BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
74
- Mentions · 7d0
- Mentions · 30d1
- All mentions1
- First seenOct 21, 2026
- Last mentioned9d ago
Timeline
1 articles · newest firstAppears with
- Sysinternalsproduct · 1
- Sandboxieproduct · 1
- Sophosorganization · 1
- BRONZE SANDCASTLEthreat actor · 1
- LINEproduct · 1
- Javaproduct · 1
- Kritaproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.