
BRONZE SANDCASTLE sideloads trusted Windows apps to steal AD credentials
Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.
1
2 stories, newest first · one card per story

Sophos observed the activity from August 2025 through August 2026 across Asia and Africa, including likely South Korea.

Sophos says the China-aligned cluster hit organizations in Asia and Africa from mid-2025 using encrypted config.ini payloads.
Today 621 readers · 750 views · 570 reads · all time 158K views