Cybersecurity researchers have disclosed details about a previously undocumented threat cluster known as Bronze Sandcastle, which has been observed targeting organizations across Asia and Africa through advanced malware techniques. According to research from Sophos, the activity was identified between August 2025 and August 2026, with affected organizations reported in countries including the Philippines, Taiwan, Afghanistan, Namibia, and potentially South Korea. Researchers said the group’s most notable technical characteristic is its repeated use of Sandboxie DLL sideloading to deliver backdoor malware. The activity highlights how threat actors continue to rely on trusted software components and operating system behaviors to avoid detection while gaining access to targeted environments.
DLL sideloading is a technique that takes advantage of how Windows operating systems search for and load Dynamic Link Library files required by applications. When a legitimate application does not specify the complete location of a required DLL, Windows follows a predefined search order to locate the file. Attackers can exploit this process by placing a malicious DLL with the same name as a legitimate component in a location that is searched before the original file. As a result, the trusted application loads the attacker controlled file, allowing malicious code to execute under the appearance of a legitimate process. Security researchers have noted that this method can reduce detection chances because the malicious activity is carried out through applications that may already be trusted or digitally signed.
Sophos researchers found that Bronze Sandcastle placed legitimate Sandboxie executables within victim environments alongside a malicious “sbiedll.dll” file. This allowed the trusted “SandboxieWUAU.exe” application to load attacker controlled code during execution. Researchers also identified several other DLL sideloading combinations involving applications such as Java, Krita, NVDA, Java Chromium Embedded Framework Helper, Sysinternals Vmmap, LINE messaging application, and Bginfo64. The sideloaded DLL files were designed to read encrypted configuration files named “config.ini,” which contained payloads used for further activity. Researchers said this approach allows operators to modify functionality without replacing DLL files and reduces the visibility of malicious components stored on systems.
The deployed payloads were designed as backdoors capable of collecting system information, including local network details, user accounts, running processes, keystrokes, screenshots, and other system metadata. Researchers identified two versions of the payload, version 1.1.5 and version 1.1.7, which showed different communication methods with external services. Some payloads were observed communicating with platforms including file.io, gofile.io, ably.net, and ably.io, while certain version 1.1.5 samples used domains linked to command and control communication. Version 1.1.7 samples were observed interacting with GitHub repositories through APIs to download encrypted configuration files, although the identified GitHub account is no longer accessible.
Researchers noted that DLL sideloading has previously been used by other China linked threat groups, including cases involving Sandboxie signed applications. Sophos stated that Bronze Sandcastle’s use of encrypted payloads and configuration files means traditional file based security detection methods may not always identify the activity. Instead, organizations are advised to monitor behavioral indicators, such as DLL files accessing local resources followed by in memory execution, which may indicate malicious decoding and staging activity. The findings highlight the continued evolution of malware delivery methods and the importance of behavioral monitoring, endpoint protection, and threat intelligence practices for organizations managing modern cybersecurity risks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
