The email looks like a legal notice. It links to a password-protected archive on Proton Drive, and inside sits an ISO image holding a Windows Shortcut file. Open the shortcut and a chain of steps begins that ends with a new malware framework called Avalon on the machine.
Researchers identified Avalon in July 2026. It packs credential harvesting, lateral movement, remote access, disruption of system recovery and ransomware into one modular toolkit. The ransomware piece is named CrownX.
What it does once inside
The campaign starts with phishing and credential collection. Once in, Avalon escalates privileges and moves sideways across the network, then opens command and control channels to stay put and run commands. It also targets data from browsers, cryptocurrency wallets and communication applications, and ships that data to a remote server.
Only then does CrownX run. It encrypts critical files and leaves ransom notes with payment instructions and deadlines.
Avalon also goes after the victim’s way back. It terminates the Volume Shadow Copy Service and deletes shadow copies, which makes recovery and incident response harder.
Built to dodge security tools
The framework uses evasion techniques aimed at security products from vendors including Microsoft Defender, SentinelOne and CrowdStrike. The delivery route matters too: the multi-stage phishing chain is designed to get past standard security controls.
Analysts reviewing the case link the emergence of Avalon to AI-assisted malware development, which they say lowers the barrier for attackers building complex, multi-function tools. Their advice for organizations covers phishing awareness training, endpoint protection and tested incident response plans. Network segmentation and egress controls, they add, would limit lateral movement and data theft.
