Dark Caracal Expands Espionage Arsenal with GoCaracal Framework and AsioGate Backdoor
Dark Caracal Expands Espionage Arsenal with GoCaracal (TL-2026-2158) is a high-severity advanced persistent threat campaign, first published 2026-08-26. It is attributed to Dark Caracal (Lebanon) with medium confidence, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1012, T1021, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2158
- Threat ID
- TL-2026-2158
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-08-26
- Last reviewed
- 2026-08-26
- Attribution
- Dark Caracal
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Lebanon
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, government administration, financial-services, health, manufacturing, pharmaceuticals, logistics, news - media, civil society
- Target regions
- Latin America, venezuela, brazil, ecuador, chile, colombia, el salvador, uruguay
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Dark Caracal Expands Espionage Arsenal with GoCaracal
Malware and tooling: Bandook, 0x03D605f13A74Bfb6149078122FcF62BD6d8799d8, 0x7D321FE277f8c25aaC14aF1BA3Fc34953242052F
Dark Caracal, a Lebanese mercenary espionage group with medium-confidence links to the General Directorate of General Security (GDGS), has fielded GoCaracal, a previously undocumented modular Go-based framework, alongside an updated Bandook variant, the C++ AsioGate backdoor (first reported by Kaspersky in February 2026), and a novel Ethereum smart-contract C2 fallback dubbed BulletproofC2. Arctic Wolf Labs documented the tooling during a June 2026 intrusion at a Venezuelan communications organization, part of a broader phishing campaign targeting Spanish-speaking Latin America.
How Dark Caracal Expands Espionage Arsenal with GoCaracal works
Arctic Wolf Labs disclosed a refreshed Dark Caracal malware arsenal deployed against a Venezuelan communications organization in June 2026, with moderate-confidence spillover into Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay. The intrusion began with Spanish-language, tax/financial-themed phishing emails carrying a weaponized SVG attachment. The SVG embeds a Base64-encoded shortened URL that redirects the victim's browser through an intermediate redirector to getpdfdigital[.]cloud, an attacker-controlled staging site, which serves a 7-Zip archive containing a lightweight GoCaracal implant (tf-oficina004a9.exe). That implant deploys a Delphi loader, which in turn delivers an extended GoCaracal build plus a payload of the Bandook remote-access trojan.
GoCaracal is a previously undocumented modular framework written in Go. Arctic Wolf reconstructed its development across four phases from January to July 2026: a January foundation phase building core communications and host-profiling code; a February-April phase reorganizing the codebase into reusable modules and adding antivirus/security-software discovery and interactive shell functionality; a May-June phase expanding the extended build with self-update capability; and a June-July phase operationalizing a blockchain-based C2 fallback and registering new delivery domains. GoCaracal's lightweight build uses a custom packet protocol with AES-GCM encryption and numeric packet identifiers; its extended build adds code/shellcode injection, an interactive command shell for the operator, and the ability to query the Ethereum blockchain for C2 configuration via public eth_getStorageAt JSON-RPC calls.
The most novel element is BulletproofC2: a custom Solidity smart contract (0x03D605f13A74Bfb6149078122FcF62BD6d8799d8) deployed to Ethereum mainnet on 2026-05-20 after prior trials on the Sepolia testnet, which stores a single owner-mutable value (observed holding both public IPs and RFC 1918 addresses) that infected hosts poll to learn current C2 infrastructure. Three additional, apparently identical contracts were deployed from the same management wallet (0x7D321FE277f8c25aaC14aF1BA3Fc34953242052F), giving the operators a resilient, censorship-resistant fallback channel that is difficult to take down via conventional domain/IP blocking.
Alongside GoCaracal, Dark Caracal deployed an updated Bandook variant with randomized command identifiers (replacing the historical sequential @0001-@0136 numbering) and obfuscated, generically named plugin exports, with a reduced set of roughly 82 command handlers versus older builds. Persistence on both malware families relies on Windows Registry Run-key manipulation, including a concealed NTUSER.MAN artifact tied to the Run-key workflow. GoCaracal infrastructure preferentially uses AEZA Group hosting, while Bandook C2 infrastructure is hosted primarily via AlexHost.
