Actor Profile

Dark Caracal (G0070) is a threat actor with a documented history of operations in Latin America since at least 2018. Arctic Wolf attributes the June 2026 GoCaracal intrusion to Dark Caracal with medium confidence based on multiple behavioral and technical overlaps: use of Bandook malware, recurring Delphi-loader characteristics, Spanish-language financial lures, malicious SVG files, URL shorteners, document-themed infrastructure, preferred hosting providers, and consistent Latin American targeting. The actor has previously deployed FinFisher, CrossRAT, and Bandook malware families. Dark Caracal's motivation appears focused on espionage and data collection targeting communications and government sectors across the region, with related artifacts linked to Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay.

TTPs (Tactics, Techniques, Procedures)

Dark Caracal employed multiple MITRE ATT&CK techniques during the GoCaracal campaign. Initial access likely occurred via phishing (T1566.003) using malicious SVG attachments with financial and tax-themed lures. The GoCaracal malware framework demonstrates obfuscation (T1027.013, T1027.002), command execution via Windows Command Shell (T1059.003), and web protocols for C2 (T1071.001). The extended profile includes system/file discovery (T1083), data from local system collection (T1005), screen capture (T1113), and persistence via registry run keys (T1547.001). The actor used compiled HTML files (T1218.001) and drive-by compromise techniques (T1189). A novel technique involves using Ethereum smart contracts via eth_getStorageAt JSON-RPC requests to retrieve replacement C2 addresses after primary server failures. Bandook was deployed in parallel with GoCaracal's lightweight profile, indicating multi-tool operations.

Targets & Patterns

Dark Caracal targeted a communications organization in Venezuela during the June 2026 intrusion. The actor demonstrates a clear regional focus on Latin America, with the communications sector appearing as a priority target likely due to intelligence collection opportunities. Arctic Wolf identified related artifacts and infrastructure associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay, suggesting broader regional reconnaissance or operations, though these are not confirmed victim countries. The use of Spanish-language financial and tax-themed lures indicates social engineering tailored to Latin American business environments. The targeting pattern aligns with espionage objectives focused on telecommunications infrastructure, which provides access to sensitive communications data and potential lateral movement opportunities into government and commercial networks across the region.

Historical Context

Dark Caracal was first publicly disclosed in 2018 (covered by The Hacker News). The actor demonstrated continuity through retooled Bandook malware operations in 2020 and subsequent Bandook attacks specifically targeting Venezuela in 2021. The June 2026 GoCaracal intrusion represents an evolution in the actor's toolset with the introduction of a Go-based malware framework, though Bandook remains in active use alongside GoCaracal. Current evidence does not establish GoCaracal as a replacement for Bandook; instead, both tools were used in parallel during the investigated intrusion. The consistent use of Delphi loaders, malicious SVG files, document-themed infrastructure, and Latin American targeting across multiple years demonstrates operational continuity and refined tradecraft. The addition of Ethereum smart contract-based C2 fallback mechanisms represents a notable technical advancement in the actor's infrastructure resilience capabilities.

Defensive Recommendations

  • Hunt for GoCaracal using Arctic Wolf's published YARA rule targeting the lightweight profile; monitor for Go-compiled binaries with remote shell, payload execution, and encrypted C2 capabilities
  • Detect phishing delivery via malicious SVG attachments (T1566.003) by blocking or sandboxing SVG files from external sources and monitoring for financial/tax-themed lures in Spanish
  • Monitor for eth_getStorageAt JSON-RPC requests to public Ethereum endpoints as anomalous C2 fallback behavior; baseline legitimate blockchain interactions and alert on unexpected queries to smart contracts
  • Detect browser credential theft (T1005, T1113) by monitoring access to browser cookie stores, login databases (e.g., Chrome Login Data, Firefox logins.json), and enabling tamper protection on credential vaults
  • Implement detection for Bandook malware and Delphi-based loaders; monitor registry run key modifications (T1547.001) and compiled HTML file execution (T1218.001) as persistence and execution vectors

---

# Geopolitical Context

Geopolitical Context

The June 2026 intrusion at a Venezuelan communications organization reflects sustained cyber operations in Latin America attributed to Dark Caracal, a threat actor with a documented operational history in the region since at least 2018. The targeting of critical communications infrastructure in Venezuela—a state facing prolonged political isolation and economic instability—is consistent with intelligence collection priorities focused on government, opposition, and civil society communications. Dark Caracal's use of Spanish-language financial lures and regional targeting patterns suggests operations designed to exploit socioeconomic vulnerabilities across Latin America. The deployment of GoCaracal, a previously undocumented Go-based framework, alongside the established Bandook malware indicates iterative tooling development and operational flexibility. The use of Ethereum smart contracts as a command-and-control fallback mechanism represents a novel resilience technique, leveraging decentralized infrastructure to complicate network-based detection and takedown efforts.

State Actor Alignment

Arctic Wolf assesses with medium confidence that the activity is linked to Dark Caracal, a threat actor historically associated with Lebanese state interests, though attribution remains contested in open-source reporting. Dark Caracal has previously been linked to campaigns targeting military personnel, activists, journalists, and enterprises across multiple continents. The actor's sustained focus on Latin American telecommunications and use of phishing with financial and tax-themed lures suggests intelligence collection objectives rather than financially motivated cybercrime. No direct state sponsor is confirmed in this reporting, and the actor's operational independence or tasking relationship remains unclear. The targeting of Venezuelan communications infrastructure occurs within a broader context of regional political tension, sanctions regimes, and competing geopolitical influence from external powers including Russia, China, Iran, and the United States.

Business Impacty pro region

The intrusion underscores persistent cyber threats to Latin American telecommunications providers, which serve as high-value targets for both state-sponsored intelligence operations and transnational criminal networks. Venezuela's communications sector remains vulnerable due to limited cybersecurity investment, sanctions-related technology gaps, and political instability. Arctic Wolf's identification of related artifacts and infrastructure associated with Brazil, Ecuador, Chile, Colombia, El Salvador, and Uruguay suggests a broader regional campaign, though confirmed victim counts remain undisclosed. European telecommunications providers with Latin American subsidiaries or partnerships may face elevated risk from similar intrusion sets. The use of Ethereum smart contracts for C2 resilience may signal an emerging trend among advanced persistent threat actors seeking to exploit decentralized technologies, complicating international law enforcement coordination and takedown operations. Regional cybersecurity capacity-building efforts, particularly in Central and South America, remain critical to mitigating such threats.

Forecast

If Dark Caracal continues operations in Latin America, additional intrusions targeting telecommunications, government, and media sectors in the identified countries are likely over the next 6–12 months. If the Ethereum-based C2 fallback proves operationally effective, adoption by other advanced threat actors is possible, potentially complicating defender response and infrastructure disruption efforts. If Venezuelan political or economic conditions remain unstable, communications providers will likely remain priority targets for both intelligence collection and influence operations. If regional cybersecurity cooperation and information-sharing mechanisms are strengthened, early detection and coordinated response to similar campaigns may improve. If GoCaracal deployment expands beyond the telecommunications sector, financial services, energy, and government networks may face increased risk from this toolset.