GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address
- ID
- 18522
- Status
- summarized
- Published
- 27 Aug 2026, 5:33 PM
- Fetched
- 27 Aug 2026, 6:32 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 27 Aug 2026, 6:34 PM
- Tags
- Audience
- developers
What happened
Arctic Wolf linked a new Go-based malware framework called GoCaracal to the Dark Caracal threat group with medium confidence, deployed in a June 2026 intrusion at a Venezuelan communications organization. GoCaracal uses an Ethereum smart contract as a fallback C2 mechanism—when its primary C2 server fails, it queries a public Ethereum JSON-RPC endpoint via eth_getStorageAt to fetch a replacement address. The malware offers remote shell, keylogging, browser data theft, WebRTC remote desktop, and SOCKS5 proxying.
Why it matters
The blockchain-as-C2-infrastructure technique is worth noting if you build or defend systems that monitor outbound network traffic, since traditional domain/IP blocklists won't catch a fallback path through public Ethereum RPC endpoints. However, this is a targeted espionage campaign against a specific sector in Latin America—most builders in this audience have no action to take beyond awareness of the technique.
Discussion angle
How public blockchain infrastructure (Ethereum RPC endpoints) can be abused as resilient, censorship-resistant command-and-control channels—and whether this pattern could appear in other adversarial use cases relevant to Southeast Asian organizations.