Avalon Framework Deploys CrownX Ransomware After ISO-Phishing and ETW Bypass

The infection chain begins with a spoofed legal email linking to a password-protected Proton Drive archive. Once mounted, the ISO holds a .lnk that invokes MSBuild to load a .NET assembly tampering with ETW telemetry before pulling the Avalon core over HTTPS. This sequence matches documented techniques in prior commodity loaders but adds explicit per-EDR bypass logic targeting Defender, SentinelOne, CrowdStrike, and six others.

Avalon aggregates browser, wallet, VPN, and RDP artifacts before exfiltrating to helloxcherry[.]com and awaiting commands. Its final stage, CrownX, uses the Windows Crypto API to encrypt engineering and virtual infrastructure files, deletes shadow copies, and attempts direct disk writes to damage boot structures. Researchers note the framework's AI-generated code smell: functional modules lack consistent OPSEC, suggesting lower-skill actors now reach enterprise impact thresholds faster.

The pattern echoes 2023-2025 rises in modular loaders that bundle ransomware only after initial access brokers have sold the foothold. No state attribution is supported by the technical artifacts; the code reuse and C2 domain registration indicate financially motivated operators iterating quickly.

Expect rapid re-use of the ETW and ISO delivery components in follow-on campaigns. Defenders should monitor for unsigned MSBuild executions from removable media and anomalous ETW provider disables within the next 60 days.