Arctic Wolf attributes the campaign to Dark Caracal (MITRE ATT&CK G0070) with medium confidence, based on the continued use of Bandook, recurring Delphi-loader characteristics, Spanish-language tax-themed phishing lures, malicious-SVG delivery, URL-shortener abuse, document-themed staging infrastructure, and consistent LATAM targeting matching the group's established pattern. Dark Caracal has been linked with medium confidence to Lebanon's General Directorate of General Security (GDGS) since at least 2012, and has historically targeted governments, businesses, journalists, and activists using malware including Bandook, CrossRAT, FinFisher, and the Android RAT Pallas. The group's most recent prior documented LATAM operation used Poco RAT against banking, manufacturing, healthcare, pharmaceutical, and logistics enterprises in Venezuela, Chile, the Dominican Republic, Colombia, and Ecuador via similar Spanish-language invoice-themed phishing. Arctic Wolf assesses GoCaracal is augmenting, not yet replacing, Bandook, with functional overlap in remote access, execution, payload delivery, and intelligence collection.
MITRE ATT&CK techniques used in TL-2026-2158
Discovery
T1012 Query Registry; T1057 Process Discovery; T1518 Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information
Collection
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
T1555 Credentials from Password Stores
Initial Access
Command and Control
Resource Development
Affected products and versions in Dark Caracal Expands Espionage Arsenal with GoCaracal
- Microsoft — Windows
Vulnerable versions: Windows endpoints generally (malware-delivered compromise, not a specific CVE or product vulnerability)
Remediation for Dark Caracal Expands Espionage Arsenal with GoCaracal
Immediate actions
- Block the identified GoCaracal and Bandook C2 IP addresses and delivery/staging domains at perimeter firewall, proxy, and DNS layers
- Configure mail gateways to sandbox or block SVG attachments, since SVG files can embed Base64-encoded redirect chains and are being used as the initial phishing delivery vector
- Alert on and investigate outbound eth_getStorageAt JSON-RPC calls to public Ethereum nodes from non-developer endpoints as a possible blockchain-based C2 fallback indicator
- Hunt across the environment for the listed SHA-256 hashes, %AppData%\Roaming\<random-hex>\<random-hex>.exe execution paths, and concealed NTUSER.MAN Run-key artifacts
Workarounds
- Disable inline SVG rendering/auto-open in email clients and enforce attachment sandboxing where SVG cannot be blocked outright
- Restrict outbound access to public blockchain JSON-RPC endpoints from workstation network segments that have no legitimate blockchain-development purpose
Longer-term hardening
- Deploy EDR with behavioral detection tuned for process/shellcode injection and Registry Run-key persistence
- Restrict and monitor RDP usage and enforce MFA on remote-access services to blunt post-compromise lateral movement
- Harden browser credential stores and monitor for bulk credential-store access consistent with T1555.003
- Deliver user-awareness training on Spanish-language tax/financial-themed phishing lures and the SVG-attachment risk to Spanish-speaking LATAM staff
Timeline of Dark Caracal Expands Espionage Arsenal with GoCaracal
- Arctic Wolf reconstructs GoCaracal's earliest development phase: core communications and host-profiling modules laid down.
- GoCaracal reorganized into reusable modules; antivirus/security-software discovery and interactive shell functionality added (phase runs through approximately April 2026).
- Kaspersky publicly reports a Dark Caracal campaign delivering the previously unseen C++ AsioGate backdoor via SVG-based phishing techniques targeting Venezuelan entities.
- The BulletproofC2 Solidity smart contract (0x03D605f13A74Bfb6149078122FcF62BD6d8799d8) is deployed to Ethereum mainnet after prior Sepolia testnet trials.
- Arctic Wolf Labs investigates a confirmed intrusion at a Venezuelan communications organization involving GoCaracal, the updated Bandook variant, and BulletproofC2.
- GoCaracal's extended build gains self-update capability and blockchain-based C2 fallback logic.
- A new domain used to deliver GoCaracal is registered; Arctic Wolf observes continued operator testing.
- Arctic Wolf Labs publishes "Dark Caracal Reloaded: New Malware, Same Hunting Grounds"; Dark Reading covers the findings.
Sources cited for Dark Caracal Expands Espionage Arsenal with GoCaracal
More in apt
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
Detection coverage for TL-2026-2158
As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2158 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.