China-aligned Bronze Sandcastle abuses Sandboxie DLL sideloading to plant backdoors

Sophos has disclosed a previously undocumented China-aligned threat cluster it calls Bronze Sandcastle, which abuses DLL sideloading through the Sandboxie sandboxing tool and other legitimate applications to deploy backdoors against organizations in Asia and Africa, The Hacker News reported on October 21. According to Sophos researcher Gabor Szappanos, the group has been active since mid-2025 and hid its malware behind trusted, sometimes digitally signed executables to avoid antivirus detection.

What happened

The Hacker News reports that Sophos identified Bronze Sandcastle victims between August 2025 and August 2026 in the Philippines, Taiwan, Afghanistan, Namibia and, likely, South Korea. The operators were most active in the UTC+8 time zone. Sophos did not attribute the activity to a known group, though the article notes that APT41 used a similar Sandboxie-based technique in July 2024 to deploy its MoonWalk backdoor.

Technical details

DLL sideloading (MITRE ATT&CK T1574.001) involves planting a malicious DLL under a name that a legitimate application expects to load. Sophos describes Sandboxie sideloading as the group's "most distinctive technical marker": legitimate Sandboxie files were found alongside a malicious sbiedll.dll, causing the trusted SandboxieWUAU.exe to run attacker code.

The researchers also observed seven other application and DLL pairs, including javaw.exe with jli.dll, Krita.exe with Krita.dll, NvdaHelper.exe with NvdaHelperRemote.dll, Vmmap.exe with version.dll and bginfo64.exe with snmpapi.dll. In each case the sideloaded DLL reads an encrypted config.ini file and executes its payload in memory, which makes static detection harder and lets operators change behavior without replacing the DLL.

The resulting backdoor, observed in versions 1.1.5 and 1.1.7, enumerates network and user accounts, collects system information and running processes, and captures keystrokes and screenshots. According to the report, version 1.1.5 used the command-and-control domains dc.cathaypacifice[.]com and net.dpworldto[.]com, while version 1.1.7 downloaded encrypted configuration files via the GitHub API from an account that is no longer accessible. The malware also contacted file-sharing and messaging services such as file[.]io, gofile[.]io and ably[.]io, likely for tasking.

Who is affected

The campaign targets organizations in Asia and Africa. Because the technique relies on widely used legitimate software, security teams elsewhere can use the same indicators to hunt for similar sideloading activity.

What to do

• Sophos recommends prioritizing behavioral indicators over static file signatures, since payloads and configurations are decoded at runtime.
• Watch for a DLL that reads a local file and immediately executes code in memory, which may indicate decoding and staging.
• Look for legitimate executables such as SandboxieWUAU.exe running from unusual directories alongside unexpected DLLs or config.ini files.
• Block and search logs for the domains listed above.