Researchers Uncover "Avalon," a Sophisticated Malware Framework with Integrated "CrownX" Ransomware

Executive Summary

Cybersecurity researchers have identified Avalon, a new and highly sophisticated malware framework that functions as an all-in-one attack platform. It integrates multiple malicious modules, including a potent credential harvester, lateral movement capabilities, and its own ransomware payload, CrownX. The framework is being distributed through a phishing campaign that uses password-protected archives and ISO images to bypass initial security checks. Avalon is particularly dangerous due to its built-in defense evasion mechanisms designed to disable or blind security tools like Microsoft Defender, CrowdStrike, and SentinelOne. The discovery is notable as it points towards the potential use of AI in malware development, which could lower the bar for creating powerful and complex threats.

Threat Overview

The Avalon attack chain begins with a phishing email containing a link to a password-protected archive on Proton Drive. This archive contains an ISO image, which, when mounted, presents a malicious Windows Shortcut (.lnk) file disguised as a PDF. Executing this shortcut triggers a fileless attack sequence that leverages trusted system tools like MSBuild.exe to execute malicious code directly in memory. This method is designed to evade detection by traditional file-based antivirus solutions.

The framework's primary goal is multifaceted: steal sensitive information and deploy ransomware. The credential stealing module targets a wide array of applications, including web browsers, cryptocurrency wallets, and enterprise communication tools, maximizing the value of a single compromise.

Technical Analysis

The Avalon framework demonstrates a high degree of technical sophistication:

• Initial Access (T1566.001): Phishing with a link to a malicious file.
• Execution (T1204.002): The user is tricked into clicking a malicious .lnk file inside an ISO image.
• Defense Evasion (T1218.007): The .lnk file uses MSBuild.exe to compile and run an inline C# project, a known Living-Off-the-Land (LOL-bin) technique.
• Defense Evasion (T1562.001) & (T1562.006): Avalon actively attempts to disable security tools. It includes functionality to patch Event Tracing for Windows (ETW) and bypass the Antimalware Scan Interface (AMSI), which are critical sources of telemetry for EDR products.
• Credential Access (T1555): The framework contains a stealer module that targets credentials from browsers, crypto wallets (MetaMask, Ledger Live), and collaboration apps (Slack, Teams).
• Impact (T1486): The final payload is the CrownX ransomware, which encrypts files. It also attempts to delete Volume Shadow Copies (T1490) to hinder recovery.
• Impact (T1485): The framework also possesses a destructive capability to overwrite physical drives, indicating it could be used for purely destructive attacks.

Impact Assessment

A successful Avalon infection can be catastrophic for an organization. The immediate impact includes the loss of access to critical data due to the CrownX ransomware. Simultaneously, the comprehensive credential theft opens the door to further breaches, financial fraud, and compromise of other online services. The defense evasion capabilities mean that the attack may go undetected for a longer period, allowing the attacker more time to exfiltrate data and move laterally. The destructive overwrite capability poses a threat of permanent data loss, far exceeding the typical impact of ransomware.

IOCs — Directly from Articles

No specific file hashes, IPs, or domains were listed in the source articles.

Cyber Observables — Hunting Hints

Security teams should hunt for the following suspicious activities:

Detection & Response

• Endpoint Detection and Response (EDR): Ensure EDR solutions are configured with anti-tampering enabled. Monitor for processes attempting to patch memory related to ETW or AMSI. Create detection rules for MSBuild.exe spawning suspicious child processes or making network connections.
• Script Block Logging: Enable PowerShell Script Block Logging (Event ID 4104) to capture the contents of de-obfuscated scripts that might be executed by the malware.
• Email Security: Use email gateways to block password-protected archives and potentially ISO file attachments or links to them.
• Application Control: Use application control solutions like AppLocker or WDAC to restrict the execution of MSBuild.exe to only authorized users (e.g., developers).

Mitigation

• User Training: Train users to be suspicious of emails with password-protected attachments and to be wary of opening files from unexpected ISO images.
• Block ISO Mounting: For most users, the ability to mount ISO files is not required for daily business. Consider using Group Policy to block the automatic mounting of ISO files to prevent this attack vector.
• Attack Surface Reduction (ASR): Implement ASR rules, such as "Block execution of potentially obfuscated scripts" and "Block all office applications from creating child processes."
• Credential Protection: Use password managers and enable MFA on all services to limit the impact of credential theft.