GoCaracal: New Go-Based Spyware Hits Venezuelan Telecom
Arctic Wolf ties a June 2026 intrusion at a Venezuelan communications company to Dark Caracal, using a fresh malware framework written in Google's Go language.
Key points
- Arctic Wolf researchers, with medium confidence, attribute a June 2026 intrusion at a Venezuelan communications company to Dark Caracal, a long-running cyber-espionage group.
- The attackers used a new, previously undocumented malware framework called GoCaracal, written in Google's Go programming language.
- GoCaracal gives the operators a remote command line on infected machines and the ability to run more malicious software on demand.
- An extended version adds browser data theft, keystroke logging and full remote desktop control, meaning the attackers can watch and drive the computer in real time.
- The named victim is a communications organisation in Venezuela; the company has not been publicly identified.
A cyber-espionage crew that has been spying on governments and dissidents for more than a decade appears to have a new tool in its kit.
Security firm Arctic Wolf says operators linked to Dark Caracal broke into an unnamed communications organisation in Venezuela in June 2026 and installed a previously unseen malware framework the researchers are calling GoCaracal. The finding was first reported by The Hacker News.
Arctic Wolf's attribution is at medium confidence, meaning the technical fingerprints line up with Dark Caracal's past work but stop short of a definitive match.
Who is Dark Caracal?
Dark Caracal is a cyber-espionage group with a record of stealing documents and call recordings from journalists, lawyers and dissidents across multiple countries. It's been linked in past reporting to nation-state tasking. The group has shifted tools several times; GoCaracal is the latest addition.
What does GoCaracal actually do?
GoCaracal is spyware: malicious software designed to sit quietly on a computer and hand an outside operator control of it. Arctic Wolf describes two profiles of the framework.
The base version is deliberately minimal. It gives attackers a remote shell, a text-based command line into the infected machine, and lets them push down additional payloads later. That keeps the initial footprint small and harder for antivirus tools to catch.
The extended profile is where the surveillance widens. It adds four capabilities:
| Capability | What it means in plain English |
|---|---|
| Browser data theft | Grabs saved passwords, cookies and browsing history from web browsers |
| Keylogging | Records every keystroke, including messages and login details |
| Remote desktop control | Lets the operator see and drive the screen live, as if sitting at the keyboard |
| Payload execution | Runs further malware chosen by the operator at any time |
Written in Go, a language made by Google that produces one self-contained file per target operating system, GoCaracal is straightforward for the attackers to compile across platforms. That flexibility matters for a group going after mixed environments inside telecoms and government networks.
Why does a telecom in Venezuela matter?
Communications companies are prized espionage targets because they carry other people's traffic. A foothold inside a telecom can expose call records and the metadata of who spoke to whom: exactly the intelligence Dark Caracal has chased in past campaigns. Our 19 August 2026 report on SilkParasite showed a similar logic at work when a freshly named group deployed five unseen tools against government offices in Central Asia.
Arctic Wolf hasn't named the affected organisation, and there's no public indication of how many customers may have been touched. The intrusion was detected during the firm's incident response work.
What should ordinary people take from this?
GoCaracal isn't aimed at consumers, and there's no sign of a mass outbreak. It's a targeted tool for spying on specific people through the companies that serve them.
The practical lesson still holds. If a telecom or messaging provider warns of unusual account activity, take it seriously. Turn on two-factor authentication, which asks for a code from your phone as well as your password, and treat unexpected password-reset emails or app-install prompts with suspicion: those are the usual entry points in this kind of operation.
What matters most here is the telecom angle. Dark Caracal collecting call metadata through a compromised carrier is a different order of threat from endpoint spyware. Watch for any disclosure from Venezuelan authorities or the affected operator about the scope of access.
