New Avalon Malware Framework Packs CrownX Ransomware Capabilities

**Avalon/CrownX**: Researchers disclosed Avalon, a modular malware framework delivered via multi-stage phishing (passworded Proton Drive ISO → .lnk → MSBuild → embedded .NET) that harvests credentials, exfiltrates data to a C2, disables recovery (VSS deletion), evades numerous EDR/AV products, and culminates in the CrownX ransomware that can encrypt and damage disk structures; the report also highlights AI-driven threats including the agentic LLM ransomware JADEPUFFER and a Telegram+LLM codeless implant.