Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a previously undocumented Go‑based framework called GoCaracal alongside an updated Bandook backdoor. Dark Caracal is an APT group associated with the Lebanese General Directorate of General. In past campaigns, it targeted entities in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany. “In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists.” reads the report published by Arctic Wolf. “GoCaracal supports separate lightweight and extended build profiles derived from a shared architecture. Both were observed in the same intrusion.” The delivery method will feel familiar to anyone who has followed the group’s recent campaigns. Phishing emails with financial or tax lures drop weaponised SVG attachments, which redirect victims through URL shorteners to attacker‑controlled sites that serve the real payload. When a recipient opens one of these SVG files, the embedded content directs the browser to a shortened URL that resolves through a redirector to getpdfdigital[.]cloud, a known attacker site used to stage malicious payloads. The site then delivers a 7‑Zip archive containing a lightweight Go implant that Arctic Wolf identifies as part of the GoCaracal framework. “While Arctic Wolf did not recover the original phishing email or SVG attachment associated with the intrusion, the artifact’s financial and tax-themed filename, the campaign’s established delivery pattern, and more than 100 related SVG files found communicating with the same malicious hosting site support our assessment that the file was delivered through phishing.” continues the report. That initial implant is not the endgame. It establishes a foothold and then pulls in a Delphi loader carrying Bandook and a more capable, extended GoCaracal build with broader post‑compromise features. The two profiles split the work. The lightweight build handles host profiling, encrypted C2, remote shell, payload download and execution, and shellcode injection. The extended build adds file management, browser credential and cookie theft, keylogging, targeted file search, WebRTC remote desktop, hidden browser sessions, a SOCKS5 proxy and persistence mechanisms. Arctic Wolf traced 249 related samples from January to July 2026 and sees a clear development arc. GoCaracal started as a focused access implant, then became modular, then gained broad post‑compromise capabilities, and finally added an Ethereum‑based C2 fallback while keeping both profiles in play. “Analysis of 249 related samples revealed two GoCaracal build profiles: a lightweight implant designed to establish access and deliver additional payloads, and an extended build intended for sustained intelligence collection and interactive control.” states the report. “The extended build also supports an Ethereum smart-contract fallback that allows operators to retrieve replacement command-and-control (C2) infrastructure without redeploying the malware.” That fallback is the most interesting twist. The extended GoCaracal configuration can include an Ethereum smart‑contract address alongside the usual HOST and PORT values. If the malware cannot reach its primary C2 after repeated tries, it calls a public Ethereum JSON‑RPC endpoint, reads a stored value from the contract, and updates its in‑memory C2 address before retrying. “An extended GoCaracal variant uses Ethereum smart contracts as a fallback source for replacement C2 addresses.” states Artic Wolf “Blockchain activity indicates that the capability was tested and operationalized rather than merely included as dormant code.” Ethereum does not carry the malware’s entire command channel. Instead, GoCaracal uses it as a backup source for a new C2 address. This lets the attackers change the server the malware contacts without releasing a new version. Arctic Wolf found a custom Solidity contract called BulletproofC2 that stores a changeable C2 address. Only its owner can update it. Transaction records show that the attackers changed the address to a public IP, suggesting they tested and used the system. The same wallet also deployed similar contracts on Ethereum’s Sepolia testnet before moving some to the mainnet. The contracts contained both public and private IP addresses, suggesting the attackers first tested the mechanism before using it operationally. GoCaracal is not replacing Bandook, at least not yet. Arctic Wolf says the two families now run in parallel, with GoCaracal augmenting the group’s existing toolkit and potentially reducing future reliance on Bandook, but current evidence does not show a full swap‑out. The June 2026 Bandook sample shows deliberate anti‑analysis tweaks. Sequential command identifiers like @0001 through @0136 were replaced with randomised strings, and plugin export names were