Loading story…
Arctic Wolf Labs attributed a targeted June 2026 intrusion at a Venezuelan communications-sector organization, with medium confidence, to the Lebanese-linked espionage group Dark Caracal. The campaign deployed a new modular Go-based framework, GoCaracal, alongside an updated variant of the Bandook remote-access trojan (RAT). GoCaracal’s extended profile supports persistence, intelligence collection, keylogging, browser-cookie theft, WebRTC desktop access, SOCKS5 proxying, and Windows Registry manipulation.
The intrusion began with Spanish-language financial or tax-themed phishing messages carrying malicious SVG attachments. Victims were redirected through URL shorteners to document-themed download domains and 7-Zip archives, which ultimately delivered GoCaracal and a Delphi loader containing Bandook. GoCaracal includes an Ethereum-based command-and-control fallback; Arctic Wolf tracked its development from January through July 2026 and found that 23 of 24 observed GoCaracal C2 addresses were hosted on AEZA Group networks, while Bandook infrastructure was hosted at AlexHost.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
GoCaracal development progressed to an operational Ethereum-based command-and-control fallback using the BulletproofC2 Solidity contract, which obtains replacement C2 information through Ethereum JSON-RPC requests.
A targeted intrusion against a Venezuelan communications-sector organization deployed the previously unidentified GoCaracal Go-based framework and an updated Bandook RAT variant. Arctic Wolf Labs attributed the activity to Dark Caracal with medium confidence.
Dark Caracal's GoCaracal framework development began with basic communications functionality and AES-GCM encryption.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Arctic Wolf Labs investigated a targeted June 2026 intrusion against a communications organization in Venezuela and assessed with medium confidence that the activity was linked to the **Dark Caracal** threat group. The operation continues the actor's established focus on Latin America, using newly identified malware while pursuing targets in its familiar regional hunting grounds. Researchers linked **249 malware samples** to two operational build profiles, indicating a structured and evolving tooling ecosystem. The campaign also used a resilient command-and-control architecture built on **Ethereum**, complicating disruption and enabling the operators to maintain infrastructure despite conventional takedown efforts.
Aug 29, 2026
A long-running cyberespionage operation dubbed **Bandidos** used the **Bandook** remote access trojan to infiltrate corporate networks across Spanish-speaking Latin America, with roughly 90% of observed detections concentrated in Venezuela. The campaign, active since at least 2015, relied on phishing emails carrying PDF lures that directed victims to password-protected archives containing a Delphi dropper. That dropper injected Bandook into `iexplore.exe` through process hollowing, established persistence via Windows Registry changes, and connected to command-and-control servers over TCP. Researchers said the malware supported extensive surveillance and theft functions, including screenshot capture, webcam and microphone recording, USB data theft, and interception of Chrome credentials, while also downloading additional DLLs to expand capability. The 2021 variant showed notable evolution from earlier Bandook activity, including a shift from `CAST-256` to `GOST` in the dropper, a reduced DLL set, and support for 132 commands. The infrastructure and tooling overlapped with previously documented Bandook-linked operations, including **Operation Manul**, **Dark Caracal**, and Check Point research, reinforcing the assessment that the operators were conducting sustained espionage against Venezuelan organizations in sectors such as manufacturing, construction, healthcare, software services, and retail.
Aug 14, 2026
Threat actors used the filename **"Source code of carbanak backdoor discovered.exe"** to bait malware analysts and threat researchers into opening password-protected archives that delivered multiple payloads, including **Vidar Stealer**, **CountLoader**, **Smoke Loader**, and a separate custom Go malware dubbed **EssentialAcquisition**. Breakglass Intelligence found that the Vidar samples were padded with null bytes to reduce detection, contained encrypted configuration data, and communicated with command-and-control infrastructure at `37.221.66.22:11522`, with a Node.js/Express administration panel briefly exposed on port `3000`; the host was linked to AlexHost SRL in Moldova. A related Vidar operation was also traced to an openly browsable Apache server at `188.137.224.103`, where exposed WebDAV access revealed payloads, staging files, and operator workflow. That campaign used both an HTA/VBScript downloader and a CMD batch script to fetch Go-based loaders and Vidar binaries disguised as benign files, while the custom **EssentialAcquisition** malware showed a more advanced design: Go 1.26.1 compilation, Garble obfuscation, zeroed PE timestamps, and a **Raft-based** command-and-control architecture running across Kubernetes infrastructure with dynamic service discovery, suggesting resilient financial-malware operations rather than ordinary credential theft.
Jun 29, 2026