China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Summary: Sophos researchers disclosed a previously undocumented China-aligned cluster called Bronze Sandcastle that has targeted organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea between August 2025 and August 2026, with activity concentrated in the UTC+8 time zone. The group's marker is DLL sideloading of legitimate Sandboxie executables alongside a malicious sbiedll.dll, which loads an encrypted config.ini payload - versions 1.1.5 and 1.1.7 - that enumerates local network and user accounts and collects system metadata, running processes, keystrokes, and screenshots.
Key Takeaway: The payload is decoded only at runtime and executes in memory, so static file-based detection may not catch it; Sophos points instead to behavioral signals such as a DLL reading local files followed immediately by in-memory execution. The backdoor has been seen reaching file-sharing and messaging services including file.io, gofile.io, ably.net, and ably.io, plus GitHub-hosted config retrieval, giving operators a route to re-task infected hosts.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026