GoCaracal Malware Uses Ethereum for Backup C2 Servers

A new malware framework called GoCaracal uses Ethereum infrastructure as a backup method for recovering command-and-control server information during cyberattacks, according to cybersecurity firm Arctic Wolf. Discovered during a June 2026 intrusion targeting a communications organization in Venezuela, GoCaracal provides remote shell access and can download additional payloads. An extended version includes browser data theft and keylogging.