GoCaracal Malware Uses Ethereum Smart Contract for C2 Resilience

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Learn: The blockchain-based C2 technique — resolving replacement C2 addresses from an Ethereum smart contract — is a novel evasion that standard domain-block controls won’t catch; worth reviewing egress filtering to include RPC/blockchain API endpoints.
SOC/IR — Plan: Add detection coverage for unexpected Ethereum RPC calls or blockchain API queries originating from endpoints, as this C2 pattern bypasses conventional domain-blocking; no specific IOCs were released, so broader TTP-level hunting is the near-term action.
Leader — Skip

Dark-Caracal on CuraSec