GoCaracal Malware Uses Ethereum Smart Contracts for C2 Dead-Drop Resolution — Detection and Hunting Guide

Arctic Wolf has attributed, with medium confidence, a June 2026 intrusion at an unnamed Venezuelan communications organization to Dark Caracal — an actor long associated with the Lebanon-linked espionage tooling best known from the Lookout/EFF "Dark Caracal" disclosure. The intrusion delivered something new: GoCaracal, a previously undocumented Go-based malware framework with a technique that should be on every SOC's radar — it resolves replacement command-and-control (C2) infrastructure by reading an Ethereum smart contract on the public blockchain.

This matters far beyond one victim in Venezuela. Blockchain-based dead-drop resolution (T1102.001 / T1071.001 territory) solves two problems for attackers: it makes C2 rotation censorship-resistant, and it hides the real C2 address behind indistinguishable, legitimate-looking HTTPS traffic to public Ethereum RPC endpoints. Your perimeter cannot simply "block Ethereum" — enterprises increasingly have legitimate wallet, DeFi, and Web3 tooling on their networks. Defenders need behavioral detection, not blocklists.

GoCaracal's core profile provides remote shell access and arbitrary code execution; an extended profile adds browser data theft, keylogging, and remote desktop control. If you are running a SOC or MDR function — particularly for telecom, government, or critical-infrastructure clients — this is a hunt you should run this week.

Technical Analysis

Threat Overview

• Malware: GoCaracal — previously undocumented, written in Go (cross-platform potential, though the observed intrusion targeted a communications organization)
• Attribution: Dark Caracal (medium confidence, per Arctic Wolf)
• Observed victimology: Communications sector, Venezuela, June 2026
• Capabilities:
  • Remote shell access and arbitrary command/code execution
  • Browser data theft (credentials, cookies, stored session data)
  • Keylogging
  • Remote desktop control (screen/interactive session access)
• C2 innovation: Ethereum smart contract used as a dead-drop resolver — the implant queries the blockchain via public RPC endpoints (typically eth_call JSON-RPC over HTTPS/443) to retrieve the current C2 address, enabling seamless infrastructure rotation when prior C2 nodes are burned

Why the Ethereum Dead-Drop Technique Is Hard to Defend

Traditional C2 detection relies on domain reputation, DNS telemetry, and TLS fingerprinting against known-bad infrastructure. GoCaracal's bootstrap traffic hits known-good infrastructure: public Ethereum JSON-RPC gateways such as Infura, Alchemy, Ankr, PublicNode, LlamaRPC, Cloudflare's Ethereum gateway, or raw port-8545 nodes. The payload returned by eth_call is just hex-encoded calldata — the replacement C2 address — that looks identical to any legitimate smart contract read.

From a defender's perspective, the attack chain looks like this:

1. Implant executes (Go binary, often statically linked, no runtime dependencies, frequently masquerading under benign-looking process names or dropped in user-writable paths).
2. Implant issues HTTPS POST JSON-RPC (eth_call / eth_getStorageAt) to a public Ethereum RPC endpoint to read the operator-controlled contract.
3. Implant extracts the live C2 address from the returned data and pivots to the actual C2 for tasking.
4. Operator modules deliver remote shell, browser credential/cookie theft (targeting Chromium Login Data, Cookies, Local State SQLite stores and browser credential vaults), keylogging (SetWindowsHook-style low-level hooks or raw input polling), and RDP-style remote control.

Exploitation status: Confirmed active in-the-wild intrusion (June 2026). No CVE is associated with this activity — it is malware TTPs, not a vulnerability. It is not on the CISA KEV (no CVE exists). The malware is previously undocumented, so assume zero or near-zero antivirus coverage and rely on behavioral controls.

Detection & Response

The highest-fidelity signals for GoCaracal-style activity are:

1. Non-browser, non-wallet processes initiating connections to Ethereum RPC endpoints or raw TCP/8545. Browsers, browser extensions, and legitimate wallet clients (MetaMask in Chrome/Edge/Firefox, Ledger Live, etc.) will legitimately touch these endpoints — but svchost-spawned children, Office applications, scripting hosts, rundll32, or unknown Go binaries in %APPDATA%/%TEMP% should not.
2. eth_call JSON-RPC bodies in proxy/ZTNA logs from endpoints that have no Web3 business function.
3. Browser credential store access by non-browser processes — classic for the extended profile's theft module.
4. Unsigned Go-compiled binaries executing from user-writable directories with outbound network activity.

