ＧＩＮＧ　セ翁ん

> be me > get dm > "smelly i found goop" > wtf i love goop (malware) > "Our EDR picked up unusual activity on the network. It was flagged as CLOUDHAZE a/k/a UNC7072" > ok > gibs files > literally nothing on CLOUDHAZE > literally nothing on UNC7072 > listed as primarily targeting healthcare > crickets > tf is this goop? > look inside > Rust malware > make quick initial assessment > say has weird anti-emulation stuff > be wildly inaccurate > be a doofus > post inaccurate information on internet > prolly shouldnt write about bonking goop at 3am while sleep deprived > nobody calls me out > calling myself out rn for being doofus > resume bonking > malware only runs when command line arguments passed > "--check" or "--check-gui" > if no command line, dies > ok > keep looking > malware has bunch of stuff inside > deobfuscates stuff inside itself > dynamically builds C2 domains > connects to C2 domains via HTTPS > sends POST > emulate > goop does its thing, connects to C2 > authenticates > radio silence > operators likely watching and waiting > goop doesnt automatically deliver more goop > ok > keep digging > goop can accept commands from operator > create process and redirect I/O > read files > likely has campaign ID associated with it internally > dm goop giver back > lol r u in healthcare bro? > "No, I work for a large Oil and Gas company in Europe" > company v v valuable to EU for strategic reasons since Ukraine Russia conflict > hmmmm Chat, I'm absolutely stumped. I have no clue what the actual fuck I'm looking at. I don't know if this state-sponsored malware, or a really dedicated financially motivated Threat Actor who cares deeply about their operational success. State-sponsored malware would align with potential motives for espionage. However, it would also align for a financially motivated Threat Actor who could make immense money if a compromise was successful. I wish I could allocate more time to bonking this malware, unfortunately more malware needs bonking. Maybe someone else can pick up on this, a colleague, company, some stinky nerd, whoever or whatever. C2s: topsmagnificentgrade(.)com tabbyottercub(.)com flawlessgradecheered(.)com Stager: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 Payload: 74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124 Unusual strings I don't understand: - "Caira" - "GUJONQGNQCLYEYJ"

> be me > get dm > "smelly, i found goop" > wtf i love goop (malware) > "My spouses work, a healthcare clinic, has been infected by malware. It arrived as a .rev file" > lol ok > download > look inside > .rar file named .rev > ok nbc > extract content from rar > control panel applet > lol is it 2002? > look inside > malware written in Go > spend forever decoding what is goop code or go code > 8 hours in > deeply rustled > Go goop has .svg document inside it > goop compromises pcs > uses .svg inside of it > goop owners steal da emails on pc > send .svg from goop to other ppls emails > .svg inside tells ppl to download a .rev file > goop propagation with social engineering > neat > keep bonking > goop establishes connection with ip address > 85.192.30.227 > not flagged by AVs > goop first seen connecting to IP 2026-09-20 > sort of new goop maybe? > keep bonking goop > goop talks to ip address in funny way > confuse me > goop takes funny talk and determines what to do > goop is told by ip to do stuff > have goop transfer / upload files to ip or infected pc > have goop start processes > have goop update itself to latest version > keep bonking > finally discover the goop > Dark Caracal a/k/a GoCaracal > "cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists" god damn lebanon government your malware was a fucking pain in the ass, i actually wanted to blow my fucking brains out a few times, ngl. also, but your wifes work is being targeted by the lebanese government, prolly a problem idk, good luck on that bro C2: 85.192.30.227 Dark Caracal (FQOYI_70153.cpl) SHA256: 8df20f4fd964c84bce577b3984bb5c65bccb876707cd9d94934a414bce7d7479