A newly documented malware framework called GoCaracal uses Ethereum infrastructure to recover command-and-control (C2) server details during cyberattacks. Arctic Wolf observed the Go-based malware in a June 2026 intrusion involving a communications organization in Venezuela. GoCaracal provides remote shell access and can retrieve and execute additional payloads, while an extended version adds browser data theft, keylogging, remote desktop control and SOCKS5 proxy capabilities. The malware first contacts a configured C2 server through a conventional off-chain connection. If repeated attempts fail, it queries a public Ethereum JSON-RPC endpoint using eth_getStorageAt to read a replacement server address from a configured smart contract (self-executing blockchain code). It then stores the address in active memory and resumes conventional internet communication. Arctic Wolf said Ethereum does not host the malware's full C2 channel; it distributes updated server details instead. Operators can change the fallback address through the contract without issuing a new binary, while multiple public RPC providers can retrieve the same data. Arctic Wolf did not confirm a successful Ethereum-based fallback reconnection during the incident, and the number of victims beyond the Venezuelan organization remains unknown. The company assessed with medium confidence that the activity was linked to Dark Caracal, citing overlaps with Bandook malware, Delphi loaders, Spanish-language financial lures, malicious SVG files and URL shorteners. Bandook operated alongside the lighter GoCaracal profile, and available evidence did not show GoCaracal replacing it. Arctic Wolf released a YARA rule, hashes, domains, IP addresses, host paths and Ethereum contract indicators, but said the public indicators were representative rather than complete. The company suspects phishing after identifying more than 100 related SVG files tied to the same malicious infrastructure, although investigators did not recover the original phishing email or malicious SVG attachment from the victim.