Bronze Sandcastle Uses Sandboxie DLL Sideloading to Deploy Backdoors Across Asia and Africa

Cybersecurity researchers have uncovered a previously undocumented China-aligned threat cluster, tracked as Bronze Sandcastle, that has targeted organizations across Asia and Africa since mid-2025. The group relies on DLL sideloading through legitimate Windows applications to execute malicious code, deploy backdoors, and collect sensitive information from compromised systems.

According to Sophos security researcher Gabor Szappanos, the group's most distinctive technical characteristic is its consistent abuse of Sandboxie DLL sideloading.

Between August 2025 and August 2026, attacks attributed to Bronze Sandcastle affected organizations in the Philippines, Taiwan, Afghanistan, and Namibia, with a possible victim in South Korea. Activity patterns suggest that the operators are most active in the UTC+8 time zone.

Sandboxie DLL Sideloading as the Primary Attack Method

DLL sideloading is a technique in which attackers exploit the way Windows searches for and loads Dynamic Link Libraries (DLLs). By placing a malicious DLL where a legitimate application expects to find a library, attackers can cause the application to execute their code.

Because the malicious library is loaded by a trusted application, the activity may appear legitimate and evade some security controls. If the application runs with elevated privileges, the malicious code may also gain access to those permissions. Applications configured to launch automatically can provide an additional route for maintaining persistence.

Sophos observed legitimate Sandboxie executables in multiple victim environments alongside a malicious DLL named sbiedll.dll. When the trusted SandboxieWUAU.exe executable runs, it loads the attacker-controlled library, enabling malicious code execution within the application process.

Seven Additional DLL Sideloading Combinations Identified

Beyond Sandboxie, Bronze Sandcastle has reportedly used seven other executable and DLL combinations to execute its payloads.

Legitimate executableDLL abusedjavaw.exejli.dllKrita.exeKrita.dllNvdaHelper.exeNvdaHelperRemote.dllJcef_helper.exeLibcef.dllVmmap.exeversion.dllLineAppMgr.exemsvcp140.dllbginfo64.exesnmpapi.dll

The use of applications for Java development, digital painting, accessibility, messaging, and system administration allows the threat actors to blend malicious execution into environments where these programs may already be present.

Sophos also reported that the attackers frequently use renamed legitimate executables. Their sideloaded DLLs can execute shellcode directly in memory, reducing the number of additional files left on disk and making traditional file-based detection more difficult.

Encrypted Configuration Files Deliver Backdoor Capabilities

The malicious DLLs typically read encrypted payloads stored in files named config.ini. These files contain code or configuration data that the DLL decrypts and executes at runtime.

The resulting backdoor can perform several surveillance and reconnaissance activities, including:

  • Enumerating local networks and user accounts.
  • Collecting system metadata and information about running processes.
  • Recording keystrokes.
  • Capturing screenshots.
  • Communicating with external infrastructure to receive further instructions.

Researchers have identified two payload versions, 1.1.5 and 1.1.7.

The payloads have been observed communicating with external services and domains, including file[.]io, gofile[.]io, ably[.]net, and ably[.]io. These connections may support communications with the operators or facilitate the retrieval of additional tasking.

Version 1.1.5 has also been associated with the command-and-control domains dc.cathaypacifice[.]com and net.dpworldto[.]com.

Version 1.1.7, meanwhile, has been observed using the GitHub API to retrieve encrypted configuration files from the repository associated with github[.]com/LatonyCharnleyaW. The GitHub account is no longer accessible.

Connection to Earlier China-Aligned Campaigns

DLL sideloading has been used in multiple campaigns attributed to China-aligned threat actors, and Sandboxie has previously been abused to load malicious libraries.

In July 2024, the APT41 threat group reportedly exploited a different Sandboxie-signed executable, taskhost.exe, to sideload a malicious sbiedll.dll and deploy a backdoor known as MoonWalk.

However, the use of similar techniques does not, by itself, establish that Bronze Sandcastle is the same group as APT41 or another previously documented threat actor.

Sophos warns that encrypted payloads and configuration files decoded at runtime can make static, file-based detection less effective. Organizations should therefore prioritize behavioral monitoring alongside conventional antivirus and endpoint protection.

Security teams should focus on the following indicators and defensive measures:

  • Monitor unusual DLL loading: Investigate legitimate executables loading DLLs from unexpected directories or locations that are writable by standard users.
  • Detect suspicious in-memory execution: Look for DLLs reading local configuration files followed by decryption, shellcode execution, or other unusual in-memory activity.
  • Audit application directories: Review Sandboxie and other listed applications for unexpected DLLs, renamed executables, and suspicious configuration files.
  • Inspect network activity: Investigate unexpected connections to file-sharing services, external APIs, GitHub repositories, and suspicious command-and-control domains.
  • Strengthen endpoint monitoring: Use endpoint detection and response (EDR) tools to correlate process execution, DLL loading, file access, persistence mechanisms, and outbound network connections.
  • Apply least privilege: Restrict unnecessary administrative privileges and limit write access to application directories.

The Bronze Sandcastle campaign highlights how threat actors can abuse trusted software to evade conventional security controls. Combining DLL-load monitoring with process behavior analysis, memory-execution detection, and network telemetry can help organizations identify suspicious activity that may not be visible through static file scanning alone.