obfuscated with generic labels, preserving functionality while weakening signature‑based detection built on older naming conventions. The wider campaign still looks like Dark Caracal. Arctic Wolf identified seven related Spanish‑language, document‑themed domains used to deliver malicious SVGs and downstream payloads, with two previously linked to the group and a new one registered in July 2026 observed delivering GoCaracal. Infrastructure is compartmentalised. Of 24 unique C2 addresses extracted from GoCaracal samples, 23 sat on AEZA Group‑operated networks, while Bandook C2 addresses were hosted on AlexHost, a provider previously associated with Dark Caracal. That separation likely limits the blast radius if one provider gets hit. Geographically, the focus remains Latin America. Arctic Wolf sees related artifacts and infrastructure tied to Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay, and assesses broader regional activity with moderate confidence while continuing to map the scope. “Taken together, the findings show Dark Caracal is preserving familiar targeting and delivery practices while modernizing their malware and infrastructure.” concludes the report. “Dark Caracal’s continued use of established tooling such as Bandook, combined with the introduction of GoCaracal and its separate C2 footprint, suggests an expanding and increasingly compartmentalized toolkit rather than a wholesale change in operational strategy.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses. "PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF," reads an urgent security advisory published Thursday. "We are aware of confirmed customer incidents and are treating this matter with the highest priority." PaperCut says the vulnerability affects all versions of PaperCut NG and MF, but has not shared details about the flaw or how it is being exploited.
The Manchester Airports Group (MAG) disclosed that hackers breached its systems and stole customer data, including Wi-Fi sign-ups from Manchester, Stansted, and East Midlands airports. The intruder did not access customer payment details, and the attack had no impact on airport operations, the company said. A statement from the company today notes that the exfiltrated data also "relates to car park, lounge and Fast Track bookings." The list of compromised details includes customers' email addresses, phone numbers, vehicle registration numbers, and postcodes. “The incident has not resulted in any operational disruption,” assured the organization, adding that “Airport operations remain unaffected and customer parking services continue to operate normally.” Out of an abundance of caution, MAG has temporarily suspended its online “Manage My Booking” service and is instead directing travelers to use its phone line.
Threat research gives security teams insight into how attackers operate, while MDR turns that intelligence into faster detection and response. ESET explains how combining threat intelligence, continuous monitoring, and human expertise can help SMBs strengthen their defenses.
Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users’ home networks. Android 17 adds support for Encrypted Client Hello (ECH), a new privacy standard that operates in conjunction with private DNS to hide profiling metadata, including visited domain names. ECH acts as a privacy extension for TLS, the protocol that secures HTTPS connections, encrypting the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI). Even if the connection to a website or service is secure, internet service providers (ISPs) and Wi-Fi operators can still see the destination, which can be collected for commercial profiling purposes. Android users benefit from ECH when browsing with Chrome 117 and later or Firefox 119 and later, but Android 17 incorporates the protection at the platform level.
Microsoft has started rolling out a permanent fix for a known issue that causes system crashes and gaming issues on Windows 11 devices. On affected PCs, users have also reported games failing to launch and freezing with "EXCEPTION_ACCESS_VIOLATION" errors. When it was first confirmed, Microsoft said that this issue affects games like ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals on systems running Windows 11 24H2 and 25H2. While it was initially believed that the August 2026 updates may be behind these problems, Microsoft later blamed them on peripherals with built-in RGB lighting. "Ongoing investigation indicates that this issue is related to peripherals or internal device components which have RGB lighting features," Microsoft noted. "Such devices may install drivers or code components with file names similar to inpoutx64. In systems where these drivers are found, the issue is then triggered by launching certain games."
