New Avalon Malware Framework Packs CrownX Ransomware Capabilities

Cybersecurity researchers discovered Avalon, a modular malware framework that integrates credential theft and ransomware execution into one package. The system deploys the internally named CrownX component after bypassing security controls via spoofed emails containing ISO images with embedded malicious shortcuts. This defense evasion subsystem conceals operations from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender while reducing telemetry visibility for forensic analysis.