Dark Caracal Deploys New Go Malware With Ethereum-Based C2 Fallback
Brief
Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications.
Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a previously undocumented Go‑based framework called GoCaracal alongside an updated Bandook backdoor.
Dark Caracal is an APT group associated with the Lebanese General Directorate of General. In past campaigns, it targeted entities in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany.
“In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela.