Dark Caracal Reloaded: New Malware, Same Hunting Grounds

Arctic Wolf Labs attributes a June 2026 targeted intrusion against a Venezuelan communications organization to Dark Caracal, describing the discovery of a modular Go-based framework dubbed GoCaracal (lightweight access and extended collection builds) used alongside an updated Bandook payload; the extended build supports an Ethereum smart-contract fallback for resilient C2 resolution. The report documents delivery via Spanish-language financial-themed phishing with weaponized SVGs and a Delphi loader, analyzes 249 samples to trace GoCaracal's development and capabilities (host discovery, keylogging, browser credential collection, WebRTC remote desktop, SOCKS5 proxy, persistence), provides YARA and IOC artifacts (hashes, domains, IPs, contract addresses, file paths), and assesses regional targeting across multiple Latin American countries.