A previously undocumented modular malware framework, Avalon, has been discovered, distributed via multi-stage phishing campaigns. Avalon integrates credential collection, lateral movement, remote access, recovery disruption, and ransomware execution into a single framework. Its sophisticated design allows it to bypass traditional security controls, posing a significant threat to targeted organizations.