Dark Caracal Reloaded: New Malware, Same Hunting Grounds

Arctic Wolf Labs attributes a June 2026 intrusion affecting a Venezuelan communications organization to Dark Caracal (medium confidence), revealing a new modular Go-based framework called GoCaracal (lightweight access and extended RAT builds) used alongside an updated Bandook; the extended build supports an Ethereum smart-contract fallback for resilient C2. The report analyzes 249 samples, describes delivery via weaponized SVG phishing and a Delphi loader, catalogs IOCs (file hashes, domains, IPs, Ethereum contracts, file paths), outlines functionality (host profiling, credential/browser theft, keylogging, WebRTC remote desktop, SOCKS5 proxy, persistence), and provides YARA rules and detection guidance.