CrownX Ransomware Embedded Inside Avalon Framework Targets Recovery and Backup Systems

A technical report on the Avalon malware framework and its CrownX ransomware module that used staged ISO-based phishing to deliver an MSBuild in-memory loader, harvest credentials, and prioritize backup and virtualization systems for lateral movement and extortion. CrownX employed strong cryptography for file encryption, actively disrupted recovery mechanisms (VSS, WinRE, shadow copies), included anti-forensic and disk-corruption capabilities, and the report provides multiple IoCs (filenames, staging domain/URL, custom HTTP header, encrypted file extension, and a bitcoin address).