threat-wire

New Ransomware Framework Evades Nine Major Security Tools

Researchers have found a new modular ransomware framework called Avalon that is built specifically to slip past nine security products many small businesses run day to day, including Microsoft Defender, SentinelOne, and CrowdStrike. It arrives through a spoofed legal document and shows signs of AI-assisted development. By the time its CrownX ransomware component shows a ransom note, it has already stolen credentials and disabled recovery options.

By SecureBusinessHub Editorial, International cybersecurity desk — · 5 min read

A new ransomware framework called Avalon is built to slip past nine security products that plenty of small businesses run every day: Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender.

How the infection starts

Researchers at Blackpoint Cyber traced the attack to a spoofed legal document email pointing to a password-protected archive on Proton Drive. The malicious content sits inside an ISO disk image rather than a normal attachment, which cuts the odds of the email gateway catching it. Opening the image and clicking a document-themed Windows shortcut triggers a chain: the shortcut runs an MSBuild project buried in the ISO, which loads a hidden .NET assembly. That assembly then tampers with Event Tracing for Windows, the logging system most endpoint tools depend on, before pulling down the main Avalon payload over HTTPS.

What it does once it's in

Avalon bundles credential collection, lateral movement, remote access, and recovery disruption under one roof, with a ransomware component internally named CrownX handling the final extortion stage. Researchers say the framework has specific methods built in to evade each of the nine named security tools individually, giving it several ways to cut telemetry and dodge user-mode monitoring depending on what's installed on the machine it lands on. By the time CrownX actually encrypts anything, Avalon has typically already pulled credentials off the box, mapped out routes to other machines on the network, and weakened whatever local backup or recovery options it can reach, so the ransom note is closer to the last step than the main event.

  • Block ISO and IMG file attachments at the email gateway; mounting an ISO skips the "mark of the web" warning a normal .exe or .zip would trigger
  • Restrict or disable Windows Shortcut (.lnk) execution from mounted virtual drives on staff machines
  • Watch endpoint logs for MSBuild.exe launching from an unusual folder or making outbound network connections, since it has no normal reason to touch the network
  • If your EDR console shows gaps in Event Tracing for Windows data or a sudden drop in telemetry from a machine, investigate immediately rather than assuming a logging glitch

An oddly amateur build with real teeth

Researchers noted that Avalon shows signs of AI-assisted development: components bolted together with little regard for the kind of careful tradecraft that used to take real expertise to pull off. That's the uncomfortable part. None of what Avalon does requires a skilled operator to build anymore, and the presence of a working, multi-stage evasion system is no longer a reliable sign that whoever assembled it actually knows what they're doing.

The disclosure lands alongside separate research on an AI agent that ran an entire ransomware attack from start to finish against an exposed Langflow server (CVE-2025-3248), and a Telegram-controlled implant that uses a public LLM to translate plain-English attacker commands into shell code. Different tools, same direction: building and running an attack now takes less skill than defending against one.