New Modular Malware Framework "Avalon" Unveiled in Sophisticated Phishing Attack Cybersecurity researchers have identified a previously unknown modular malware framework, Avalon, distributed via a multi-stage phishing campaign designed to evade traditional security controls. The framework integrates credential theft, lateral movement, remote access, recovery disruption, and ransomware execution with its ransomware component internally dubbed CrownX. The attack begins with a spoofed legal document email directing recipients to a password-protected archive hosted on Proton Drive. Instead of attaching malicious files directly, attackers embedded them within an ISO image, reducing detection at the email layer. When a victim interacts with a document-themed Windows shortcut (Secure Document CA-283505.pdf.lnk) inside the mounted image, it triggers a sequence that deploys Avalon. The shortcut executes an MSBuild project within the ISO, which loads an embedded .NET assembly to disable Event Tracing for Windows (ETW), obscuring forensic visibility. The malware then downloads a next-stage payload over HTTPS to deploy Avalon, which includes an extensive defense evasion subsystem targeting security tools from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. Avalon’s capabilities include: - Credential harvesting from Chromium-based browsers, Firefox, cryptocurrency wallets (MetaMask, Coinbase Wallet, Exodus, etc.), and apps like Discord, Slack, and Teams. - Data exfiltration to a remote server (helloxcherry[.]com) and command polling for further instructions. - Reconnaissance to prioritize high-value systems for lateral movement. - Ransomware execution using Windows Cryptography API, encrypting files tied to business operations, software development, and virtual infrastructure. - Recovery disruption by terminating the Volume Shadow Copy Service and deleting shadow copies. - Anti-forensic measures, including direct disk manipulation to corrupt partition data or boot records. Researchers note that CrownX represents only the final extortion stage by the time the ransom note appears, the framework has already stolen credentials, established C2 communications, and weakened recovery options. The malware also exhibits signs of AI-assisted development, suggesting lower barriers to entry for threat actors with limited technical expertise. ### AI-Driven Ransomware and Codeless Attacks Emerge In related developments, Sysdig reported the first publicly documented agentic ransomware attack powered by a large language model (LLM). The threat actor, JADEPUFFER, exploited CVE-2025-3248 to gain access to an exposed Langflow instance, executing an automated campaign that adapted in real-time to pivot toward a production database server for extortion. Separately, Palo Alto Networks Unit 42 uncovered an AI-powered malware combining a Telegram bot with a public LLM API (api.groq[.]com) to enable codeless attacks. The malware forwards system details to the attacker’s Telegram bot, then polls the API every five seconds to translate natural language instructions into shell commands eliminating the need for command-line expertise. The sample, uploaded to VirusTotal in March 2026, remains undetected by all engines.

HoneyMyte Threat Group Enhances Cyber Espionage Arsenal with Advanced Malware The HoneyMyte threat group also tracked as Mustang Panda or Bronze President has intensified its cyber espionage campaigns, targeting government organizations across Asia and Europe with upgraded malware tools. Recent research reveals the group’s focus on Southeast Asia, where it has refined its tactics to extract sensitive data from compromised systems. In 2025, security analysts identified significant enhancements to CoolClient, HoneyMyte’s primary backdoor malware. The group has expanded its toolset with new variants of the malware, leveraging DLL sideloading a technique that abuses legitimate software (including BitDefender, VLC Media Player, and Sangfor) to execute malicious payloads. Campaigns have been detected in Myanmar, Mongolia, Malaysia, Russia, and Pakistan, with government agencies as the primary targets. Beyond CoolClient, HoneyMyte has deployed specialized browser credential stealers to harvest login data from popular browsers. Three variants have been observed: - Variant A: Targets Google Chrome - Variant B: Focuses on Microsoft Edge - Variant C: Supports Chromium-based browsers (Brave, Opera) The malware extracts encrypted credentials by copying browser databases, decrypting them using Windows Data Protection API, and exfiltrating the data to attacker-controlled servers. Additional capabilities, such as keylogging and clipboard monitoring, suggest a shift toward active surveillance beyond traditional espionage. HoneyMyte’s evolving tactics underscore its persistence in refining tools for data theft and system compromise, posing a continued threat to high-value targets in the region.