Loading story…
Arctic Wolf Labs investigated a targeted June 2026 intrusion against a communications organization in Venezuela and assessed with medium confidence that the activity was linked to the Dark Caracal threat group. The operation continues the actor's established focus on Latin America, using newly identified malware while pursuing targets in its familiar regional hunting grounds.
Researchers linked 249 malware samples to two operational build profiles, indicating a structured and evolving tooling ecosystem. The campaign also used a resilient command-and-control architecture built on Ethereum, complicating disruption and enabling the operators to maintain infrastructure despite conventional takedown efforts.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
During June and July, GoCaracal development added an Ethereum smart-contract fallback that could provide a replacement C2 address after repeated primary-C2 failures. Transaction history showed the configured BulletproofC2 contract's stored C2 value had been changed to a public IP address, indicating the mechanism was operationalized.
Arctic Wolf Labs investigated a targeted intrusion against a communications organization in Venezuela and assessed with medium confidence that Dark Caracal was responsible. Victims were directed through a malicious SVG and shortened-URL chain to a payload-hosting site that delivered a lightweight GoCaracal implant; the intrusion later deployed an updated Bandook payload and an extended GoCaracal build.
The observed BulletproofC2 Ethereum fallback contract, 0x03D605f13A74Bfb6149078122FcF62BD6d8799d8, was deployed using wallet 0x7D321FE277f8c25aaC14aF1BA3Fc34953242052F. The contract served as a dead-drop location for replacement GoCaracal C2 configuration data.
GoCaracal development began with core encrypted command-and-control communications and code-execution capabilities.
Arctic Wolf published a YARA rule for GoCaracal's lightweight profile and representative indicators including SHA-256 hashes, domains, IP addresses, Ethereum contracts and wallets, and host paths. The report stated that the complete indicator set was available to Arctic Wolf customers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 47 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcemkd-cirt.mk
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arctic Wolf Labs attributed a targeted June 2026 intrusion at a Venezuelan communications-sector organization, with medium confidence, to the Lebanese-linked espionage group **Dark Caracal**. The campaign deployed a new modular Go-based framework, **GoCaracal**, alongside an updated variant of the Bandook remote-access trojan (RAT). GoCaracal’s extended profile supports persistence, intelligence collection, keylogging, browser-cookie theft, WebRTC desktop access, SOCKS5 proxying, and Windows Registry manipulation. The intrusion began with Spanish-language financial or tax-themed phishing messages carrying malicious SVG attachments. Victims were redirected through URL shorteners to document-themed download domains and 7-Zip archives, which ultimately delivered GoCaracal and a Delphi loader containing Bandook. GoCaracal includes an Ethereum-based command-and-control fallback; Arctic Wolf tracked its development from January through July 2026 and found that 23 of 24 observed GoCaracal C2 addresses were hosted on AEZA Group networks, while Bandook infrastructure was hosted at AlexHost.
Sep 16, 2026
The **Machete** cyberespionage group continued targeting government and military organizations in Latin America, with recent activity focused on Venezuelan government entities and the Ecuadorean military. Researchers observed more than 50 compromised systems communicating with Machete command-and-control infrastructure over a two-month period, while operators exfiltrated gigabytes of confidential data each week. The campaign relied on highly tailored spearphishing emails that used stolen legitimate documents as decoys and reflected detailed knowledge of military communications and target-specific terminology. The malware toolset, active for years under the names **Machete** and **El Machete**, evolved into a more capable Python-based platform with added obfuscation, persistence, geolocation, browser data theft, removable-media collection, and data exfiltration over FTP with HTTP fallback. Reporting across multiple investigations indicates the group has maintained a long-running focus on Latin American targets, and researchers assessed the operators are likely Spanish-speaking and may have a physical presence in one of the affected countries, partly because the malware supports copying stolen data to removable drives.
Aug 14, 2026
Blind Eagle, also tracked as **TAG-144**, **APT-C-36**, and linked by some researchers to **Red Akodon**, continued targeting organizations across South America with a sustained emphasis on Colombian government entities at the local, municipal, and federal levels. Researchers described multi-stage intrusion chains using spearphishing, including compromised Colombian government email accounts, to deliver commodity and cracked remote access trojans through exposed Apache staging servers, dynamic DNS infrastructure, and legitimate internet services used for payload staging. The group has remained active since at least 2018, blending credential theft, financial crime, and surveillance-oriented collection against public-sector targets. Recent activity shows the actor refining rather than replacing its established toolkit. Investigators observed VBScript-to-PowerShell delivery chains, steganography to conceal payloads in image files, a new JavaScript stage with custom AES-based string obfuscation, an AutoIt3 RunPE loader fetched from `raw.githubusercontent.com`, and repeated use of the **"Photo Studio"** persistence disguise. The most significant upgrade was a new AsyncRAT variant, **JC-46**, which adds WNF-based process injection, custom Base28 encoding, HVNC support for banking fraud, browser profile cloning, and a bypass for Chrome App-Bound Encryption v20, while the group continued reusing VPN-linked command-and-control infrastructure and familiar dynamic DNS patterns.
Jul 17, 2026