Malware Framework GoCaracal Leverages Ethereum for Backup C2 Server Info

A newly identified malware framework called GoCaracal is using Ethereum infrastructure to backup command-and-control (C2) server information during cyberattacks, according to cybersecurity firm Arctic Wolf. Researchers discovered the Go-based malware during a June 2026 intrusion targeting a communications organization in Venezuela.

GoCaracal provides attackers with remote shell access and the ability to download and execute additional malicious payloads. The extended version also includes browser data theft, keylogging, remote desktop control, and SOCKS5 proxy capabilities.

Initial connections are made through conventional internet infrastructure. If repeated attempts fail, the malware queries a public Ethereum JSON-RPC endpoint to obtain an alternative server address using the 'eth_getStorageAt' method. The returned data contains a replacement C2 address, which is loaded into GoCaracal's active memory before another standard connection attempt.