All threats In Q2 2026, the percentage of ICS computers on which malicious objects were blocked continued to decrease, falling to 19.15%, its lowest level since 2022. Percentage of ICS computers on which malicious objects were blocked, Q3 2023–Q2 2026 Regionally, the percentages ranged from 8.1% in Northern Europe to 27.9% in Africa. Regions ranked by percentage of attacked ICS computers The figures increased in five regions over the quarter, most notably in East Asia (by 2.0 pp) and Africa (by 0.5 pp). East Asia saw increases in percentages for all threats except miners. The region ranked first in terms of growth for malicious scripts and phishing pages, spyware, and viruses. East Asia also led in terms of growth in threats from the internet. The percentage of ICS computers on which email threats were blocked also increased. Selected industries The biometrics sector (26.44%) has traditionally led the rankings of industries and OT infrastructures surveyed in this report in terms of the percentage of ICS computers on which malicious objects were blocked. Biometric systems are characterized by the availability of internet access, extensive email use for data exchange and approvals (e.g. access granting), and, in many cases, minimal cybersecurity controls within the organizations that use them. Industries ranked by percentage of ICS computers on which malicious objects were blocked The biometrics sector ranked first among industries in terms of the following threat categories: malicious scripts and phishing pages, malicious documents, spyware, ransomware, and worms. The sector is also leading among industries in terms of email threats. At the same time, unlike other industries, the percentage of affected ICS computers for email threats in biometrics exceeds that for internet threats. In all selected industries, the global average follows a downward trend. Threat categories In Q2 2026, Kaspersky security solutions blocked malware from 10,904 different malware families of various categories on industrial automation systems. Over the quarter, the percentage of ICS computers on which malicious objects of the following categories were blocked increased: denylisted internet resources, malicious documents, worms, ransomware, and malware for AutoCAD. Percentage of ICS computers on which the activity of malicious objects from various categories was blocked Malicious scripts and phishing pages (JS and HTML) Malicious scripts and phishing pages remained in first place in the threat category rankings based on the percentage of ICS computers on which the respective threats were blocked. In Q2 2026, the global average dropped to 5.42%. Over the quarter, the figure for this category only increased in East Asia, rising by 0.93 pp to 4.86%. This is the second-highest figure in the region in the last three years. In East Asia, the percentage of ICS computers affected by malicious scripts and phishing pages increased in all the industries surveyed, except construction. The highest figures were recorded for biometrics (9.01%) and building automation (6.49%). Denylisted internet resources In Q2 2026, denylisted internet resources rose in the threat category rankings from third to second place, displacing spyware. Globally, the percentage of ICS computers on which denylisted internet resources were blocked has been increasing for two quarters in row and reached 4.31%. The figures increased in all regions over the quarter, most notably in Russia (by 1.33 pp). Moreover, Russia ranked first (5.17%) among the regions in terms of denylisted internet resources. Since 2022, the region has topped these rankings twice before, both times in Q2: in 2022 and 2024. Among the selected industries in Russia, the highest figures for the denylisted internet resources were in the electric power (6.61%) and engineering and ICS integration (5.62%) industries. Malicious documents (MSOffice + PDF) Malicious documents ranked fourth in the threat category rankings by the percentage of ICS computers on which they were blocked. The percentage for this category decreased over the previous three quarters, reaching its lowest level in three years. However, in Q2 2026, it increased to 1.77%. Over the quarter, the figures for malicious documents increased in seven regions, most notably in South America (by 1.35 pp) and Southern Europe (by 0.48 pp). These two regions are among the top three in terms of malicious documents, malicious scripts and phishing pages, as well as threats from email clients. South America ranked second in the rankings of regions in terms of malicious documents. In Q2 2026, the percentage of ICS computers in the region on which this threat was blocked was 3.56%, which was the fourth highest in three years. Among