GoCaracal Malware Framework Exploits Ethereum Infrastructure

A newly documented malware framework called GoCaracal is using Ethereum infrastructure to support command-and-control recovery during cyberattacks. Arctic Wolf observed the Go-based malware during a June 2026 intrusion involving a communications organization in Venezuela.

The framework gives operators remote shell access and allows them to retrieve and execute additional payloads. Its extended version also supports browser data theft, keylogging, remote desktop control, and SOCKS5 proxy functions.

GoCaracal first attempts to communicate with a configured command-and-control server through a normal off-chain connection. When repeated attempts fail, the malware can query a public Ethereum JSON-RPC endpoint for another address.

The request uses ‘eth_getStorageAt’ to read data stored within a configured Ethereum smart contract. That response contains a replacement C2 address, which GoCaracal places into its active memory configuration.