Researchers Detail Avalon Malware Framework and CrownX Ransomware Capabilities
Summary
Researchers say Avalon uses a phishing-delivered ISO, shortcut and MSBuild chain to steal data, evade defenses, move laterally and deploy CrownX ransomware. The article also describes JADEPUFFER and LLM-driven Telegram malware.
Key points
- Blackpoint researchers say Avalon was delivered through a spoofed legal-document email and a password-protected archive hosted on Proton Drive.
- An ISO image contains a Windows shortcut that launches an MSBuild project; an embedded .NET assembly interferes with ETW and downloads the next-stage payload.
- Avalon can collect credentials, browser and wallet data, and other information, then exfiltrate it and receive commands from a remote server.
- The framework supports lateral movement and anti-forensic cleanup; its CrownX component can encrypt files, disrupt recovery by deleting shadow copies, and damage disk structures.
- Sysdig reported that the JADEPUFFER operator accessed an internet-facing Langflow instance through CVE-2025-3248 and used an adaptive automated campaign against a production database.
- Unit 42 described malware that relays Telegram messages to a public LLM API to convert plain-text instructions into shell commands for execution on a compromised system.
Article Details
- Event Type
- Discovery of the Avalon malware framework and reporting on AI-driven ransomware and LLM-enabled malware
- Impact
- Avalon can collect credentials and sensitive data, communicate with a remote server, support lateral movement, disrupt recovery, and deploy CrownX ransomware. Separately, Sysdig reported that JADEPUFFER exploited CVE-2025-3248 to reach a victim’s production database server and run a destructive extortion playbook. Another reported malware used Telegram for command and control and a public LLM API to translate operator instructions into shell commands.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | helloxcherry[.]com | Reported remote server used by Avalon to exfiltrate data and poll for tasking commands. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelAvalon exfiltrated collected data to a remote server; the separately reported Telegram-based malware returned command results through its C2 channel.T1059 · Command and Scripting InterpreterThe separately reported AI malware used an LLM to translate operator instructions into shell commands that were executed on the compromised system.T1070.004 · File DeletionAvalon’s anti-forensic cleanup subsystem removed artifacts to complicate incident response.T1071.001 · Web ProtocolsAvalon downloaded a next-stage payload over HTTPS and communicated with a remote server for tasking.T1102.002 · Bidirectional CommunicationThe AI malware polled a Telegram bot API for instructions and returned command results through the same channel.T1127.001 · MSBuildThe shortcut launched an MSBuild project that loaded an embedded .NET assembly.T1190 · Exploit Public-Facing ApplicationSysdig reported that JADEPUFFER gained initial access through an internet-facing Langflow instance by exploiting CVE-2025-3248.T1204.002 · Malicious FileOpening a document-themed Windows Shortcut inside the mounted ISO triggered the staged malware sequence.T1486 · Data Encrypted for ImpactThe CrownX ransomware component encrypted files associated with business operations and other work areas.T1490 · Inhibit System RecoveryAvalon inhibited recovery by terminating the Volume Shadow Copy Service and deleting shadow copies.T1555.003 · Credentials from Web BrowsersAvalon harvested credentials and browser data from Chromium-based browsers and Mozilla Firefox.T1566.001 · Spearphishing AttachmentThe Avalon infection began with a spoofed legal-document email directing recipients to a password-protected archive.
CVE
People
Michael ClarkSysdig researcher who reported details of the JADEPUFFER operation and its exploitation of CVE-2025-3248.Nevan BealBlackpoint Cyber researcher quoted describing the Avalon infection chain and its capabilities.Sam DeckerBlackpoint Cyber researcher quoted describing the Avalon infection chain and its capabilities.
Threat Actors
Malware
Products
Langflow#AvalonMSBuild.exeThe attack uses an ISO image, a shortcut file, and MSBuild to launch the payload and evade detection.TelegramThe report also describes JADEPUFFER, an agentic ransomware attack driven by an LLM, and an AI malware that uses a Telegram bot and public LLM API to convert plain-text instructions into shell commands.