hacker-news · Crawled Jul 5, 2026
New Avalon Malware Framework Packs CrownX Ransomware Capabilities
3 IoCs 1 CVEs
Read original article ↗
AI Summary
A new modular malware framework dubbed Avalon has been discovered, capable of executing a multi-stage attack chain that includes credential theft, lateral movement, and ransomware deployment via its CrownX component. The attack begins with a phishing email containing a password-protected archive hosted on Proton Drive, which delivers a malicious ISO image. The framework employs advanced defense evasion techniques, disables recovery mechanisms, and exfiltrates sensitive data before encrypting systems. Notably, Avalon shows signs of AI-assisted development, lowering the barrier for less sophisticated actors to deploy complex malware.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 3 extracted
MITRE ATT&CK TTPs 27 techniques
T1021 Remote Services · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1053.003 Cron · Execution T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1075 T1075 T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1490 Inhibit System Recovery · Impact T1499 Endpoint Denial of Service · Impact T1505.003 Web Shell · Persistence T1552 Unsecured Credentials · Credential Access T1619 Cloud Storage Object Discovery · Discovery