the selected industries in South America, the highest percentage of ICS computers on which malicious documents were blocked was in biometrics (6.67%). Southern Europe ranked first in the rankings of regions in terms of malicious documents. In the previous quarter, the percentage of ICS computers in the region on which this threat was blocked was the lowest in three years, but in Q2 2026 it increased to 3.63%. Among the selected industries in Southern Europe, the highest percentage of ICS computers on which malicious documents were blocked was once again in biometrics (11.48%). Spyware Spyware ranked third in the threat category rankings based on the percentage of ICS computers on which it was blocked. The percentage for this category (3.30%) is the lowest since 2022. Over the quarter, the figures increased in three regions, most notably in East Asia (by 0.53 pp) and Southeast Asia (by 0.42 pp). East Asia ranked third based on the figures for spyware (4.77%), behind Africa and Southeast Asia. This is the region’s highest rate since Q2 2025. Among the countries and territories in the region, the highest percentage of ICS computers on which spyware was blocked was in mainland China (6.61%). Among the selected industries in East Asia, the highest figures for spyware were in the electric power (11.75%) and manufacturing (5.87%) industries. In all the industries surveyed, the figures are higher than the regional average. Southeast Asia ranked second after Africa in the ranking of regions in terms of spyware, with 5.32%. Among the selected industries in Southeast Asia, the highest figures for spyware were in biometrics (8.93%) and manufacturing (7.32%). The figures increased in all industries over the quarter. Ransomware The percentage of ICS computers on which ransomware was blocked decreased in the previous three quarters but increased to 0.16% in Q2 2026. During the quarter, the percentage increased in all regions, except Western and Southern Europe and North America (Canada). Africa led the ranking in terms of growth for this metric. In Q2 2026, Africa ranked first among the regions in terms of the percentage of ICS computers on which ransomware was blocked (0.29%). The only time the figure in the region was higher in the past three years was Q2 2025 (0.31%). Among the selected industries in Africa, the highest figures for ransomware were in the electric power industry (0.72%) and biometrics (0.52%). Over the quarter, the figures increased in all industries, except manufacturing and construction. The biggest increase was recorded in the electric power industry. In Russia, the percentage of ICS computers on which ransomware was blocked in biometric systems has increased for three consecutive quarters, reaching 1.22%. This is the highest level of ransomware across all industries in all regions. Miners In Q2 2026, the percentage of ICS computers on which miners were blocked was the lowest since 2021, for both miners in the form of executable files for Windows (0.48%) and web miners running in browsers (0.14%). The figures for both categories decreased in all regions, except for Africa where figures for miners in the form of executable files for Windows increased slightly. On average, the oil and gas industry led the rankings among the selected industries both in terms of miners in the form of executable files for the Windows OS (0.66%) and in terms of web miners (0.34%). Worms In Q2 2026, the percentage of ICS computers on which worms were blocked increased to 1.43%. In Q2 2026, the Middle East (2.11%) was second (after Africa) in the rankings of regions in terms of worms, displacing Central Asia and the South Caucasus. Among the selected industries in the Middle East, the highest percentage of ICS computers on which worms were blocked was in building automation (2.90%). Over the quarter, the figures increased in all industries. Australia and New Zealand ranked 12th among the regions in terms of the percentage of ICS computers on which worms were blocked (0.41%). Over the past three years, the figure in this region was only higher in Q2 2024 (0.42%). The figures increased in all the surveyed industries in the region, most notably in manufacturing and electric power. As a result, for these industries they exceeded the regional average by 2.9 and 2.3 times, respectively. Viruses In Q2 2026, the percentage of ICS computers on which viruses were blocked decreased to 1.29%. The top three regions for this metric remain unchanged: Southeast Asia (6.03%), Africa (4.22%), and East Asia (3.14%). These same regions lead the rankings in terms of malware for AutoCAD. The figures increased in three regions: East Asia, Australia and New Zealand, and Africa, where it has been growing for four