Bronze Sandcastle sideloads Sandboxie DLLs to deploy backdoors
Original title: China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
Sophos described Bronze Sandcastle, a previously undocumented China-aligned cluster active since mid-2025 and most active in the UTC+8 time zone. Operators place legitimate Sandboxie executables beside a malicious sbiedll.dll so SandboxieWUAU.exe loads attacker code, and they use at least seven other sideloading pairs. The DLL runs an encrypted config.ini backdoor, seen in versions 1.1.5 and 1.1.7, that collects accounts, processes, metadata, keystrokes, and screenshots and contacts external sites for tasking.
Unconfirmed: South Korea is described as a likely victim location, and China alignment is Sophos’s assessment.
- Named victim locations include the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea.
- Other abused binaries include javaw.exe, Krita.exe, bginfo64.exe, and LineAppMgr.exe.
- Version 1.1.5 used dc.cathaypacifice.com and net.dpworldto.com for command and control.
- Version 1.1.7 pulled encrypted configs from a GitHub account that is no longer accessible.
- Payloads run in memory, so Sophos says static file detections may miss them.
Impact: Backdoor collects accounts, keystrokes, screenshots, and system data
- 1.Look for legitimate or renamed binaries loading a local DLL that then reads a file and executes in memory.
- Products
- Sandboxie
- Threat actors
- Bronze Sandcastle
- Organizations
- Sophos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ably.io | ternal sites (e.g., file[.]io, gofile[.]io, ably[.]net, and ably[.]io), likely in an attempt to receive additional tasking from |
| domain | ably.net | municate with external sites (e.g., file[.]io, gofile[.]io, ably[.]net, and ably[.]io), likely in an attempt to receive addition |
| domain | cathaypacifice.com | tors. In addition, version 1.1.5 has been observed using dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control (C2). Ver |
| domain | dpworldto.com | 1.5 has been observed using dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control (C2). Version 1.1.7 payloads, on |
| domain | file.io | s also been found to communicate with external sites (e.g., file[.]io, gofile[.]io, ably[.]net, and ably[.]io), likely in an at |
| domain | gofile.io | found to communicate with external sites (e.g., file[.]io, gofile[.]io, ably[.]net, and ably[.]io), likely in an attempt to rece |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gabor Szappanos said in a post published
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.