cyber.hendryadrian.com
Threat Research · thehackernews.com

Bronze Sandcastle Uses Sandboxie DLL Sideloading to Deploy Backdoors

· Original article ↗

Summary

Sophos researchers describe Bronze Sandcastle, a China-aligned cluster targeting organizations in Asia and Africa since mid-2025, using Sandboxie DLL sideloading to run encrypted backdoors and collect system and user data.

Key points

  • Sophos observed victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026.
  • The cluster places a malicious sbiedll.dll alongside legitimate Sandboxie executables, causing SandboxieWUAU.exe to load attacker-controlled code.
  • The sideloaded DLLs typically execute payloads stored in encrypted config.ini files; researchers identified versions 1.1.5 and 1.1.7.
  • The backdoor can enumerate local networks and user accounts and collect system metadata, running processes, keystrokes, and screenshots.
  • Version 1.1.5 used external services and reported C2 domains including dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com; version 1.1.7 used a GitHub repository to download encrypted configuration files.
  • Sophos recommends prioritizing behavioral indicators, such as DLLs reading local files followed by immediate in-memory execution, because encrypted payloads may evade static file-based detection.

Article Details

Attack Vectors
  • Bronze Sandcastle sideloaded a malicious sbiedll.dll through legitimate Sandboxie executables, including SandboxieWUAU.exe, to run attacker-controlled code.
  • The sideloaded DLL read and executed encrypted payloads stored in config.ini files; renamed legitimate executables were also used, with execution leading to in-memory shellcode activity.
  • Version 1.1.7 payloads used the GitHub API to download encrypted configuration files from a repository associated with LatonyCharnleyaW.
Defensive Notes
  • Sophos recommends focusing on behavioral indicators, including DLLs reading local files followed by immediate in-memory execution, which may indicate decoding and staging.
  • Sophos noted that encrypted payloads and configuration files decoded at runtime may make static, file-based detections ineffective.

Indicators of compromise

TypeIndicatorContext
DOMAINdc[.]cathaypacifice[.]comReported command-and-control domain used by Bronze Sandcastle's version 1.1.5 payload.
DOMAINnet[.]dpworldto[.]comReported command-and-control domain used by Bronze Sandcastle's version 1.1.5 payload.

MITRE ATT&CK

T1016 · System Network Configuration DiscoveryThe backdoor enumerated the local network.T1027 · Obfuscated Files or InformationThe sideloaded DLL read encrypted payloads and configuration files that were decoded at runtime.T1056.001 · KeyloggingThe backdoor collected keystrokes.T1057 · Process DiscoveryThe backdoor collected information about running processes.T1087 · Account DiscoveryThe backdoor enumerated user accounts.T1105 · Ingress Tool TransferVersion 1.1.7 payloads downloaded encrypted configuration files from a GitHub repository via the API.T1113 · Screen CaptureThe backdoor collected screenshots.T1574.001 · DLLThe actor placed a malicious sbiedll.dll alongside legitimate Sandboxie executables so the trusted executable would load it.

People

Gabor SzappanosSophos security researcher who described Sandboxie DLL sideloading as a distinctive technical marker for Bronze Sandcastle.

Threat Actors

BRONZE SANDCASTLEChina-aligned threat cluster reported targeting organizations in Asia and Africa since mid-2025.SPIRE CASTLEReportedly used a different Sandboxie-signed executable to sideload a malicious sbiedll.dll and deploy MoonWalk in July 2024.

Malware

MoonWalkSandboxie ("taskhost.exe") to sideload a malicious version of "sbiedll.dll" to deploy a backdoor called MoonWalk ultimately.

Products

Sandboxie"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published Tuesday.

Countries

AfghanistanAugust 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8Namibiaattacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.PhilippinesAugust 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle isSouth Koreathe threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.Taiwan2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active

Related Articles