SOPHOS Counter Threat Unit and SophosLabs have tracked BRONZE SANDCASTLE across victims in Asia and Africa from August 2025 to August 2026. The group’s hallmark technique is Sandboxie DLL sideloading, where a legitimate Sandboxie program is placed beside a malicious DLL so that when the trusted process starts, it loads the attacker’s code into memory.
The operators also abuse other trusted tools such as Java, Krita, NVDA, Sysinternals utilities and LINE, often renaming these files to blend into the victim’s network. The campaign centres on a custom Meterpreter‑style backdoor (versions 1.1.5 and 1.1.7), described by Sophos as a non‑standard loader that runs in memory, with code borrowed from the COFFLoader project to support add‑ons.
Infection and operation hinge on an encrypted config[.]ini that the payload decodes at runtime, allowing operators to change behaviour without swapping the DLL. The payload acts as a reflective loader, executing the backdoor in memory. Command‑and‑control data includes a JSON host/profile sent to the C2, detailing host name, user, domain, IPs, OS version and running processes; some samples contact lookalike domains or external services for tasking.
Version 1.1.7 is noted for downloading encrypted config files from a GitHub repository. Within networks, attackers map users and hosts with Windows net commands and create shadow copies to access ntds[.]dit, the Active Directory credential database. Attribution remains suspected but unconfirmed, with activity peaking during UTC+8 working hours, aligning with China’s 996 schedule.
Defence guidance emphasises memory‑centric monitoring, looking for a DLL reading a local file and immediately running code, unusual Sandboxie activity, odd PE headers and shadow copy access to ntds[.]dit.