BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Original title: China-Linked Hackers Turn Trusted Windows Applications Into Backdoors to Steal Credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
Sophos’ Counter Threat Unit says China-linked BRONZE SANDCASTLE places malicious libraries beside legitimate Windows programs so those programs load attacker code. Abused components include Sandboxie, Java, Krita, NVDA, LINE, and Microsoft Sysinternals. A custom reflective backdoor, versions 1.1.5 and 1.1.7, reports host details to operators, who then created Volume Shadow Copies and copied the Active Directory database. Sophos tracks the group separately from BRONZE PRESIDENT and BRONZE ATLAS.
Unconfirmed: Sophos says the activity could not be reliably linked to BRONZE PRESIDENT or BRONZE ATLAS, and did not confirm a command role for legitimate file-sharing services.
- Victims were in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.
- Payload 1.1.5 used dedicated control domains; 1.1.7 pulled encrypted configuration from GitHub.
- Operators ran Windows network commands, then used vssadmin and copied ntds.dit.
- Sophos did not confirm that file-sharing and messaging services carried operator instructions.
Impact: Remote access and theft of Active Directory credential data
- 1.Detect libraries that read local files and immediately execute code in memory.
- 2.Watch for reflective loading and the published sideloading pairs and control domains.
- 3.Look for vssadmin snapshot creation and copies of ntds.dit.
- Threat actors
- BRONZE SANDCASTLE
- Organizations
- Sophos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ably.io | Legitimate services file[.]io ; gofile[.]io ; ably[.]net ; ably[.]io ; github[.]com Observed connections GitHub location hxxps |
| domain | ably.net | 5 connections Legitimate services file[.]io ; gofile[.]io ; ably[.]net ; ably[.]io ; github[.]com Observed connections GitHub lo |
| domain | api.github.com | ; github[.]com Observed connections GitHub location hxxps://api[.]github[.]com/repos/LatonyCharnleyaW Configuration retrieval Sandboxi |
| domain | dc.cathaypacifice.com | compromise (IoCs):- Type Indicator Context Control domains dc[.]cathaypacifice[.]com ; net[.]dpworldto[.]com Version 1.1.5 connections Legit |
| domain | file.io | worldto[.]com Version 1.1.5 connections Legitimate services file[.]io ; gofile[.]io ; ably[.]net ; ably[.]io ; github[.]com Obs |
| domain | gofile.io | m Version 1.1.5 connections Legitimate services file[.]io ; gofile[.]io ; ably[.]net ; ably[.]io ; github[.]com Observed connecti |
| domain | net.dpworldto.com | dicator Context Control domains dc[.]cathaypacifice[.]com ; net[.]dpworldto[.]com Version 1.1.5 connections Legitimate services file[.]io |
| url | https://api.github.com/repos/LatonyCharnleyaW | ly[.]io ; github[.]com Observed connections GitHub location hxxps://api[.]github[.]com/repos/LatonyCharnleyaW Configuration retrieval Sandboxie pairs SandboxieWUAU.e |
From the original article
3 min read at cybersecuritynews.com
China-linked hackers are using trusted Windows applications to load hidden backdoors, collect system details, and steal Active Directory credential data. The group, tracked as BRONZE SANDCASTLE, places malicious files beside legitimate software, allowing familiar programs to run attacker-controlled code without changing the original application. The campaign shows how genuine software can become part of an […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.