Ethereum Smart Contracts Used by Malware Framework for Backup C2 Access

GoCaracal, a newly documented malware framework, is using Ethereum infrastructure to support command-and-control recovery during cyberattacks. Arctic Wolf observed the Go-based malware during a June 2026 intrusion involving a communications organization in Venezuela.

The researchers noted that GoCaracal uses an Ethereum smart contract to provide backup C2 access, allowing the attackers to recover and maintain control over their compromised systems.

This finding highlights the growing threat of malware using blockchain technology for malicious purposes, underscoring the need for increased vigilance in cybersecurity measures.