Dark Caracal GoCaracal Framework + Tortoiseshell TWOSTROKE Backdoor: Dual APT Campaign OTX Analysis — Enterprise Detection Pack

This briefing synthesizes two concurrent advanced persistent threat campaigns identified through open threat exchange telemetry. Both campaigns demonstrate the continued evolution of cyber-espionage tradecraft: Dark Caracal has rebuilt its tooling in Go with blockchain-based C2 fallback infrastructure, while the Iranian-aligned Tortoiseshell group has expanded its arsenal with a new C++ backdoor and a reverse SSH tunneling utility disguised as a legitimate Windows DLL.

Threat Summary

Two distinct espionage operations are running in parallel against different geopolitical targets:

Dark Caracal Reloaded — The long-running Dark Caracal operation (historically attributed to the Lebanese General Directorate of General Security) has resurfaced with GoCaracal, a previously undocumented modular framework written in Go. The campaign targets telecommunications providers across Latin America — Brazil, Chile, Colombia, Ecuador, El Salvador, Uruguay, and Venezuela — continuing the group's historic surveillance focus on the region. GoCaracal ships in two operational profiles: a lightweight implant for initial access and payload delivery, and an extended build for sustained collection including keylogging and browser credential theft. Most notably, the framework incorporates an Ethereum blockchain-based C2 fallback channel, allowing operators to rotate infrastructure while implants recover updated C2 addresses from blockchain data — a technique that defeats static domain blocklists.

Tortoiseshell Toolset Expansion — The Iranian-linked Tortoiseshell group (also tracked as Mirage Kitten) has added two new tools to its arsenal: a reverse SSH tunneling utility masquerading as wtsapi32.dll and a C++ backdoor sharing code lineage with the previously documented TWOSTROKE malware. Targeting is consistent with historic Tortoiseshell victimology: defense, aerospace, and technology sectors in the United States, United Kingdom, Australia, Canada, Japan, Saudi Arabia, and the UAE. The SSH tunnel leverages the legitimate Windows OpenSSH client to establish outbound encrypted tunnels to attacker infrastructure, blending C2 traffic with administrative SSH activity.

Collective objective: Both campaigns are intelligence-collection operations. Dark Caracal seeks persistent surveillance of telecommunications infrastructure and personnel; Tortoiseshell pursues defense industrial base and aerospace intellectual property and operational intelligence aligned with Iranian strategic interests.

Threat Actor / Malware Profile

Dark Caracal / GoCaracal

• Distribution: Targeted intrusion delivery; the lightweight GoCaracal implant establishes initial access and stages the extended build or secondary payloads such as Bandook (S0234) and the AsioGate loader.
• Payload behavior: Modular architecture — operators load collection modules on demand. The extended profile supports keylogging and browser credential harvesting, consistent with Dark Caracal's historic focus on account compromise and communications interception.
• C2 communication: Primary C2 over conventional infrastructure (the IPv4 and themed-domain indicators below, several using Spanish-language lures such as contabilidad.icu and documentodigital.cloud). Fallback channel resolves C2 addresses via Ethereum blockchain data, making takedown-resistant infrastructure rotation possible.
• Persistence: The extended build maintains long-term residence for sustained collection; expect scheduled task or run-key persistence staging from the lightweight implant.
• Anti-analysis: Go compilation frustrates static signature matching and string-based detection; modular design means analysts may only recover the lightweight stager, never observing full capability.

Tortoiseshell / TWOSTROKE + SSH Tunnel

• Distribution: Consistent with prior Tortoiseshell operations — social engineering lures (historically fake job/recruitment and defense-themed personas) delivering first-stage tooling.
• Payload behavior: The C++ backdoor shares code similarities with TWOSTROKE and supports file operations (upload/download, execution), enabling hands-on-keyboard collection.
• C2 communication: Reverse SSH tunnel using the legitimate Windows OpenSSH client (ssh.exe), initiated from a malicious DLL disguised as wtsapi32.dll — a DLL hijacking technique that abuses the trusted Windows Terminal Services API library name. C2 domains use the low-reputation .sbs TLD (locat.sbs, tiktok-u.sbs, the latter impersonating TikTok branding).
• Persistence: DLL hijack placement ensures the tunnel loads whenever the vulnerable host application executes.
• Anti-analysis: Living-off-the-land abuse of signed Microsoft OpenSSH binaries evades application allowlisting; the wtsapi32.dll masquerade hides the implant within expected system DLL search paths.

IOC Analysis

The indicator set comprises two types, requiring different operational handling:

IPv4 addresses (Dark Caracal C2): 45.152.198.108, 176.124.220.153, 82.117.87.192, 82.117.87.138 — these are bulletproof-hosting-adjacent netblocks. Operationalize at the egress firewall, proxy, and DNS resolver layers. Because GoCaracal can rotate C2 via its Ethereum fallback, IP blocking alone is insufficient — pair with behavioral detection for Go binaries making outbound TLS to uncategorized infrastructure and monitor for processes querying public Ethereum JSON-RPC endpoints (e.g., requests to eth_call methods) from non-wallet processes.

