CYBERSECURITY researchers have disclosed a China-aligned threat cluster named Bronze Sandcastle, observed targeting organisations in Asia and Africa from mid-2025 and active through at least August 2026. Sophos notes the group’s most distinctive marker is its repeated use of Sandboxie DLL sideloading, a technique that leverages Windows’ DLL loading order to execute a malicious library under the umbrella of a legitimate, trusted application.
Bronze Sandcastle’s operations extend beyond Sandboxie, employing seven other DLL sideloading pairings, including javaw[.]exe (jli[.]dll), Krita[.]exe (Krita[.]dll), and LineAppMgr[.]exe (msvcp140[.]dll), among others. The sideloaded DLLs read and execute payloads stored in encrypted config[.]ini files, enabling in-memory activity with minimal on-disk traces.
The backdoor payloads (versions 1.1.5 and 1.1.7) enumerate local networks, harvest system metadata and processes, capture keystrokes and screenshots, and exfiltrate data via external sites (file[.]io, gofile[.]io, ably[.]net, ably[.]io), with different C2 patterns: 1.1.5 contacting dc[.]cathaypacific e .com and net.dpworldto[.]com; 1.1.7 downloading encrypted config files from GitHub and via a GitHub account that is no longer accessible. Sophos emphasizes that defenders should monitor for DLLs reading local files followed by in-memory execution as a primary behavioural indicator.