Threat actor
Dark Caracal
Lebanon
Tracked by CyberSIXT since 26 Aug
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 1
4 articles from 1 outlet since 26 Aug; the latest 55 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 1 Sep · 10:01 UTC | SecurityOnline | Dark Caracal Deploys New GoCaracal Malware Framework |
| Thu 27 Aug · 21:20 UTC | Security Affairs | Dark Caracal's GoCaracal malware uses Ethereum C2 in Venezuela |
| Thu 27 Aug · 10:06 UTC | The Hacker News | GoCaracal uses Ethereum smart contracts to evade detection |
| Wed 26 Aug · 22:17 UTC | Dark Reading | Dark Caracal Deploys GoCaracal Malware with Blockchain Backed C2 |
Names and sources
- Dark Caracal
- Named by CyberSIXT coverage
- Dark Caracal
- Named by Malpedia · dark_caracal
- G0070
- Named by Malpedia · dark_caracal
- Dark Caracal
- Named by MISP Galaxy · 3d449c83-4426-431a-b06a-cb4f8a0fca94
- G0070
- Named by MISP Galaxy · 3d449c83-4426-431a-b06a-cb4f8a0fca94
- Dark Caracal
- Named by MITRE ATT&CK® · G0070
Attributed facts
- origin
- Lebanon (MISP Galaxy · 3d449c83-4426-431a-b06a-cb4f8a0fca94)
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0070
Persistence
- T1547.001
- Registry Run Keys / Startup Folder
Privilege Escalation
- T1547.001
- Registry Run Keys / Startup Folder
Discovery
- T1083
- File and Directory Discovery
Command and Control
- T1071.001
- Web Protocols
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
Also mentioned alongside Dark Caracal (not attributed)2 CVEs in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Dark Caracal.
CVE-2026-81578PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityCVSS8.8HighExploited86%EPSS0articles
CVE-2026-82078PaperCut NG/MF Unsafe Reflection VulnerabilityCVSS9.4CriticalExploited64%EPSS0articles
- Dark Caracal Deploys New GoCaracal Malware FrameworkSecurityOnline
- Dark Caracal's GoCaracal malware uses Ethereum C2 in VenezuelaSecurity Affairs
- GoCaracal uses Ethereum smart contracts to evade detectionThe Hacker News
- Dark Caracal Deploys GoCaracal Malware with Blockchain Backed C2Dark Reading · first in our coverage