consecutive quarters and reached its highest value since 2022. Among the selected industries in Africa, the highest percentage of ICS computers on which viruses were blocked was in construction (5.47%). East Asia ranked third among the regions in terms of viruses, reaching the highest level in the region for the past three years. Among the countries and administrative regions of East Asia, mainland China is the clear leader in terms of viruses (5.07%). Among the selected industries in East Asia, the highest percentage of ICS computers on which viruses were blocked was in construction (5.93%). In Australia and New Zealand, the increase in the percentage of ICS computers on which viruses were blocked was primarily due to a 4.3-fold increase in the figure for the electric power industry: from 0.29% to 1.24%. For a region where the percentage of attacked ICS computers for all threats is 0.12%, this is a very high value. Malware for AutoCAD In Q2 2026, the percentage of ICS computers on which malware for AutoCAD was blocked increased to 0.31%. The most notable increase over the quarter was observed in Africa. After more than doubling in the previous quarter, the figure for the region continued to rise (although not so dramatically), reaching 1.02%. Among the selected industries across all regions, the highest percentage of ICS computers on which malware for AutoCAD was blocked was in construction in East Asia (6.38%) and in Southeast Asia (4.05%). Main threat sources In Q2 2026, of all the threat sources, the percentage increased only for email. Percentage of ICS computers on which malicious objects from various sources were blocked Internet The percentage of ICS computers on which threats from the internet were blocked decreased to 7.61%, reaching its lowest level since 2021. Over the quarter, the percentage increased in three regions: East Asia by 0.8 pp (to 6.3%), South Asia by 0.3 pp (to 10.4%), and Russia by 0.3 pp (to 6.4%). Among the selected industries across all regions, the highest percentage of ICS computers on which threats from the internet were blocked was in biometrics (13.03%) and engineering and ICS integration (12.16%) in South Asia. Email The percentage of ICS computers on which email threats were blocked increased to 2.84%. In Q2 2026, the percentage of ICS computers on which email threats were blocked increased in South America by 1.0 pp (to 5.2%) and in Africa by 0.7 pp (to 4.3%). Among the selected industries across all regions, the highest percentage of ICS computers on which email threats were blocked was in biometrics (19.14%) and building automation (12.49%) in Southern Europe. Removable media The percentage of ICS computers on which threats from removable media were blocked continued to decrease, reaching 0.24%, the lowest value for the period under review. Among the selected industries across all regions, the highest percentage of ICS computers on which threats from removable media were blocked was in the electric power industry in East Asia (1.34%) and biometrics in Africa (1.29%). Network folders The percentage of ICS computers on which threats from network folders were blocked continued to decrease. In Q2 2026, it was the lowest for the period under review, at 0.023%. The only region to see an increase in the percentage of ICS computers on which threats from network folders were blocked during the quarter was Africa. This was mainly due to an increase in the building automation figure to 0.05%. Among the selected industries across all regions, the highest percentage of ICS computers on which threats from network folders were blocked was in biometrics (0.23%), building automation (0.17%), and engineering and ICS integration (0.13%) in East Asia. For more information on industrial threats see the full version of the report.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch their Citrix NetScaler appliances against an actively exploited vulnerability by Saturday. Tracked as CVE-2026-8452, this high-severity security flaw stems from a memory overflow weakness affecting NetScaler ADC and NetScaler Gateway appliances configured with Gateway VPN or AAA (Authentication, Authorization, and Auditing) virtual servers. While Citrix said in June that threat actors could only exploit the flaw in denial-of-service (DoS) attacks, cybersecurity firm watchTowr showed in August that successful exploitation can also allow attackers to gain remote code execution as root on unpatched NetScaler instances. "This is a memory overflow vulnerability that may lead to unpredictable behavior or denial of service and impacts NetScaler Gateway or AAA virtual server," Citrix said at the time. "We have not observed any unmitigated exploitation of this vulnerability as well."
