Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025.
“The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,” Sophos security researcher Gabor Szappanos said in a post published Tuesday.
Between August 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone.
DLL sideloading is a popular adversarial technique that exploits the way Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL.
When an application is launched, it needs to load various DLLs in order to function correctly. If the application does not provide the full path to a required DLL, the operating system looks for it in a predetermined sequence of directories.
An attacker can take advantage of this behavior by planting a malicious DLL with the same name as a legitimate one in a location that Windows searches before the folder that contains the actual DLL. Thus, when the legitimate application starts, it proceeds to load and run the malicious DLL, giving the attacker a way in to the system.
“Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions,” Zscaler noted in an analysis last week.
“If the legitimate application runs with elevated privileges, the malicious DLL will inherit those same permissions, allowing the attacker to perform more sensitive actions on the system.”
What’s more, the technique enables persistence if the compromised application is configured to automatically run every time a system is rebooted, thereby allowing the attacker’s code to execute on the infected host.
Sophos said it observed legitimate Sandboxie executables placed in multiple victim environments, along with a malicious “sbiedll.dll” file, which, in turn, causes the trusted application (“SandboxieWUAU.exe”) to load attacker-controlled code during runtime.
Besides Sandboxie, Bronze Sandcastle has been leveraged in seven other DLL sideloading combinations –
- javaw.exe (Java application) – jli.dll
- Krita.exe (Krita digital painting) – Krita.dll
- NvdaHelper.exe (NVDA NonVisual Desktop Access) – NvdaHelperRemote.dll
- Jcef_helper.exe (Java Chromium Embedded Framework Helper) – Libcef.dll
- Vmmap.exe (Sysinternals process memory analyzer) – version.dll
- LineAppMgr.exe (LINE messaging application) – msvcp140.dll
- bginfo64.exe (Sysinternals utility that displays system information) – snmpapi.dll
“The sideloaded DLLs typically read and execute payloads stored in encrypted config.ini files,” Sophos said. “This design minimizes static detection and allows operators to adjust behavior without replacing DLL binaries. Renamed legitimate executables are frequently used to blend into victims’ environments, with execution resulting in in-memory shellcode activity rather than additional disk artifacts.”
The DLL is designed to load and execute an encrypted payload (“config.ini”), which functions as a backdoor designed to enumerate local network and user accounts, as well as collect system metadata, running processes, keystrokes, and screenshots. Two different versions of the payload have been identified to date: 1.1.5 and 1.1.7.
The payload has also been found to communicate with external sites (e.g., file[.]io, gofile[.]io, ably[.]net, and ably[.]io), likely in an attempt to receive additional tasking from its operators. In addition, version 1.1.5 has been observed using dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control (C2).
Version 1.1.7 payloads, on the other hand, have been observed communicating with GitHub repositories (“github[.]com/LatonyCharnleyaW”) via the API to download encrypted config files. The GitHub account is no longer accessible.
This is not the first time Chinese hacking groups have relied on DLL sideloading, nor is it the first time Sandboxie has been employed in such attacks. In July 2024, the APT41 threat actor leveraged a different executable signed by Sandboxie (“taskhost.exe”) to sideload a malicious version of “sbiedll.dll” to deploy a backdoor called MoonWalk ultimately.
“The threat group predominantly uses encrypted payload and configuration files that are decoded at runtime, meaning that static file-based detections may be ineffective,” Sophos said. “Organizations should instead focus on behavioral indicators such as DLLs reading local files followed by immediate in-memory execution, which may indicate decoding and staging activity.”
