News

Security analysts have uncovered a previously unseen, modular malware platform named Avalon that is being propagated through a layered phishing workflow capable of sidestepping conventional defenses. The framework integrates credential theft, lateral propagation, remote access, interference with recovery mechanisms and a built-in ransomware module the investigators have labeled CrownX.

The intrusion begins with a spoofed legal-themed email that points recipients to a password-protected archive hosted on Proton Drive, according to Blackpoint Cyber researchers Nevan Beal and Sam Decker. Instead of attaching malicious files to the message, the attackers place the payload inside an ISO image, a tactic intended to reduce the chance of detection at the mail-gateway level.

If a victim opens the mounted ISO and clicks a document-style Windows shortcut named "Secure Document CA-283505.pdf.lnk", that action launches a staged infection chain that ultimately activates Avalon. The shortcut executes a command which runs an MSBuild project embedded in the ISO. That MSBuild project in turn loads a concealed .NET assembly that tampers with Event Tracing for Windows (ETW) to blunt forensic telemetry and then retrieves a follow-on payload over HTTPS that starts the Avalon framework.

Avalon incorporates an extensive defense-evasion component designed to hide activity from a wide range of endpoint controls, with targeted techniques intended to foil tools from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee and Bitdefender.

The researchers note the framework adapts its behavior based on what defensive controls are present, reducing telemetry, avoiding user-mode monitoring where possible and selecting different execution paths to bypass protections.

Built-in capabilities observed in Avalon include harvesting credentials, cookies, browsing history and bookmarks from Chromium-based browsers and Mozilla Firefox; extracting data from cryptocurrency wallet applications such as MetaMask, Phantom, Coinbase Wallet, Exodus, Electrum, Atomic Wallet, Ledger Live and Bitcoin Core; and collecting artifacts from collaboration and networking tools including Discord, Slack, Microsoft Teams, OpenVPN, WireGuard and the Windows Credential Manager.

In addition, the malware gathers SSH known_hosts, saved RDP connection entries, Wi-Fi profiles and Group Policy Preferences cpassword artifacts. Stolen information is exfiltrated to a command-and-control host identified as helloxcherry[.]com, while the implant also polls that server for tasking instructions.

Avalon performs reconnaissance to identify and prioritize systems that can broaden the compromise, and its ransomware component encrypts files tied to business operations, software development, engineering, data stores and virtualization environments using the Windows Cryptography API. Victims receive a ransom note with payment directions and countdown timers indicating how long remains before the demanded amount increases.

To frustrate recovery, the malware stops the Volume Shadow Copy Service and deletes shadow copies. It also contains anti-forensic cleanup routines to erase traces that would aid incident responders. Observers warn the framework appears capable of low-level disk interaction-likely targeting partition tables, boot records or other critical structures-to render hosts unusable beyond mere file encryption.

Blackpoint Cyber explains that CrownX is the final extortion phase but the overall impact far exceeds file encryption: by the time victims see the ransom demand the attackers have already harvested credentials, established C2 channels, staged multiple lateral movement vectors and sabotaged local recovery mechanisms.

The investigators also found indicators suggesting AI-assisted development played a role in Avalon’s construction. The framework stitches together diverse modules without the kind of strict operational security or tradecraft that would typically indicate a highly experienced operator. This, they say, is another example of how generative AI can lower the barrier to producing sophisticated malware, enabling less-skilled actors to assemble complex toolsets in a fraction of the time it would previously have required. As a result, the mere presence of an advanced capability is no longer a reliable measure of the attacker’s expertise.

Blackpoint Cyber summarized the kill chain as a familiar business-themed lure that escalates into a reusable, multi-function platform built to harvest credentials, fetch additional payloads into memory and launch multiple follow-on actions from a single compromised endpoint.

The Avalon disclosure arrives alongside other AI-related ransomware research. Sysdig recently described what it believes is the first publicly documented instance of an agentic ransomware attack carried out end-to-end by a large language model (LLM). The actor, tracked as JADEPUFFER, gained initial access to an internet-exposed Langflow instance via CVE-2025-3248 and executed an adaptive, fully automated campaign that ultimately pivoted to the intended target and ran a destructive database-extortion workflow against a production database server, according to Sysdig’s Michael Clark. He warned that the minimum skill required to run ransomware has dropped to the cost of operating an agent, and if that agent is executed with stolen credentials through LLMjacking, the expense for attackers approaches zero.

Separately, researchers have identified a codeless AI-driven implant that leverages a Telegram bot and a public LLM API to implement commands for an operator lacking command-line expertise. The malware sends basic system identifiers to the attacker’s Telegram bot, then polls the bot API every five seconds for new instructions and returns execution results via the same channel.

Each message from the operator is forwarded to a public LLM endpoint at api.groq[.]com/openai/v1/chat/completions, which translates the attacker’s plain-language instructions into shell commands; the victim’s system executes those translated commands. Palo Alto Networks Unit 42 noted that this design inserts an LLM translation layer to convert natural language into shell syntax so the attacker can issue plaintext instructions without needing command-line knowledge. The sample was uploaded to VirusTotal on March 11, 2026 and showed zero detections across engines at the time of reporting.

Together, these findings underscore a trend: AI capabilities are being integrated into malware development and operations in ways that can accelerate attacker productivity and reduce required expertise, complicating attribution and raising the stakes for defenders.