- Researchers have identified a China-aligned threat cluster named Bronze Sandcastle targeting organizations in Asia and Africa since mid-2025.
- The group exclusively uses Sandboxie DLL sideloading, a technique that tricks legitimate software into executing malicious code.
- Attacks have resulted in victims across the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026.
Cybersecurity researchers at Sophos have disclosed details of a previously undocumented China-aligned threat cluster, known as Bronze Sandcastle, which has been targeting organizations in Asia and Africa since mid-2025. The group’s most distinctive technical marker, according to Sophos security researcher Gabor Szappanos, is its consistent use of Sandboxie DLL sideloading.
This technique exploits how Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL. Because the malicious code is executed by a trusted application, it is less likely to be flagged by security solutions, as Zscaler noted.
Between August 2025 and August 2026, attacks resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Sophos observed legitimate Sandboxie executables placed in victim environments alongside a malicious “sbiedll.dll” file, which forces the trusted application to load attacker-controlled code.
Bronze Sandcastle has also leveraged seven other DLL sideloading combinations, including Java, Krita, and Sysinternals utilities. Sophos stated that the sideloaded DLLs typically read and execute payloads stored in encrypted config files, minimizing static detection and allowing operators to adjust behavior without replacing binaries.
The payload functions as a backdoor designed to enumerate network accounts and collect system metadata. It has been found communicating with external sites like file[.]io and gofile[.]io, likely to receive additional tasking from its operators. Sophos advised that organizations should focus on behavioral indicators such as DLLs reading local files followed by immediate in-memory execution, which may indicate decoding and staging activity.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
