CyberNew CyberNew
Ransomware & Malware Dark Reading 1 month ago

Dark Caracal Adds New Malware to Cyber Espionage Arsenal

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"The Lebanon-linked Dark Caracal threat group has upgraded its cyberespionage arsenal with a previously unknown malware framework that gives the threat actor broader capabilities for stealing data and maintaining persistent access to compromised systems. Researchers at Arctic Wolf discovered the new malware when investigating a targeted intrusion in Venezuela and are tracking the new framework as..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

The Lebanon-linked Dark Caracal threat group has upgraded its cyberespionage arsenal with a previously unknown malware framework that gives the threat actor broader capabilities for stealing data and maintaining persistent access to compromised systems.

Researchers at Arctic Wolf discovered the new malware when investigating a targeted intrusion in Venezuela and are tracking the new framework as GoCaracal.

Dark Caracal's New Tricks

In a report this week, the security vendor said its analysis of some 250 samples of the malware revealed the threat actor is using two versions of GoCaracal. One of them is a lightweight implant for initial access and downloading additional payloads while the other is a more substantial build for harvesting intelligence and maintaining interactive control on compromised systems. The extended version of GoCaracal uses a public blockchain-based Ethereum database as a backup source for finding command-and-control servers if its main C2 infrastructure becomes unavailable.

Related:Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks

"The infrastructure associated with the June 2026 intrusion forms part of a broader cluster of Spanish-language, document-themed domains used to deliver malicious SVG files and downstream payloads," Arctic Wolf researchers wrote in the report.

Dark Caracal is a long-running cyber-espionage operation that researchers have previously linked to Lebanon's General Directorate of General Security (GDGS). The group has been active since at least 2012 and has been associated with intelligence gathering operations that have targeted a broad range of organizations and individuals including military and government personnel, businesses, journalists, activists, lawyers, medical professionals and educational institutions.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →