Researchers at Blackpoint Cyber have uncovered a new modular malware framework called Avalon. It’s delivered through a multi-stage phishing chain designed to slip past traditional security controls.
Once inside, Avalon does a lot. Credential harvesting. Lateral movement. Remote access. Recovery sabotage. And finally — ransomware. The ransomware module goes by CrownX.
The infection starts with an email carrying a spoofed legal document. Recipients are directed to a password-protected archive on Proton Drive. Inside that archive, an ISO image contains a Windows Shortcut disguised as a PDF. Click it, and the chain begins.
The shortcut launches an MSBuild project, which loads a .NET assembly that disables Windows Event Tracing to reduce visibility. Then it downloads a next-stage payload that deploys Avalon itself.
Avalon’s defense evasion is aggressive. It specifically targets monitoring from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic, FortiEDR, ESET, McAfee, and Bitdefender. It adapts its execution based on whatever defenses are present.
The framework steals browser credentials, cryptocurrency wallets (MetaMask, Phantom, Coinbase, Exodus, Electrum, Atomic, Ledger Live, Bitcoin Core), Discord and Slack sessions, VPN configs, and Wi-Fi profiles. It exfiltrates everything to a remote server at helloxcherry[.]com.
CrownX encrypts files related to business operations, software development, and infrastructure. It terminates Volume Shadow Copy Service and deletes shadow copies. It directly corrupts disk structures to make systems unrecoverable.
Avalon shows signs of AI-assisted development. Multiple components assembled with minimal concern for operational security. That’s a warning sign — AI is making sophisticated tools accessible to anyone.
