BRONZE SANDCASTLE Uses DLL Sideloading to Deploy Modified Meterpreter-Based Payloads
Summary
Sophos researchers detail BRONZE SANDCASTLE’s DLL sideloading, obfuscated in-memory backdoor, C2 behavior, and credential-theft activity across victims in Asia and Africa. They recommend behavioral, endpoint, and memory-based detection.
Key points
- The group commonly places malicious DLLs beside legitimate executables, including Sandboxie programs, to sideload attacker-controlled code.
- The DLLs decrypt payloads from config.ini files and execute them in memory; control-flow obfuscation complicates static analysis.
- Researchers found two payload versions, 1.1.5 and 1.1.7, with reflective loading and features resembling COFFLoader and stageless Metasploit shellcode, but not a standard Metasploit artifact.
- Payloads collect host and process details and communicate with C2 infrastructure; version 1.1.7 was also observed retrieving encrypted configuration files from GitHub.
- After installation, operators enumerated networks and accounts and created Volume Shadow copies before copying the Active Directory ntds.dit database.
- Sophos observed incidents from August 2025 to August 2026 affecting victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea; attribution to other similarly targeting groups was not reliable.
- Sophos recommends behavioral, endpoint, and memory-based monitoring for DLLs followed by in-memory execution, reflective loading, and anomalous PE headers.
Article Details
- Attack Vectors
- BRONZE SANDCASTLE placed legitimate executables alongside malicious DLLs, which the executables loaded through DLL sideloading.
- Sideloaded DLLs read and executed payloads stored in encrypted config.ini files, resulting in in-memory shellcode activity.
- Version 1.1.7 payloads were observed communicating with GitHub repositories to download encrypted configuration files.
- After installation, operators used Windows net commands for local network and account enumeration, then created Volume Shadow copies with vssadmin.exe before copying ntds.dit.
- Defensive Notes
- Monitor DLLs reading local files followed by immediate in-memory execution, reflective loading patterns, anomalous PE headers in memory, and processes exhibiting position-independent shellcode execution.
- Use endpoint telemetry and memory-based detection; static file-based detections may be ineffective because payloads and configuration files are encrypted and decoded at runtime.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dc[.]cathaypacifice[.]com | C2 server contacted by version 1.1.5 payloads. |
| DOMAIN | net[.]dpworldto[.]com | C2 server contacted by version 1.1.5 payloads. |
| URL | hxxps[:]//api[.]github[.]com/repos/LatonyCharnleyaW | Specific GitHub repository URL used by version 1.1.7 payloads to communicate and download encrypted configuration files. |
MITRE ATT&CK
T1003.003 · NTDSOperators created Volume Shadow copies with vssadmin.exe before copying the Active Directory ntds.dit database.T1016 · System Network Configuration DiscoveryThe payload collected internal and public IP addresses in its host-information JSON object.T1027 · Obfuscated Files or InformationPayloads and configuration files were encrypted and decoded at runtime; the malicious DLL also used control-flow obfuscation.T1057 · Process DiscoveryThe payload collected process listings and metadata, including process IDs and names.T1059.003 · Windows Command ShellOperators executed Windows net commands to enumerate local networks and user accounts.T1082 · System Information DiscoveryThe payload collected the operating system version in its host-information JSON object.T1574.002 · DLL Side-LoadingThe group placed malicious DLLs alongside legitimate executables, including Sandboxie executables, to have the executables load attacker-controlled code.T1620 · Reflective Code LoadingThe payload used a reflective loader and executed position-independent code in memory.
People
Threat Actors
Malware
Vendors
Products
GitHuband net[.]dpworldto[.]com. Version 1.1.7 payloads have also been observed communicating with github[.]com repositories to download encrypted config files (see Figure 7).Metasploit Frameworkexhibits structural similarities to stageless shellcode payloads such as those generated by the Metasploit Framework (MSF), including position-independent execution, manual PE validation, and in-memory loading of anMicrosoft WindowsThe decrypted payload is a backdoor program. Once loaded and decoded by the DLL, config.ini superficially resembles a Windows executable in memory (see Figure 3).Sandboxiethreat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading.
Tools
Countries
AfghanistanCTU analysis of incidents between August 2025 and August 2026 revealed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely also the Republic of Korea (see Figure 10).NamibiaCTU analysis of incidents between August 2025 and August 2026 revealed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely also the Republic of Korea (see Figure 10).PhilippinesCTU analysis of incidents between August 2025 and August 2026 revealed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely also the Republic of Korea (see Figure 10).South KoreaCTU analysis of incidents between August 2025 and August 2026 revealed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely also the Republic of Korea (see Figure 10).TaiwanCTU analysis of incidents between August 2025 and August 2026 revealed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely also the Republic of Korea (see Figure 10).