Avalon Malware Framework Deploys CrownX Ransomware in New AI-Assisted Cyberattacks

Cybersecurity researchers have uncovered a highly sophisticated, modular malware framework dubbed Avalon that deploys a destructive ransomware payload known as CrownX. Distributed through a multi-stage phishing chain, this new threat actively disables system telemetry and bypasses major endpoint detection systems to harvest credentials and encrypt critical infrastructure.

The attack sequence begins with a spoofed legal document email that directs victims to a password-protected archive hosted on Proton Drive. To evade email-layer detection, the malicious content is embedded within an ISO image rather than attached directly. When a user interacts with a specific Windows Shortcut file (Secure Document CA-283505.pdf.lnk) inside the mounted image, it triggers the infection sequence.

This shortcut launches an MSBuild project that loads an embedded.NET assembly. The assembly immediately interferes with Event Tracing for Windows (ETW) to blind forensic tools, before downloading the final Avalon payload over HTTPS. The framework is explicitly designed to evade detection from major security platforms, including Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender.

Once active, Avalon executes a comprehensive compromise of the host system before the CrownX ransomware is even deployed. Its extensive feature set includes:

• Harvesting credentials, cookies, history, and bookmarks from Chromium-based browsers and Mozilla Firefox.
• Gathering data from cryptocurrency wallet apps (MetaMask, Phantom, Coinbase Wallet, Exodus, Electrum, Atomic Wallet, Ledger Live, Bitcoin Core) and communication platforms (Discord, Slack, Teams, OpenVPN, WireGuard, and Windows Credential Manager).
• Collecting details about SSH known hosts, saved RDP connections, Wi-Fi profiles, and Group Policy Preferences cpassword artifacts.
• Exfiltrating data to a remote server (helloxcherry[.]com) and polling the server to receive tasking commands.
• Performing reconnaissance to prioritize systems that can expand the scope of the compromise.
• Encrypting files associated with business operations, software development, engineering, data storage, and virtual infrastructure using the Windows Cryptography API, followed by a ransom note with a countdown timer.
• Inhibiting system recovery by terminating the Volume Shadow Copy Service and deleting shadow copies.
• Removing traces of artifacts using an anti-forensic cleanup subsystem to complicate incident response efforts.
• Directly interacting with disk structures to damage partition information, boot records, or other critical areas of the drive, rendering the system unusable.

The kill chain illustrates how a familiar business lure can progress into a reusable, multi-capability framework designed to harvest credentials, retrieve subsequent payloads entirely in memory, and stage multiple follow-on actions from a single compromised endpoint.

- Blackpoint Cyber

Avalon exhibits clear signs of AI-assisted development, combining complex modules without the traditional operational security usually required for such advanced tools. This trend is accelerating, as evidenced by a separate agentic ransomware attack codenamed JADEPUFFER. Discovered by Sysdig, this operation utilized a large language model (LLM) to autonomously exploit CVE-2025-3248 in a Langflow instance, dynamically adjusting its actions to execute a database-extortion playbook.

Furthermore, Palo Alto Networks Unit 42 recently reported a codeless AI malware that operates entirely through a Telegram bot and a public LLM API (api.groq[.]com). The attacker simply types natural language instructions into Telegram, which the LLM translates into shell commands for the compromised machine to execute. Uploaded to VirusTotal in March 2026, this malware achieved zero detections across all security engines.

The integration of LLMs into malware frameworks like Avalon and JADEPUFFER fundamentally alters the cybersecurity landscape by decoupling threat severity from attacker sophistication. Historically, deploying a multi-stage, memory-resident framework required deep technical expertise and rigorous operational security. Now, AI translation layers allow novice actors to execute complex, agentic attacks using plain text.

This shift renders traditional indicators of compromise (IoCs) increasingly unreliable. When malware dynamically generates shell commands via public APIs like Groq, static signatures become obsolete. Enterprise security teams must pivot toward behavioral monitoring and strict API egress filtering, as the cost of launching a highly adaptive, zero-detection ransomware campaign has effectively dropped to near zero.