"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published Tuesday.
Sophos unveils a previously undocumented China-aligned cluster
Researchers at Sophos disclosed details of a threat cluster they call Bronze Sandcastle, attributing a series of intrusions across Asia and Africa to the actor since mid-2025. Between August 2025 and August 2026, Sophos says victims were identified in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. The reporting notes Bronze Sandcastle appears most active in the UTC+8 time zone.
Sandboxie DLL sideloading: the technical pivot
The hallmark of Bronze Sandcastle is repeated use of DLL sideloading with Sandboxie binaries. DLL sideloading exploits how Windows locates DLLs when an application does not provide full paths, allowing an attacker to plant a malicious DLL that the legitimate application will load instead of the intended library.
As Zscaler explained in separate analysis, "Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions." Zscaler further noted that if the legitimate host process runs with elevated privileges, "the malicious DLL will inherit those same permissions," and that persistence can follow when the compromised application is configured to autorun.
Sophos observed legitimate Sandboxie executables placed in multiple victim environments alongside a malicious sbiedll.dll that causes SandboxieWUAU.exe to load attacker-controlled code at runtime. Renamed legitimate executables and in-memory execution patterns were used to minimize disk artifacts and evade static detection.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageOther sideloading combinations and runtime behavior
Bronze Sandcastle did not rely on Sandboxie alone. Sophos cataloged seven additional DLL sideloading pairings used by the actor:
- javaw.exe — jli.dll
- Krita.exe — Krita.dll
- NvdaHelper.exe — NvdaHelperRemote.dll
- Jcef_helper.exe — Libcef.dll
- Vmmap.exe — version.dll
- LineAppMgr.exe — msvcp140.dll
- bginfo64.exe — snmpapi.dll
The sideloaded DLLs typically read and execute payloads stored in encrypted config.ini files, a design choice Sophos says "minimizes static detection and allows operators to adjust behavior without replacing DLL binaries." Execution generally resulted in in-memory shellcode activity rather than additional files on disk.
Payloads, capabilities, and command channels
The DLLs load and execute an encrypted payload (the config.ini) that functions as a backdoor. Sophos reported that the payloads enumerate local network and user accounts and collect system metadata, running processes, keystrokes and screenshots. Two payload versions have been identified: 1.1.5 and 1.1.7.
Both versions were observed calling out to public file-sharing and delivery services such as file[.]io, gofile[.]io, ably[.]net and ably[.]io, likely to receive additional tasking. Version 1.1.5 additionally used dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control communication. Version 1.1.7 was observed using GitHub repositories via the API — specifically "github[.]com/LatonyCharnleyaW" — to download encrypted config files; the GitHub account is no longer accessible.
The Sophos write-up also places this activity in a technical lineage: it is not the first time Sandboxie binaries have been used for sideloading. In July 2024 the APT41 threat actor used a Sandboxie-signed taskhost.exe to sideload a malicious sbiedll.dll and deploy the MoonWalk backdoor.
What this means for technologists, policymakers, and affected enterprises
Technologists and security teams: Sophos recommends shifting detection emphasis away from static file signatures and toward runtime behavior. In practical terms that means watching for DLLs reading local files followed by immediate in-memory execution — indicators Sophos calls more reliable than static artifacts in this campaign.
Policymakers and regulators: The campaign’s use of public services and domains for staging and C2 — including file-sharing sites and GitHub — underlines a cross-jurisdictional challenge where legitimate platforms are coopted for malicious ends. That behavior may inform discussions about platform abuse mitigation and cooperation with responders.
Affected enterprises and procurement leaders: Bronze Sandcastle shows that attackers may rename trusted executables to blend in and exploit commonly deployed utilities such as Sandboxie and Sysinternals tools. Procurement and asset inventories that track which signed binaries are expected on endpoints will be useful for triage and response.
Sophos closed with a practical caution: "The threat group predominantly uses encrypted payload and configuration files that are decoded at runtime, meaning that static file-based detections may be ineffective." The question facing defenders is concrete — can detection and response tooling be retooled to catch decoding and staging activity in memory before the backdoor operator’s next move?