Sigma Rules

---
title: Non-Browser Process Connecting to Public Ethereum RPC Endpoints
id: 4f2c1b8a-7d3e-4a91-b6c2-9e0d5f7a3c21
status: experimental
description: Detects processes other than known browsers/wallet clients establishing connections to public Ethereum JSON-RPC endpoints, consistent with GoCaracal-style blockchain dead-drop C2 resolution.
references:
  - https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html
  - https://attack.mitre.org/techniques/T1102/001/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1102.001
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'infura.io'
      - 'alchemy.com'
      - 'cloudflare-eth.com'
      - 'llamarpc.com'
      - 'ankr.com'
      - 'publicnode.com'
      - 'flashbots.net'
      - 'mainnet.eth'
  selection_port:
    DestinationPort:
      - 443
      - 8545
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\Ledger Live.exe'
  condition: selection_dest and selection_port and not filter_browsers
falsepositives:
  - Legitimate Web3/dApp backend services or enterprise blockchain nodes
  - Cryptocurrency trading or treasury management software
level: high
---
title: Browser Credential Store Access by Non-Browser Process
id: 8c1e4d72-2b5f-49a3-8d71-6a0c3e9b5f44
status: experimental
description: Detects non-browser processes accessing Chromium or Firefox credential and cookie stores, consistent with GoCaracal extended-profile browser data theft modules.
references:
  - https://thehackernews.com/2026/08/gocaracal-malware-uses-ethereum-smart.html
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Local State'
      - '\logins.json'
      - '\key4.db'
      - '\cookies.sqlite'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Legitimate backup, migration, or password-manager import tools
  - EDR/forensic collection agents
level: high

KQL Hunt (Microsoft Sentinel / Defender)

Hunt for non-browser processes talking to Ethereum RPC infrastructure, joined against devices with no sanctioned Web3 usage. Extend the LegitImages list to your environment's approved wallet/dApp software.

let EthRpcIndicators = dynamic(["infura.io", "g.alchemy.com", "cloudflare-eth.com", "llamarpc.com", "rpc.ankr.com", "publicnode.com", "flashbots.net"]);
let LegitImages = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "Ledger Live.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (EthRpcIndicators) or (RemotePort == 8545 and ActionType == "ConnectionSuccess")
| where not(InitiatingProcessFileName has_any (LegitImages))
| extend SuspiciousPath = iff(InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Temp\\", "\\ProgramData\\", "\\Users\\Public\\"), true, false)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    RemoteEndpoints = make_set(RemoteUrl), RemoteIPs = make_set(RemoteIP)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, SuspiciousPath
| order by SuspiciousPath desc, Connections desc

For proxy/network telemetry ingested as CommonSecurityLog, hunt JSON-RPC method strings:

CommonSecurityLog
| where TimeGenerated > ago(14d)
| where (RequestURL has_any ("infura.io", "alchemy.com", "ankr.com", "publicnode.com", "llamarpc.com", "cloudflare-eth.com"))
   or (AdditionalExtensions has_any ("eth_call", "eth_getStorageAt", "eth_getCode"))
| summarize Hits = count(), Methods = make_set(AdditionalExtensions), Destinations = make_set(RequestURL)
   by SourceHostName, SourceIP, DestinationHostName
| order by Hits desc

Velociraptor VQL Hunt

Sweep the fleet for live processes holding connections to Ethereum RPC infrastructure or raw 8545, enriched with binary metadata (unsigned, user-writable path — typical of dropped Go implants):

-- Hunt for processes with active connections to Ethereum RPC endpoints / port 8545
-- Joins netstat with pslist and flags unsigned binaries in user-writable paths
LET suspects <= SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(appdata|temp|programdata|users\\\\public)'
   OR CommandLine =~ '(?i)(infura|alchemy|eth_|8545|jsonrpc)'

SELECT n.Pid AS Pid,
       n.RemoteIP AS RemoteIP,
       n.RemotePort AS RemotePort,
       n.Status AS ConnStatus,
       s.Name AS ProcessName,
       s.Exe AS ExePath,
       s.CommandLine AS CommandLine,
       s.Username AS Username,
       s.CreateTime AS ProcessStart
FROM netstat()
JOIN suspects AS s ON n.Pid = s.Pid
WHERE n.RemotePort = 8545
   OR n.RemotePort = 443

A complementary artifact to sweep for Go binaries recently dropped in user-writable locations:

-- Find recently created executables in user-writable paths (GoCaracal implant staging)
SELECT FullPath, Size, Mtime, Ctime,
       hash(path=FullPath) AS Hash
FROM glob(globs=[
  'C:/Users/*/AppData/Local/**/*.exe',
  'C:/Users/*/AppData/Roaming/**/*.exe',
  'C:/ProgramData/**/*.exe',
  'C:/Windows/Temp/**/*.exe'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

Triage / Hardening Script

Run this on suspect endpoints (or fleet-wide via your RMM/EDR) to enumerate established connections to Ethereum RPC infrastructure, identify the owning process, and check its signature and path. The optional block section creates egress firewall rules for RPC port 8545 on segments that have no blockchain business need — do not blindly block 443 endpoints if your org uses Web3 tooling.

