Cybersecurity
Bronze Sandcastle used Sandboxie sideloading to deploy backdoors
Sophos said a China-aligned cluster it tracked as Bronze Sandcastle used Sandboxie DLL sideloading from August 2025 to August 2026 to place backdoors on victim systems in several countries.
- Sophos said it had identified a China-aligned threat cluster it called Bronze Sandcastle, which it described as previously undocumented.
- The researchers said the group had targeted organisations in Asia and Africa since mid-2025, with victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea between August 2025 and August 2026.
- Sophos said the cluster used Sandboxie DLL sideloading, with a legitimate Sandboxie executable loading a malicious sbiedll.dll to run attacker code.
- The payloads were stored in encrypted config.ini files and were used to enumerate accounts, collect system data, processes, keystrokes and screenshots; Sophos said versions 1.1.5 and 1.1.7 had been seen.
- Sophos said version 1.1.5 used dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control, while version 1.1.7 fetched encrypted configuration files from GitHub repositories.
Sophos said Bronze Sandcastle relied on Sandboxie sideloading as its main pattern. It said the activity had run from August 2025 to August 2026, with victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea, and with operations appearing to fit the UTC+8 time zone.
The article described DLL sideloading as a Windows loading behaviour that can be abused when a program does not point to the right library file. Zscaler said code run through a trusted or signed application can be less likely to be detected, and that elevated privileges or automatic start-up can widen the impact.
Sophos said it found legitimate Sandboxie executables in several victim environments together with a malicious sbiedll.dll. It said SandboxieWUAU.exe then loaded attacker-controlled code at runtime, and that Bronze Sandcastle had also used other sideloading combinations.
According to Sophos, the sideloaded code loaded an encrypted config.ini payload that behaved as a backdoor. The company said it could collect local accounts, system metadata, running processes, keystrokes and screenshots, and that version 1.1.7 used GitHub repositories to retrieve encrypted configuration files.
Sophos also compared the technique with an APT41 operation in July 2024, when that group used a different Sandboxie-signed executable to sideload sbiedll.dll and deliver MoonWalk. The firm said defenders should look for DLLs reading local files and then running code in memory.
Named in this story
People
- Gabor Szappanos
- the Sophos researcher quoted on the sideloading marker
Companies
- Sophos
- the security firm that published the analysis
- Zscaler
- the firm that commented on how DLL sideloading evaded detection
- GitHub
- the service used to host encrypted config files for version 1.1.7
Organisations
- Bronze Sandcastle
- the China-aligned threat cluster Sophos tracked
- APT41
- the earlier threat group cited as a comparison
Products and systems
- Windows
- the operating system whose DLL search order was abused
- Sandboxie
- the signed software whose executables were abused for sideloading
- SandboxieWUAU.exe
- the legitimate executable that loaded the malicious DLL
- sbiedll.dll
- the malicious DLL loaded at runtime
- config.ini
- the encrypted payload file used by the backdoor
- MoonWalk
- the backdoor APT41 deployed in 2024
- dc.cathaypacifice.com
- a command-and-control domain used by version 1.1.5
- net.dpworldto.com
- another command-and-control domain used by version 1.1.5
How the source tells it
The piece was a plain threat-intelligence report with no distinct emotive framing.
No emotive framing was found in the original.