Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
Dark Caracal, a cyberespionage group, has modernized its toolkit with GoCaracal, a modular Go-based framework. The new malware operates alongside an established Bandook variant, giving the group both lightweight access and broader intelligence collection capabilities. Dark Caracal has also added a resilient C2 fallback mechanism that uses Ethereum smart contracts to maintain command-and-control infrastructure.
Investigation
Arctic Wolf Labs investigated a targeted intrusion against a communications organization in Venezuela. The analysis identified a shift from the previously used AsioGate backdoor to the newer GoCaracal framework. Researchers examined 249 samples to trace the framework’s evolution and understand its dual-profile operational model.
Mitigation
Organizations should strengthen email filtering to block malicious SVG attachments and finance-themed phishing lures. Security teams should monitor for suspicious registry hive manipulation and creation of concealed NTUSER.MAN artifacts. Outbound traffic to known malicious hosting providers and unauthorized Ethereum JSON-RPC requests should also be closely monitored.
Response
If Dark Caracal activity is detected, affected systems should be isolated immediately to stop further payload delivery or lateral movement. Responders should perform memory forensics to identify injected shellcode or active SOCKS5 proxy tunnels. Investigations should also search for persistence mechanisms, including suspicious Run-key entries and unexpected files created within %AppData% directories.
Attack Flow
We are still updating this part.
Detections
Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)
Suspicious Command and Control by Unusual Top Level Domain (TLD) DNS Request (via dns)
IOCs (HashSha256) to detect: Dark Caracal Reloaded: New Malware, Same Hunting Grounds
IOCs (SourceIP) to detect: Dark Caracal Reloaded: New Malware, Same Hunting Grounds Part 2
IOCs (SourceIP) to detect: Dark Caracal Reloaded: New Malware, Same Hunting Grounds Part 1
IOCs (DestinationIP) to detect: Dark Caracal Reloaded: New Malware, Same Hunting Grounds Part 2
IOCs (DestinationIP) to detect: Dark Caracal Reloaded: New Malware, Same Hunting Grounds Part 1
Detection of GoCaracal Lightweight Variant Execution [Windows File Event]
Detect GoCaracal Malware Activity [Linux Process Creation]
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands: The adversary has successfully dropped a GoCaracal lightweight variant onto the target system. To initiate the infection and move toward credential harvesting, the attacker executes the payload named
TF-OFICINA004A9.exe. The goal is to trigger the specific file-based signature to see if the current SOC monitoring (the detection rule) alerts on this known indicator of compromise (IOC). -
Regression Test Script:
# Simulation of GoCaracal lightweight variant execution. # This script creates a dummy file with the exact malicious name and executes it. $MaliciousName = "TF-OFICINA004A9.exe" $Path = "$env:TEMP$MaliciousName" # Create a harmless dummy executable (effectively a renamed notepad/calc for testing) # In a real scenario, this would be the actual malware. Copy-Item (Get-Command calc.exe).Source -Destination $Path Write-Host "Executing simulated malware: $Path" Start-Process -FilePath $Path -Wait -
Cleanup Commands:
# Cleanup: Remove the simulated malicious file. Remove-Item -Path "$env:TEMPTF-OFICINA004A9.exe" -Force -ErrorAction SilentlyContinue Write-Host "Cleanup complete."
