New Avalon Malware Framework Packs CrownX Ransomware Capabilities

Blackpoint says Avalon uses Proton Drive, ISO images, LNK files, and MSBuild to disable ETW, steal credentials, and deploy CrownX ransomware.

Raccontata dathehackernews.com