GoCaracal Malware Uses Ethereum Smart Contract for C2 Access

GoCaracal initially attempts to connect to its configured C2 server through standard off-chain communication. If these attempts fail, the malware can query a public Ethereum JSON-RPC endpoint to retrieve an alternative address from a specific smart contract using the 'eth_getStorageAt' function. This updated address is then loaded into the malware's active memory, allowing it to resume communication with the new server.

Arctic Wolf noted that this method does not place the entire C2 channel on the blockchain but rather uses it as a distribution mechanism for updated server details. This design enables operators to alter fallback addresses without needing to release a new version of the GoCaracal binary. The use of multiple public RPC providers also mitigates reliance on a single service, offering several routes for retrieving updated information.

Arctic Wolf assessed with medium confidence that this activity is associated with the Dark Caracal threat group, citing technical and operational patterns consistent with previous campaigns, including the use of Bandook malware, Delphi loaders, and specific lure types. The company has provided detection materials, including a YARA rule, hashes, domains, IP addresses, and Ethereum contract indicators, to help organizations identify GoCaracal activity.