BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
74
Threat actor
BRONZE SANDCASTLE
- Mentions · 7d0
- Mentions · 30d3
- All mentions3
- First seenOct 21, 2026
- Last mentioned9d ago
Timeline
3 articles · newest firstBronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
72
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
72
Appears with
- Sophosorganization · 3
- Sandboxieproduct · 3
- Kritaproduct · 1
- NVDAproduct · 1
- LINEproduct · 1
- Windowsproduct · 1
- COFFLoadermalware · 1
- Sysinternalsproduct · 1
- Javaproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.