New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Summary: Blackpoint Cyber researchers discovered a previously undocumented modular malware framework called Avalon, distributed through a multi-stage phishing chain that begins with a spoofed legal document email linking to a password-protected Proton Drive archive and uses an ISO image and a document-themed Windows Shortcut to launch an MSBuild project that loads a .NET assembly and disables Event Tracing for Windows. Avalon combines credential collection, lateral movement, remote access, recovery disruption, and a ransomware component named CrownX, and includes evasion methods targeting Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender.
What you should know: By the time the CrownX ransom note appeared, the framework had already collected credentials, established C2 communications, prepared multiple lateral movement paths, and weakened local recovery options - so the encryption was the last step, not the first.
Read the original at The Hacker News ↗
- Mentions
- CVE-2025-3248
- Related
- CVE-2025-3248: Langflow Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 05, 2025