New Avalon Malware Framework Packs CrownX Ransomware Capabilities
Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls.
Credential capture, lateral movement, remote access, recovery interruption, and ransomware execution are all combined under one roof by Avalon. CrownX is the internal name for the ransomware component.
According to Blackpoint Cyber analysts Nevan Beal and Sam Decker, the attack started with a phony legal document email that led recipients to a password-protected archive on Proton Drive. Instead of being directly attached, malicious content was contained within an ISO picture, which decreased the possibility of detection at the email layer.
If the recipient of t...