GoCaracal Malware Leverages Ethereum for Backup C2 Access

A newly discovered malware framework called GoCaracal is using Ethereum infrastructure to support command-and-control recovery during cyberattacks. The framework, which was observed by Arctic Wolf during a June 2026 intrusion involving a communications organization in Venezuela, gives operators remote shell access and allows them to retrieve and execute additional payloads.

GoCaracal first attempts to communicate with a configured command-and-control server through a normal off-chain connection. When repeated attempts fail, the malware can query a public Ethereum JSON-RPC endpoint for another address. This address is obtained by reading data stored within a configured Ethereum smart contract using the 'eth_getStorageAt' function.

The response from the smart contract contains a replacement C2 address, which GoCaracal places into its active memory configuration. The malware then returns to conventional internet communication and tries reaching the newly supplied command server.