Domains: Dark Caracal lure domains (contabilidad.icu, documentodigital.cloud, getpdfdigital.cloud, soportedigital.cloud) use Spanish-language business themes targeting Latin American victims — these are both delivery and C2 infrastructure. Tortoiseshell's .sbs domains (locat.sbs, tiktok-u.sbs) should be blocked at DNS and flagged for any historical resolution. The .icu, .cloud, and .sbs TLDs warrant heightened scrutiny generally when combined with newly-registered-domain (NRD) intelligence feeds.

Tooling: Enrich indicators through your TIP (ThreatConnect, Anomali, OpenCTI); detonate associated samples in a sandbox (ANY.RUN, Hybrid Analysis) with Go-aware analysis (use gore or IDAPython Go string recovery for GoCaracal artifacts); pivot on TLS certificates and passive DNS (VirusTotal, PassiveTotal) to identify pre-publication infrastructure.

Detection Engineering

---
title: Tortoiseshell SSH Tunnel — Masqueraded wtsapi32.dll Loaded From Non-System Path
id: 8f3c2a11-dc4a-4e7b-9c1a-tort0001sshd
status: experimental
description: Detects DLL hijacking of wtsapi32.dll loaded from outside System32/SysWOW64, consistent with Tortoiseshell reverse SSH tunneling utility disguised as the Windows Terminal Services API library.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://www.infosecurity-magazine.com/news/tortoiseshell-new-backdoor-ssh/
logsource:
  category: image_load
  product: windows
detection:
  selection_dll:
    ImageLoaded|endswith: '\wtsapi32.dll'
  filter_legit:
    ImageLoaded|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_dll and not filter_legit
falsepositives:
  - Rare third-party remote administration tools bundling their own wtsapi32.dll
level: high
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1574.001
  - attack.t1036
---
title: Suspicious Windows OpenSSH Client Outbound Tunnel Usage
id: 8f3c2a12-dc4a-4e7b-9c1a-tort0002ssht
status: experimental
description: Detects ssh.exe launched with reverse/remote forwarding flags or spawned by non-interactive processes, matching Tortoiseshell abuse of the legitimate Windows OpenSSH client for C2 tunneling.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://www.infosecurity-magazine.com/news/tortoiseshell-new-backdoor-ssh/
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\ssh.exe'
  selection_args:
    CommandLine|contains:
      - ' -R '
      - ' -D '
      - '-o StrictHostKeyChecking=no'
      - ' -N '
      - ' -f '
  filter_admin:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
  condition: selection_img and selection_args and not filter_admin
falsepositives:
  - Legitimate administrative SSH tunneling by sysadmins (tune filter_admin to your environment)
level: medium
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1219
---
title: GoCaracal / Dark Caracal C2 Communication to Known Infrastructure
id: 8f3c2a13-dc4a-4e7b-9c1a-dc00003goc2
status: experimental
description: Detects outbound network connections to Dark Caracal GoCaracal C2 IP addresses and lure/C2 domains identified in OTX pulse telemetry (August 2026 campaign).
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://arcticwolf.com/resources/blog/dark-caracal-reloaded-new-malware-same-hunting-grounds/
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - '45.152.198.108'
      - '176.124.220.153'
      - '82.117.87.192'
      - '82.117.87.138'
  selection_domain:
    DestinationHostname:
      - 'contabilidad.icu'
      - 'documentodigital.cloud'
      - 'getpdfdigital.cloud'
      - 'soportedigital.cloud'
      - 'locat.sbs'
      - 'tiktok-u.sbs'
  condition: 1 of selection_*
falsepositives:
  - None expected; all indicators are confirmed malicious C2
level: critical
tags:
  - attack.command_and_control
  - attack.t1071

// Security Arsenal — Dark Caracal GoCaracal + Tortoiseshell TWOSTROKE/SSH Tunnel Hunt
// Looks for: (1) C2 connections, (2) masqueraded wtsapi32.dll loads, (3) suspicious ssh.exe tunnels, (4) Ethereum RPC fallback queries
let DarkCaracalIPs = dynamic(["45.152.198.108","176.124.220.153","82.117.87.192","82.117.87.138"]);
let MalDomains = dynamic(["contabilidad.icu","documentodigital.cloud","getpdfdigital.cloud","soportedigital.cloud","locat.sbs","tiktok-u.sbs"]);
let C2Hits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in~ (DarkCaracalIPs) or RemoteUrl in~ (MalDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend Hunt = "C2 Indicator Match";
let DllHijack = DeviceImageLoadEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "wtsapi32.dll"
| where FolderPath !startswith "C:\\Windows\\System32" and FolderPath !startswith "C:\\Windows\\SysWOW64"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, SHA256
| extend Hunt = "Masqueraded wtsapi32.dll Load";
let SshTunnel = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "ssh.exe"
| where ProcessCommandLine has_any (" -R ", " -D ", " -N ", "StrictHostKeyChecking=no")
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend Hunt = "Suspicious OpenSSH Tunnel";
let EthFallback = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort == 8545 or RemoteUrl has_any ("infura.io", "alchemy.com", "eth_call")
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
| extend Hunt = "Possible Blockchain C2 Fallback Query";
union C2Hits, DllHijack, SshTunnel, EthFallback
| sort by TimeGenerated desc

# Security Arsenal — Dual APT Host Hunt: GoCaracal & Tortoiseshell artifacts
# Run elevated on suspected hosts or deploy fleet-wide via your EDR/remote shell.

