Avalon: The AI-Assembled Malware Kit With CrownX Ransomware

Researchers at Blackpoint Cyber have taken apart a new modular malware framework called Avalon, and it reads like a Swiss Army knife for intrusions. Credential theft, lateral movement, remote access, recovery sabotage and a ransomware payload internally named CrownX are all bundled into one kit, delivered by a phishing chain that begins with something as ordinary as a fake legal document.

The lure is a spoofed email pointing at a password protected archive on Proton Drive. Inside sits an ISO. Inside that, a Windows shortcut called Secure Document CA-283505.pdf.lnk. One click kicks off MSBuild, which loads a .NET assembly that quietly tampers with Event Tracing for Windows to blind forensic tools, then reaches out over HTTPS for the next stage. By the time CrownX drops its ransom note, the attackers have already collected credentials, opened command channels, and knocked out local recovery.

Tailored to defeat the tools you probably run

Avalon ships with specific evasion tricks for Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic, FortiEDR, ESET, McAfee and Bitdefender. That's not a generic loader hoping for the best. It's a kit built with a shopping list of common defences in front of it.

What's telling is how it was built. The researchers reckon large parts were stitched together with the help of AI, because the individual components are capable while the tradecraft joining them is sloppy in ways experienced developers rarely are. Odd choices, mismatched conventions, the sort of seams that don't appear when one skilled person owns the whole thing end to end.

The same pattern keeps showing up

Avalon isn't a one-off. Sysdig recently documented a ransomware operation dubbed JADEPUFFER that was run end to end by a large language model. The model broke into a Langflow instance via CVE-2025-3248 and improvised its way through to a production database. Unit 42 flagged a Telegram-controlled implant that takes plain English instructions, pipes them through the Groq API, and turns them into shell commands. Zero detections on VirusTotal at the time of reporting, and zero command-line skill required from the operator.

What this actually changes

For a long time, the shape of the malware told you something about the crew behind it. A polished, modular framework with real evasion work meant a well-resourced operator with time and talent. That inference is getting shaky.

• Components can be generated or refined by a model, then bolted together by someone who couldn't write them from scratch.
• Operators can drive intrusions in natural language, without knowing the underlying commands.
• Detections stay low because novel code paths and light obfuscation are cheap to produce.

The uncomfortable part is that capability is no longer a good proxy for skill. A well-built framework used to imply a well-resourced crew. Now it might just mean somebody with a chatbot subscription, a Proton Drive account, and a phishing template that still, after all these years, gets clicked. The delivery chain here didn't need a zero-day or a novel technique. It needed one person to double-click a shortcut inside an ISO inside an archive. That first click is doing more work than any of the clever bits that follow.