[gocaracal]

August 28, 2026

• GoCaracal — a previously undocumented Go framework linked with medium confidence to Dark Caracal — pulls a replacement C2 address from an Ethereum smart contract when its primary infrastructure dies, alongside shell access, browser theft, keylogging and remote desktop (The Hacker News). Second blockchain dead-drop of the day. · Threat Activity

in Australia Charges Two Over the TeamPCP Supply-Chain Spree

August 27, 2026

• Nimbus Manticore has expanded its toolset with a TWOSTROKE-like backdoor and an SSH tunneler (The Hacker News), Dark Caracal has added the modular GoCaracal framework for data theft and persistence (Dark Reading), and a new cluster dubbed PATCHCORD is targeting Afghan telecom and South Asian critical infrastructure (Acronis TRU). · Threat Activity

in When the Sandbox Isn't a Boundary