Reported by 2 outlets
Dark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin America
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Dark Caracal Deploys New GoCaracal Malware With Ethereum-Based C2 Across Latin America
cyberpress.org · 46d ago · August 28th, 2026
Arctic Wolf Labs has uncovered a new Go-based malware framework, named GoCaracal, used in a targeted intrusion against a communications organization in Venezuela. The activity has been linked with medium confidence to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security. The campaign shows that Dark Caracal is updating its long-running operations across Latin America while retaining familiar phishing and malware-delivery methods. Researchers identified 249 related GoCaracal samples and found that the framework evolved rapidly between January and July 2026. The group previously used financial-themed phishing emails, malicious SVG attachments , URL-shortening services, and a Delphi loader to target Spanish-speaking victims. The latest activity continues that approach but introduces GoCaracal alongside an updated version of the Bandook remote-access trojan. Arctic Wolf said the malware was likely delivered through weaponized SVG files carrying Base64-encoded shortened URLs. Victims who opened the attachment were redirected to attacker-controlled websites, including getpdfdigital[.]cloud, which delivered a 7-Zip archive containing a lightweight GoCaracal executable. Dark Caracal Debuts GoCaracal GoCaracal has two main build profiles, a lightweight version for initial access and payload delivery, and an extended version for long-term control and intelligence collection. The lightweight implant collects basic details from infected s
-
update from gbhackers.com
Hackers Use Ethereum Smart Contracts to Keep New GoCaracal Malware Connected
gbhackers.com · 46d ago · August 28th, 2026
Dark Caracal-linked operators are using Ethereum smart contracts as a resilient fallback mechanism for a newly identified Go-based malware framework called GoCaracal. The company assesses, with medium confidence, that the activity is tied to Dark […] The post Hackers Use Ethereum Smart Contracts to Keep New GoCaracal Malware Connected appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .