kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · LB

Dark Caracal

also tracked as nimbus manticore 1, patchcord 1

2 stories · 2 in the wild · August 27, 2026 – August 28, 2026

evidence: 2 observed

sectors

  • critical infrastructure 1 · Aug 27
  • telecom 1 · Aug 27

geography

  • afghanistan 1 · Aug 27
  • south asia 1 · Aug 27

malware and tools

  • gocaracal 2 · Aug 28
  • twostroke 1 · Aug 27

techniques

  • blockchain c2 1 · Aug 28
  • browser theft 1 · Aug 28
  • keylogging 1 · Aug 28
  • remote desktop 1 · Aug 28
  • shell access 1 · Aug 28
  • persistence 1 · Aug 27

attack phases seen

  • Collection 2 · Aug 28
  • Persistence 2 · Aug 28
  • Command and control 1 · Aug 28

what we reported, newest first, grouped by story

Aug 27 – August 28, 2026 · 2 reports

  • GoCaracal — a previously undocumented Go framework linked with medium confidence to Dark Caracal — pulls a replacement C2 address from an Ethereum smart contract when its primary infrastructure dies, alongside shell access, browser theft, keylogging and remote desktop (The Hacker News). Second blockchain dead-drop of the day. · Aug 28 · observed · Threat Activity
  • Nimbus Manticore has expanded its toolset with a TWOSTROKE-like backdoor and an SSH tunneler (The Hacker News), Dark Caracal has added the modular GoCaracal framework for data theft and persistence (Dark Reading), and a new cluster dubbed PATCHCORD is targeting Afghan telecom and South Asian critical infrastructure (Acronis TRU). · Aug 27 · observed · as nimbus manticore, patchcord · Threat Activity