Cybersecurity

This Malware Deletes Your Backups First

A new attack kit called Avalon hunts your backup servers and deletes Windows shadow copies before its CrownX ransomware encrypts anything. It sat undetected for four months while evading nine major security tools.

CybersecurityBy Servola Tech Desk2026-07-063 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

How the attack actually arrives

On 3 July 2026, researchers Nevan Beal and Sam Decker of Blackpoint Cyber, working alongside Palo Alto Networks Unit 42, disclosed a previously undocumented modular framework they named Avalon. It does not arrive as an obvious attachment. The chain starts with a spoofed legal-document email that points the recipient to a password-protected archive hosted on Proton Drive, and the malicious code travels inside an ISO disk image rather than a file the mail gateway would scan.

Opening the image mounts it like a drive, and a document-themed Windows shortcut inside runs MSBuild, a trusted Microsoft build tool, to load an embedded piece of code that first tampers with Windows event logging and then pulls down Avalon itself. Almost all of this runs in memory, leaving little on disk. The sample was uploaded to VirusTotal on 11 March 2026 and drew zero detections for roughly four months.

It goes for the recovery layer first

What separates Avalon from routine ransomware is the order of operations. Before any encryption, the framework harvests credentials from browsers, password stores, VPN, SSH and Wi-Fi profiles, then moves laterally toward the assets that would let a company recover: domain controllers, virtualization hosts such as vCenter and Hyper-V, and backup platforms including Veeam, Acronis, NetApp and Synology. It deletes Windows shadow copies along the way.

Only after the recovery layer is neutralised does the CrownX module encrypt files with authenticated AES-GCM cryptography. The framework also carries specific routines to hide from nine named security products: Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee and Bitdefender. The uncomfortable thesis is not that another ransomware exists; it is that this one is engineered to make the standard answer, we can just restore, untrue before the encryption even starts.

What this changes for an operator

The practical lesson does not depend on which endpoint brand you run. When a kit is purpose-built to blind nine of them and to delete the backups first, detection becomes one layer rather than the guarantee, and the control that still works is a backup copy the attacker cannot reach. That means at least one immutable or offline copy that a compromised domain administrator cannot delete, and a restore you have actually tested this quarter rather than assumed.

Two details raise the stakes for European operators. Three of the nine evaded tools, Sophos, ESET and Bitdefender, are European mainstays, so a large share of the region runs exactly the products this kit was tuned against. And the researchers note signs of AI-assisted development, which lowers the skill and time a group needs to build something this layered, so more of it is coming. Under NIS2 the accountability for handling it sits with named senior management, not only the security team.

Frequently asked questions

What is Avalon and who found it?

Avalon is a modular malware framework disclosed on 3 July 2026 by Blackpoint Cyber researchers Nevan Beal and Sam Decker, working with Palo Alto Networks Unit 42. It bundles credential theft, lateral movement, backup destruction and the CrownX ransomware module into one kit, and spreads through a spoofed legal-document email that hides its payload inside an ISO image.

Will my endpoint security stop it?

Not on its own. Avalon carries specific routines to evade nine named tools, including Sophos, ESET and Bitdefender, and it ran undetected on VirusTotal for about four months. Treat detection as one layer and put the durable control on the recovery side: an immutable or offline backup the malware cannot delete.

What is the single most useful step this week?

Confirm you hold at least one backup copy that a domain administrator cannot delete, whether immutable, air-gapped or offline, and run a real restore from it. Because Avalon targets Veeam, Acronis, NetApp and Synology and wipes shadow copies before encrypting, an unreachable copy is the difference between a bad day and a shutdown.

New malware families arrive every week; this one is a warning about which control still works. When the kit deletes the backups before it encrypts, the sentence we can restore is only true if the copy sits somewhere the attacker never reaches. That copy, not the alert that never fired, decides how a Monday like this one ends.

CybersecurityAvalonCrownX ransomwareBlackpoint CyberEDR evasionNIS2

The SharePoint Patch You Skipped in May Is Now Urgent

CISA added SharePoint flaw CVE-2026-45659 to its exploited-vulnerabilities list on 1 July. Microsoft rated it unlikely to be attacked. The patch has existed since May, and under NIS2 the clock is yours.

3 min read1 views

Cybersecurity

81 Million Logins Hit Microsoft 365 in Two Weeks

A password-spray campaign threw 81 million login attempts at Microsoft 365 in two weeks and got past multi-factor authentication - not with a new exploit, but by abusing a legacy sign-in path that skips MFA.

3 min read3 views

Digital Sovereignty

Microsoft Raises 365 Prices as France and German States Walk Away

Microsoft 365 list prices rise on 1 July 2026 while France and German states move off Microsoft entirely. Why your renewal is now a sovereignty decision, and how to price the exit option.

3 min read14 views

← All articles