New Malware Framework, Avalon, Exposed: A Threat to Cybersecurity
A recently identified malware framework, dubbed Avalon, represents a significant development in the landscape of cyber threats. This framework employs a deceptive tactic involving a spoofed legal document to entice potential victims, packaging its malicious payload within a multi-stage, fileless chain. At the heart of Avalon is a ransomware component referred to as CrownX.
Avalon’s emergence illustrates a concerning trend in cybersecurity: the consolidation of diverse offensive capabilities into a single, more potent framework. This integration not only streamlines the malware’s operations but also underscores how advancements in development practices, possibly aided by artificial intelligence, are enabling cybercriminals to deploy increasingly sophisticated toolsets with relative ease.
One of the framework’s notable features is its strategy to obfuscate the malware from detection. By hosting the payload externally, the attackers effectively minimized opportunities for email inspection by mail gateways. Victims received a convincingly themed email that directed them to a password-protected archive stored on Proton Drive, diverting attention from the actual malware. The archive contained an ISO image that, once mounted, displayed a shortcut mimicking a legitimate document along with a fake "Mimecast Secure File Logs" folder. This deliberate design reinforced the illusion of a secure document while the real threat lay hidden in an MSBuild project file disguised with a .tmp extension.
The sophistication of Avalon extends beyond its deceptive appearance. The malware utilizes a robust in-memory loader that incorporates multiple telemetry-evasion techniques. It effectively resolves and patches ETW (Event Tracing for Windows) entry points and manipulates AMSI (Antimalware Scan Interface) flows to ensure that security products either report false success or are completely bypassed.
The managed downloader included within Avalon exhibits advanced functionality as well. It employs a permissive certificate callback along with a browser-like User-Agent and custom request headers to pull down an encrypted remote payload. To enhance its evasiveness, the response is subjected to HMAC-SHA256-based keyed validation and requires an offset-driven keystream for decryption, making it resistant to passive analysis.
Upon execution, the loader manually maps the decrypted payload into the process memory, effectively resolving imports, applying relocations, and registering exception tables. This intricate process ensures that the final native binary operates without creating a new process or residual files on disk, thereby complicating forensic investigation efforts.
The mechanics of Avalon also allow it to act as a comprehensive orchestration framework, consolidating various functionalities including credential harvesting, persistence, lateral movement, anti-forensics, recovery disruption, and extortion into one integrated package. Specifically, Avalon’s operations include a stealthy harvesting of browser data—which encompasses credentials stored in Chromium and Firefox, crypto wallets, messaging tokens, VPN, SSH keys, and Windows credential material via DPAPI calls.
Further enhancing its capability to wreak havoc, Avalon employs operational methods that target backup infrastructures such as Veeam, Acronis, and even Hyper-V. The ransomware component, CrownX, displays an alarming mix of resilience and destructive potential. It implements strong cryptographic measures using Windows CNG and AES-GCM and utilizes file mapping for swift bulk encryption, all while supporting transactional file operations that allow modification of files on the go.
In terms of recovery neutralization, CrownX takes aggressive measures to hinder restoration efforts by stopping and deleting VSS snapshots and corrupting recovery artifacts. This strategy is bolstered by a comprehensive anti-forensics subsystem designed to obliterate evidence from visibility.
The operational significance of Avalon lies not only in its integration of various malicious capabilities but also in its accessibility, allowing even less experienced threat actors to orchestrate devastating campaigns. The framework’s evolution seems to reflect a rapid assembly process, likely facilitated by advanced assisting tools, leading to an urgent need for robust cybersecurity measures and greater awareness among potential targets.
Indicators of Compromise (IoCs)
Identifying and mitigating threats posed by Avalon requires vigilance and understanding of specific indicators of compromise. Examples include:
- ISO Image:
Secure_Document_CA-283505_pdf.iso– Containing the fake PDF shortcut and MSBuild project. - Shortcut:
Secure Document CA-283505.pdf.lnk– Launchedcmd.exe, cloaked under a Microsoft Edge icon. - MSBuild Project:
Mimecast Secure File Logs\zfighv.tmp– A malicious XML project from the ISO. - Staging Domain:
helloxcherry[.]com– The remote domain contacted by the managed loader.
By maintaining awareness of these identifiers and enhancing security measures, organizations can strive to safeguard their networks from the growing threat of frameworks like Avalon. As cybercriminals continue to innovate and evolve, proactive responses will be crucial in combatting these sophisticated threats.