BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Original title: BRONZE SANDCASTLE Hackers Steal Active Directory Database Using Hidden Windows Backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
Sophos describes BRONZE SANDCASTLE, a suspected China-based group, using DLL sideloading through legitimate programs including Sandboxie, Java, Krita, NVDA, LINE, and Sysinternals tools to run an in-memory backdoor. After access, operators enumerated accounts, created Volume Shadow Copies with vssadmin.exe, and copied ntds.dit. Backdoor versions 1.1.5 and 1.1.7 sent host and user details to attacker infrastructure, including lookalike domains and GitHub content tied to LatonyCharnleyaW. Researchers say the tooling is distinct and do not attribute it to BRONZE PRESIDENT or BRONZE ATLAS.
Unconfirmed: China-based attribution is an assessment from working hours and tooling, not a confirmed link to another named group.
- The strongest signature is Sandboxie executables loading attacker-controlled sbiedll.dll.
- Payloads are flattened with a virtualized state machine and a reflective in-memory loader.
- Version 1.1.5 contacted dc.cathaypacifice.com and net.dpworldto.com.
- Activity clustered in UTC+8 working hours, which supports the China-based assessment.
- Code overlap with COFFLoader does not establish Cobalt Strike use.
Impact: theft of the Active Directory database ntds.dit
- 1.Hunt for trusted binaries loading DLLs from unusual directories, then unexpected shadow copies and ntds.dit access.
- 2.Use application control and module-load telemetry to catch sideloaded libraries.
- Threat actors
- BRONZE SANDCASTLE
- Malware
- COFFLoader
- Organizations
- Sophos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ably.io | rved connections to file[.]io, gofile[.]io, ably[.]net, and ably[.]io, potentially for command-and-control tasking. Version 1.1 |
| domain | ably.net | rchers also observed connections to file[.]io, gofile[.]io, ably[.]net, and ably[.]io, potentially for command-and-control taski |
| domain | dc.cathaypacifice.com | eyaW GitHub repo (Source : Sophos). Version 1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Researchers also observed co |
| domain | file.io | .]dpworldto[.]com. Researchers also observed connections to file[.]io, gofile[.]io, ably[.]net, and ably[.]io, potentially for |
| domain | gofile.io | [.]com. Researchers also observed connections to file[.]io, gofile[.]io, ably[.]net, and ably[.]io, potentially for command-and-c |
| domain | net.dpworldto.com | hos). Version 1.1.5 contacted dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com. Researchers also observed connections to file[.]io, go |
From the original article
3 min read at gbhackers.com
BRONZE SANDCASTLE intrusions involving hidden Windows backdoors and the theft of the Active Directory database. The suspected China-based group combines legitimate applications, malicious DLLs, and encrypted payloads to execute code inside trusted processes while limiting artifacts available to conventional file scanning.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.