GoCaracal Attempts C2 Recovery Using Ethereum Storage Values

The GoCaracal malware framework has been revealed to utilize Ethereum (ETH) smart contract storage values to identify alternative command and control (C2) server addresses. Arctic Wolf Labs reported discovering GoCaracal during an investigation into the infiltration of a telecommunications organization in Venezuela in June 2026. This malware sends an eth_getStorageAt request to a public Ethereum JSON-RPC endpoint to read alternative C2 addresses and retry communication in case of a failure to connect to the primary C2 server. Arctic Wolf explained that the entire C2 channel does not exist on Ethereum, and the blockchain serves as a backup path for distributing server addresses. The smart contract mentioned in the report, BulletproofC2, is designed to store mutable C2 values, allowing only the deployer to update the values. GoCaracal is divided into lightweight and extensible versions, with the extensible version including file management, keylogging, and SOCKS5 proxy capabilities. Arctic Wolf analyzed 249 samples and found that GoCaracal evolved into a modular infiltration framework between January and July 2026. This case demonstrates how the public functionality of blockchain networks can enhance the concealment and resilience of malicious infrastructure. Arctic Wolf has released YARA rules and indicators of compromise to aid in detection and response.