[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJ6qK9XpnhDk5598mczH5xVDjyXY3rtIqSdlwUMmuIAk":3},{"article":4,"iocs":49,"watch_terms":90,"solutions":91,"lesson":181},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"f1c60dd5-226d-441c-98d2-aa0fc4df2858","GoCaracal Malware Uses Ethereum Smart Contract to Fetch Replacement C2 Address","gocaracal-malware-uses-ethereum-smart-contract-to-fetch-replacement-c2-address-cb4f10","Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control","A new Go-based malware framework named GoCaracal has been deployed by threat actors potentially linked to Dark Caracal. The malware offers remote shell access, payload execution, and extended features like keylogging and browser data theft. Notably, GoCaracal utilizes an Ethereum smart contract to dynamically fetch replacement C2 addresses when primary servers fail, allowing operators to update C2 infrastructure without distributing new binaries.","GoCaracal malware uses Ethereum smart contracts for C2 fallback.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fgocaracal-malware-uses-ethereum-smart.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEieDE2TgdHU9cQ1MQ7milMPfNWnlskvIWM9VB_9t59o4zxCWPtZY5yyhrJ9Pc558pdVGdapBNcv9SP38IyfrHp0KIgLQeYlAQIPGwopzDvg2WimSzte5wkju-6YypllUrEr8-yto3Bx8mZAhfs7Hf64MTLwyDqAUCPEFlSey89QZx3L-xmHFzVBBwQmRVU\u002Fs1600\u002Fgo.jpg","2026-08-27T09:33:38+00:00","2026-08-27T12:00:03.564828+00:00",8,[17,20,23],{"name":18,"type":19},"Dark Caracal","threat_actor",{"name":21,"type":22},"Arctic Wolf","vendor",{"name":24,"type":25},"Ethereum","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60,63,66,69,72,75,78,81,84,87],{"type":51,"value":52,"context":53},"mitre_attack","T1059.001","Shell execution",{"type":51,"value":55,"context":56},"T1105","Ingress Tool Transfer (payload retrieval and execution)",{"type":51,"value":58,"context":59},"T1071.001","Web Protocols (C2 communication)",{"type":51,"value":61,"context":62},"T1055","Process Injection (shellcode loading and injection)",{"type":51,"value":64,"context":65},"T1056.001","Keylogging",{"type":51,"value":67,"context":68},"T1537","Transfer Data to Cloud Account (browser data theft)",{"type":51,"value":70,"context":71},"T1219","Remote Access Software (remote desktop control)",{"type":51,"value":73,"context":74},"T1090.003","Proxy (SOCKS5 proxying)",{"type":51,"value":76,"context":77},"T1078.004","Cloud Accounts (browser login data collection)",{"type":51,"value":79,"context":80},"T1071.004","Web Protocols (WebRTC remote desktop)",{"type":51,"value":82,"context":83},"T1547.001","Registry Run Keys \u002F Startup Folder (persistence)",{"type":51,"value":85,"context":86},"T1041","Exfiltration Over C2 Channel",{"type":51,"value":88,"context":89},"T1071","Application Layer Protocol (eth_getStorageAt request)",[21],{"controls":92,"vendors":175},[93,122,149],{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":123,"name":124,"problem":125,"products":126},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":144,"product_name":145,"url":147,"description":148},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"slug":150,"name":151,"problem":152,"products":153},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[154,162,170],{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":163,"vendor_name":164,"vendor_logo":165,"product_slug":166,"product_name":167,"url":168,"description":169},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":171,"product_name":172,"url":173,"description":174},"cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[176],{"slug":177,"name":21,"logo_path":178,"roles":179},"arctic-wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[180],"reported_by",{"slug":182,"title":183,"body":184,"framework_refs":185,"framework_notes":197},"gocaracal-malware-exploits-ethereum-smart-contracts-for-resilient-c2-communication","GoCaracal Malware Exploits Ethereum Smart Contracts for Resilient C2 Communication","GoCaracal represents a sophisticated evolution in malware resilience by leveraging Ethereum smart contracts as a decentralized, tamper-resistant mechanism to rotate command-and-control (C2) server addresses — making traditional domain\u002FIP blocklisting largely ineffective. Because the blockchain is public and immutable, defenders cannot take down or seize the C2 pointer the way they would a rogue domain. This technique allows threat actors to maintain persistent control over compromised hosts without redeploying malware binaries, significantly extending the operational lifespan of a campaign. The malware's additional capabilities — keylogging, browser credential theft, and remote shell access — mean that a single undetected infection can lead to full credential compromise and lateral movement across an organization.",[186,187,188,189,190,191,192,193,194,195,196],"CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","CIS Control 4 – Secure Configuration of Enterprise Assets","NIST SP 800-61 – Incident Response","NIST SP 800-41 – Guidelines on Firewalls and Firewall Policy","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.AC-5 – Network Integrity \u002F Segmentation","MITRE ATT&CK T1568.001 – Dynamic Resolution: Fast Flux DNS (analogous blockchain C2 technique)","MITRE ATT&CK T1071 – Application Layer Protocol","MITRE ATT&CK T1414 – Capture Browser Credentials","ISO\u002FIEC 27001 A.13.1 – Network Security Management",{}]