Dark Caracal Uses Ethereum Smart Contracts to Keep Malware Connected

Arctic Wolf Labs has discovered a new malware framework called GoCaracal, which is linked to the cyber-espionage group Dark Caracal. The framework was found while investigating a targeted intrusion in June 2026 against a communications organization in Venezuela.

The most notable feature of GoCaracal is its use of Ethereum smart contracts as a resilient fallback mechanism for command-and-control (C2) communication. If the primary C2 server fails, the malware issues an eth_getStorageAt query to a public Ethereum JSON-RPC service and retrieves a replacement address stored in a configured smart contract.

Arctic Wolf identified a custom Solidity contract named BulletproofC2, designed to store a mutable C2 value that only the deploying wallet can update. Researchers also found related deployments on Ethereum's Sepolia test network before comparable mainnet activity, indicating active development and testing of the framework.