Summary
Blackpoint Cyber’s Adversary Pursuit Group has uncovered “Avalon,” a previously undocumented modular malware framework that bundles credential harvesting, lateral movement, remote access, backup and recovery disruption, and ransomware deployment into a single coordinated toolkit. The framework’s final-stage payload is CrownX, a ransomware component — but researchers emphasize that by the time the ransom note appears, extensive damage including credential theft and full network mapping has already occurred.
Avalon is distributed through a sophisticated multi-stage phishing chain beginning with spoofed legal document emails that direct victims to password-protected archives on Proton Drive. Malicious content is embedded within ISO images rather than direct attachments, reducing email-layer detection. A document-themed Windows Shortcut (.lnk) triggers a staged deployment that uses trusted Microsoft tooling like MSBuild to execute .NET components, with the framework disabling Event Tracing for Windows (ETW) to hinder forensic visibility.
The framework’s credential harvesting capabilities are extensive, targeting Chromium-based browsers, Firefox, cryptocurrency wallets (MetaMask, Phantom, Coinbase Wallet), Discord, Slack, Teams, VPN clients, and Windows Credential Manager. Avalon also includes an aggressive defense evasion subsystem designed to bypass or disable Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. Researchers note signs of AI-assisted development in the framework’s code, which lowers the sophistication barrier for the operators behind it.
Source
The Hacker News — New Avalon Malware Framework Packs CrownX Ransomware
Blackpoint Cyber — Avalon’s Path: From Legal Lure to CrownX Ransom Capabilities
Commentary
Avalon is a reminder that the ransomware ecosystem continues to mature. This isn’t a single-purpose encryptor — it’s a full-spectrum intrusion framework that treats ransomware as just the final act in a broader data theft and access operation. The explicit targeting of nearly every major EDR product shows that the operators have done their homework on enterprise defenses.
The ISO-in-a-Proton-Drive-link delivery chain is clever and reflects how attackers continue to find gaps in email security stacks. The use of MSBuild for execution and ETW disabling for anti-forensics are well-known techniques, but packaging them into a modular, AI-assisted framework makes the whole package more accessible to less skilled operators. Detection teams should be hunting for MSBuild executions from unusual paths, ETW tampering, and anomalous Proton Drive downloads in their environments.