Meta will pay up to $18B and cap teen Facebook and Instagram use at two hours daily after nearly all US states sued over child safety. Meta will pay up to $18 billion over the next decade and impose real usage limits on teenagers using Facebook and Instagram, settling claims that the company deliberately designed its platforms to addict children. The deal ended a federal trial mid-stream, right as Instagram head Adam Mosseri had begun testifying and Mark Zuckerberg was expected to take the stand next. The timing made sense given the huge potential penalties. Four states, California, Colorado, Kentucky, and New Jersey, were seeking up to $200 billion in damages. Before the trial, Meta said they could demand as much as $1.4 trillion. Against those figures, the $18 billion settlement looks relatively small, although it still equals about three to four months of Meta’s profits. The most important part of the deal is what Meta agreed to change. Teenagers will be limited to two hours a day on Facebook and Instagram. Meta will also block access between midnight and 6 a.m. unless a parent gives permission, and it will turn off most push notifications during school hours. “The focus of this case was to protect our kids,” Colorado Attorney General Phil Weiser said in a statement reported by Reuters. “The relief we are getting in this settlement is very meaningful and well beyond what any court has ordered or is likely to order.”” What the settlement leaves unchanged matters too. Meta does not have to stop using personalized recommendations or targeted ads for teenagers. It also does not have to remove specific types of content that researchers have linked to negative effects, such as posts that can make users feel worse about their bodies. A two-hour limit is still a meaningful restriction, but Meta can continue trying to maximize engagement during those two hours. The deal also creates an interesting financial incentive. Of the roughly $16.7 billion going to 47 states, Washington D.C., Puerto Rico and other territories, about $12.7 billion is guaranteed. The remaining $5 billion depends on whether Snapchat, TikTok and YouTube introduce similar protections for teenagers. This gives Meta a financial reason to push its competitors to adopt the same rules, which is why the company reportedly plans to use newspaper ads to encourage TikTok and YouTube to follow suit. Separately, Wednesday’s settlement also resolved lingering state privacy claims tied to the Cambridge Analytica scandal, with Meta agreeing to pay $459 million on top of everything else. That’s an old wound getting stitched up alongside a much newer one, in the same afternoon. Not every state joined the settlement. New Mexico stayed out after winning a $567 million public nuisance ruling against Meta earlier this month, on top of a separate $375 million jury verdict. Attorney General Raul Torrez said the settlement didn’t include some changes his case had pushed for, including stronger protection against adults targeting children and a ban on sexualized AI chatbot interactions with minors. Still, he called the deal a step forward. Florida rejected the settlement altogether. Attorney General James Uthmeier said the payouts amount to “peanuts” compared with the harm caused and said Florida would take Meta to trial instead. Legal experts already see the settlement as a possible model for future cases. Northwestern law professor James Speta said Meta and other tech companies faced growing pressure to change anyway, from Congress, state lawmakers and the public. That makes the settlement more than a single case: it could set a standard that courts and regulators use when judging other platforms. Thousands of similar lawsuits from individuals, school districts and municipalities are still moving through courts across the U.S. If those cases follow the same pattern, we haven’t seen the last of these headlines. “Today, we are announcing an agreement with a bipartisan group of 52 attorneys general across US states, territories, and the District of Columbia, building on our longstanding efforts to empower parents and support teens.” reads the statement published by Meta. “Over the years, we have consistently partnered with parents and experts — listening, learning, and building. That’s why we launched Teen Accounts in 2024, to bring automatic protections to teens, and more control for parents.” The agreement aims to push YouTube, TikTok and other platforms to adopt similar protections for teenagers. “While this is an important step, the fact is that teens move fluidly between dozens of apps a day. All platforms should empower parents and support teens by putting the same measures in place, because we know that when teens are restricted on one app, they simply move to another.” concludes Meta. “For meaningful progress to happen, we urge TikTok and YouTube to join us and state attorneys general in adopting this new standard, to ensure teens use social media in a healthy and responsible way.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Facebook)
ATF, the regulatory agency that enforces federal laws governing firearms and explosives in the United States, has confirmed that one of its systems was compromised after breach claims made by the Qilin ransomware gang. This follows Qilin adding the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives to its dark web data leak portal on Wednesday, without saying whether it had stolen files from ATF's systems or demanded a ransom. The same day, the ATF published a press release saying that a standalone system was breached in what it described as a "major incident," which is now being investigated in collaboration with the Department of Justice. "The impacted system operates separately from the ATF enterprise network, and there is no indication that the incident has affected the ATF enterprise network, the ATF eForms system, or any other ATF system," the federal law enforcement agency said.
Confirm this action.
Leaving now will discard your changes.