$Report = @()

# 1. Check for active/recent connections to known C2 IPs
$C2IPs = @('45.152.198.108','176.124.220.153','82.117.87.192','82.117.87.138')
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $C2IPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $Report += [pscustomobject]@{Check='C2 Connection'; Finding="$($c.RemoteAddress):$($c.RemotePort) by $($proc.ProcessName) ($($proc.Path))"}
}

# 2. DNS cache check for malicious domains
$MalDomains = @('contabilidad.icu','documentodigital.cloud','getpdfdigital.cloud','soportedigital.cloud','locat.sbs','tiktok-u.sbs')
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $d = $_.Entry; $MalDomains | Where-Object { $d -like "*$_*" } }
foreach ($d in $dns) { $Report += [pscustomobject]@{Check='DNS Cache IOC'; Finding="$($d.Entry) -> $($d.Data)"} }

# 3. Hunt for masqueraded wtsapi32.dll outside system paths
$suspectPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:USERPROFILE\Downloads","C:\Users\Public")
foreach ($p in $suspectPaths) {
    Get-ChildItem -Path $p -Filter 'wtsapi32.dll' -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        $Report += [pscustomobject]@{Check='DLL Hijack Artifact'; Finding="$($_.FullName) | Signed: $($sig.Status)"}
    }
}

# 4. Unsigned/recently-created ssh.exe copies outside System32\OpenSSH
$sshDirs = @("$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","C:\Users\Public")
foreach ($p in $sshDirs) {
    Get-ChildItem -Path $p -Filter 'ssh.exe' -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $Report += [pscustomobject]@{Check='Rogue OpenSSH Binary'; Finding="$($_.FullName) | Created: $($_.CreationTime)"}
    }
}

# 5. Persistence review: run keys and scheduled tasks referencing Go-built or odd binaries
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object {
        $_.Value -match 'AppData|ProgramData|Temp|Public' -and $_.Name -notmatch '^PS'
    } | ForEach-Object { $Report += [pscustomobject]@{Check='Suspicious Run Key'; Finding="$k :: $($_.Name) = $($_.Value)"} }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match 'AppData|ProgramData|Temp|Public'
} | ForEach-Object { $Report += [pscustomobject]@{Check='Suspicious Scheduled Task'; Finding="$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"} }

if ($Report.Count -eq 0) { Write-Output "[+] No indicators found on $env:COMPUTERNAME" }
else { $Report | Format-Table -AutoSize | Out-String -Width 300 | Write-Output }

Response Priorities

Immediate (0–4 hours)

• Block all listed IPv4 addresses and domains at the egress firewall, secure web gateway, and DNS resolver (including RPZ sinkholes for the .icu/.cloud/.sbs indicators).
• Deploy the Sigma rules above to your SIEM; run the KQL hunt across a 30-day lookback for retrospective compromise.
• Search proxy/ZTNA logs for historical connections to the indicators and for non-browser processes reaching Ethereum RPC endpoints (port 8545, infura.io, alchemy.com) — GoCaracal's blockchain fallback channel.
• Inventory hosts with wtsapi32.dll present outside System32/SysWOW64 and any ssh.exe copies outside C:\Windows\System32\OpenSSH.

24 Hours

• GoCaracal's extended build performs browser credential theft and keylogging — for any host with confirmed C2 contact, force enterprise-wide credential resets for the affected users (including stored browser credentials), revoke active sessions/OAuth tokens, and re-enroll MFA factors.
• For telecommunications and defense/aerospace organizations in the targeted geographies, brief executives and activate enhanced monitoring; verify no recruitment-themed or Spanish-language business-document lures (accounting/PDF support themes) reached users.
• Isolate confirmed-compromised hosts and capture memory before remediation — GoCaracal's modular design means disk artifacts may only show the lightweight stager.

1 Week

• Implement application control (WDAC/AppLocker) restricting ssh.exe execution to approved administrative contexts and alerting on all other invocations.
• Deploy DLL search-order hardening and monitor image loads of security-sensitive DLL names from user-writable paths.
• Restrict outbound traffic to known-good destinations for server and sensitive-segment VLANs; block newly registered domains categorically for high-risk user groups.
• Add Go-binary behavioral analytics (unexpected TLS beacons, JSON-RPC to blockchain nodes from non-wallet software) to your EDR detection stack, since static GoCaracal signatures will not survive recompilation.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub