Avalon Malware Framework Bundles Ransomware, Credential Theft and AI-Assisted Development Into One Nasty Package
Researchers at Blackpoint Cyber have pulled apart a previously unknown modular malware framework called Avalon, and it's a fairly comprehensive piece of work. Credential harvesting, lateral movement, remote access, recovery sabotage, and ransomware all rolled into a single toolkit. The ransomware component goes by the name CrownX internally.
The initial infection starts with a phishing email dressed up as a legal document, pointing victims toward a password-protected archive hosted on Proton Drive. Tucking the payload inside an ISO image rather than attaching it directly is a deliberate choice to skip past email-layer scanning. Once the ISO is mounted, victims are presented with a Windows shortcut file with a reassuring-sounding name and a .pdf.lnk extension. Clicking it kicks off a chain that eventually deposits Avalon on the machine.
The chain itself is reasonably clever. The shortcut triggers an MSBuild project embedded in the ISO, which loads a .NET assembly, quietly mangles Event Tracing for Windows to reduce forensic visibility, then pulls down the next stage over HTTPS. By the time Avalon is running, it has already done quite a bit of groundwork.
The framework includes a dedicated defense evasion subsystem with specific logic to detect and work around Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. It adjusts its behaviour depending on what security tooling it finds, reducing telemetry and sidestepping user-mode monitoring where possible.
Once past defenses, Avalon gets busy. It strips credentials, cookies, browsing history and bookmarks from Chromium and Firefox. It targets crypto wallet applications including MetaMask, Phantom, Exodus, Electrum, Atomic Wallet, Ledger Live, Coinbase Wallet and Bitcoin Core. It also goes after Discord, Slack, Teams, OpenVPN, WireGuard, and the Windows Credential Manager. SSH known hosts, saved RDP connections, Wi-Fi profiles, and Group Policy Preferences cpassword artifacts are all fair game too.
Stolen data gets exfiltrated to a remote server at helloxcherry[.]com, which also handles command-and-control tasking. The framework performs its own reconnaissance and identifies systems useful for spreading the compromise further.
When CrownX finally executes, it encrypts files related to business operations, software development, engineering, data storage and virtual infrastructure using the Windows Cryptography API. A ransom note appears with payment instructions and a countdown timer that ticks up the demanded amount as time passes. Shadow copies are deleted, Volume Shadow Copy Service is terminated, and an anti-forensic cleanup routine removes artifacts to complicate any incident response effort. There is also functionality that directly manipulates disk structures, potentially damaging partition tables or boot records to render systems unbootable.
As Blackpoint's researchers put it, by the time the ransom note shows up, the real damage is already done.
One detail worth flagging: Avalon shows signs of AI-assisted development. The components fit together without the kind of cohesive tradecraft you would expect from experienced malware authors. This matters because it points to something the security community has been warning about for a while. The presence of sophisticated capabilities in a piece of malware is no longer a reliable signal of a sophisticated threat actor behind it.
Meanwhile, an LLM Ran Its Own Ransomware Campaign
Separately, Sysdig has documented what it describes as the first publicly confirmed ransomware attack driven autonomously by a large language model from start to finish. The threat actor behind it has been named JADEPUFFER.
The attacker gained initial access through CVE-2025-3248, a vulnerability in an internet-exposed Langflow instance. From there, a fully automated, adaptive campaign ran without human intervention, ultimately pivoting to a production database server and executing a destructive extortion playbook against it.
Sysdig's Michael Clark put the economic reality bluntly: the skill floor for running ransomware has dropped to whatever it costs to run an agent. If the agent is running on credentials stolen through LLMjacking, that cost is effectively zero.
The Codeless C2
Then there is this: Unit 42 at Palo Alto Networks has documented an AI malware sample that routes command-and-control through a Telegram bot connected to a public LLM API. The implant sends basic system information to the attacker's Telegram bot and then polls it every five seconds for instructions. The twist is that the attacker types commands in plain English. Those messages get forwarded to Groq's API endpoint, which translates them into actual shell commands. The victim machine executes whatever comes back.
No shell syntax knowledge required. The LLM handles the translation layer entirely.
The sample was uploaded to VirusTotal on 11 March 2026 and currently sits at zero detections across all engines. Whether that reflects good evasion or the fact that nobody has quite caught up with this approach yet is an open question. Probably both.