVGs, the number of compromised organizations, and the actual use of stolen data.
• The relationship between Dark Caracal and Lebanon GDGS is based on prior assessments and does not represent new evidence specific to this case.

15. Impact on SOCs and Organizations

While the primary targets are located in Latin America, attack techniques like SVG-to-archive redirects, browser credential theft, and Ethereum backup C2s can be reused globally. Security Operations Centers (SOCs) should monitor not just hashes, but the entire behavior chain including multi-stage delivery, browser activity, proxy usage, and blockchain communications.

16. Target-Specific Summaries

• For SOCs: Correlate timelines from SVGs to lightweight and extended builds, Bandook, browser theft, and Ethereum fallbacks.
• For Administrators: Control SVG/archive delivery, block unauthorized binaries, protect browser credential stores, and restrict unnecessary Ethereum RPC traffic.
• For End Users: If an executable is launched from a document-like SVG or archive, do not open it and report it immediately.