# GoCaracal Ethereum-C2 triage — run elevated
$RpcDomains = @('infura.io','alchemy.com','cloudflare-eth.com','llamarpc.com','ankr.com','publicnode.com','flashbots.net')

# 1) Enumerate live connections to raw Ethereum RPC port 8545
Get-NetTCPConnection -State Established -RemotePort 8545 -ErrorAction SilentlyContinue |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
      RemoteIP    = $_.RemoteAddress
      ProcessName = $p.ProcessName
      Path        = $p.Path
      Signed      = (Get-AuthenticodeSignature $p.Path -ErrorAction SilentlyContinue).Status
      StartTime   = $p.StartTime
    }
  } | Format-Table -AutoSize

# 2) Resolve recent DNS queries to public ETH RPC endpoints from DNS client cache
Get-DnsClientCache | Where-Object {
  $d = $_.Entry; $RpcDomains | Where-Object { $d -like "*$_*" }
} | Select-Object Entry, Data, TimeToLive | Format-Table -AutoSize

# 3) Flag unsigned executables running from user-writable paths
Get-Process | Where-Object {
  $_.Path -match 'AppData|Temp|ProgramData|Users\\Public'
} | ForEach-Object {
  $sig = Get-AuthenticodeSignature $_.Path -ErrorAction SilentlyContinue
  if ($sig.Status -ne 'Valid') {
    [PSCustomObject]@{ Name = $_.ProcessName; Path = $_.Path; Hash = (Get-FileHash $_.Path -Algorithm SHA256).Hash }
  }
} | Format-Table -AutoSize

# 4) OPTIONAL: block outbound raw RPC port 8545 on segments with no blockchain need
New-NetFirewallRule -DisplayName "Block Outbound Ethereum RPC 8545" -Direction Outbound `
  -Protocol TCP -RemotePort 8545 -Action Block -Profile Any

Remediation

There is no patch for this threat — it is a malware campaign, not a vulnerability. Remediation is architectural and operational:

1. Egress policy for blockchain RPC. If your organization has no legitimate Web3, crypto-treasury, or blockchain infrastructure function, add public Ethereum RPC endpoints (Infura, Alchemy, Ankr, PublicNode, LlamaRPC, Cloudflare-ETH) and raw TCP/8545 to your egress deny or alert-only lists at the proxy/ZTNA layer. Where Web3 use is sanctioned, restrict it to named hosts/service accounts and alert on everything else.
2. Application control. Enforce WDAC/AppLocker rules blocking unsigned binaries from %APPDATA%, %TEMP%, %ProgramData%, and C:\Users\Public. Go implants are self-contained and rely on user-writable staging; this single control breaks a large share of commodity and APT droppers alike.
3. Browser credential hardening. Enable Chromium/Edge Application-Bound Encryption enforcement, restrict browser data directories via EDR tamper rules, and alert on non-browser access to Login Data, Cookies, and Local State (see Sigma rule above).
4. Keylogging/RDP module detection. Ensure EDR coverage for low-level keyboard hooks (SetWindowsHookEx with WH_KEYBOARD_LL), suspicious RDP session shadowing, and unexpected termsrv/RdpWddm driver activity on workstations that should never host interactive remote sessions.
5. Hunt retroactively. Run the KQL and VQL content above across at least the last 30–90 days. The June 2026 intrusion means implants may have been resident for weeks before the Arctic Wolf disclosure; blockchain dead-drop C2 means infrastructure IoCs alone will miss rotated C2.
6. Telecom/critical-infrastructure note. Dark Caracal's historic targeting of telecommunications and government entities in Latin America and the Middle East means comms providers should treat this as sector-relevant: review exposed management interfaces, MFA on remote access, and segmentation between corporate IT and network-operations environments.
7. Threat intel integration. Pull Arctic Wolf's published GoCaracal IoCs (file hashes, smart contract addresses, C2 infrastructure) into your blocklists — but treat them as point-in-time. The smart contract address is the most durable indicator: monitoring eth_call requests to that specific contract in proxy logs will catch the implant even after C2 rotation.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub