BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
74
Country
Afghanistan
- Mentions · 7d0
- Mentions · 30d4
- All mentions18
- First seenAug 15, 2026
- Last mentioned10d ago
Timeline
18 articles · newest firstBronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
72
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
72
US Air Force pilots used malware-laden USB drives to plan Afghanistan missions
Former Air Force staff say pilots used locally bought USB drives that later carried Agent.BTZ into military systems.
28
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
SideCopy used spear-phishing and mshta.exe to deploy ReverseRAT against Indian academic institutions, Trellix reports.
68
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Zscaler attributes Operation RapidRust to Pakistan-aligned APT36, targeting Indian and Afghan government and defense entities with new Rust malware and GitHub-based C2.
75
APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks
Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.
78
APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.
78
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
55
Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
72
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
Chinese Hackers Use AI Agents in Multi
China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.
72
Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.
74
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
55
Iranian cyber spies target aviation, fintech developers with new malware
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
75
New Malware 'Rover' Targets Indian Ambassador to Afghanistan
Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.
40
APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.
72
New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.
61
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2010-333389%—Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution
- CVE-2024-6387100%8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
Appears with
- NodeRabbitmalware · 5
- Transparent Tribethreat actor · 5
- PollCatmalware · 5
- APT36threat actor · 5
- Mirage Kittenthreat actor · 5
- Microsoftvendor · 4
- Kasperskyvendor · 4
- NodeRabbitproduct · 3
- Zscalervendor · 3
- PSNATCHmalware · 3
- RUSTYSHADEmalware · 3
- Nimbus Manticorethreat actor · 3
- Visual Studio Codeproduct · 3
- RUSTYMOVEmalware · 3
- UNC1549threat actor · 3
- Sophosorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.