TLDR Tech / InfoSec
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Avalon is a modular framework delivered via legal-themed phishing that uses Proton Drive archives, ISO images, LNK shortcuts, and MSBuild to deploy itself while disrupting ETW and avoiding major EDR tools. It harvests browser and wallet data, corporate credentials, VPN and messaging tokens, then moves laterally, encrypts key business files with Windows Crypto API, kills VSS, manipulates disk structures, and drops CrownX ransom notes with deadline timers. Separate research shows agentic and codeless ransomware operations that use public LLM APIs and Telegram bots to turn natural-language attacker prompts into live shell commands against compromised systems.
Read the full story