A China-aligned threat group called Bronze Sandcastle has been targeting organizations in Asia and Africa since mid-2025, using a technique that tricks legitimate software into loading malicious code, Sophos researcher Gabor Szappanos reported Tuesday.

The group's signature move is DLL sideloading through Sandboxie, a legitimate sandboxing tool. Attackers plant a malicious "sbiedll.dll" alongside genuine Sandboxie executables, so the trusted, digitally signed application loads the attacker's code at runtime. Because the host program is trusted, antivirus tools are less likely to flag it, and if the program runs with elevated privileges, the malicious DLL inherits them.

Between August 2025 and August 2026, victims were recorded in the Philippines, Taiwan, Afghanistan and Namibia, with South Korea likely affected. Evidence points to the group operating mainly in the UTC+8 time zone.

Beyond Sandboxie, researchers tied Bronze Sandcastle to seven other sideloading pairs, including javaw.exe with jli.dll, Krita.exe with Krita.dll, and Vmmap.exe with version.dll. The sideloaded DLLs read and execute payloads hidden in encrypted config.ini files, keeping activity in memory rather than on disk. Renamed legitimate executables help the group blend into victim environments.

The payload acts as a backdoor, enumerating local networks and user accounts and harvesting system metadata, running processes, keystrokes and screenshots. Two versions, 1.1.5 and 1.1.7, have been identified. The malware contacts external services such as file.io, gofile.io and ably.net, apparently to receive tasking; version 1.1.5 also used dc.cathaypacifice.com and net.dpworldto.com for command-and-control, while 1.1.7 pulled encrypted configs from a GitHub repository that is no longer accessible.

Sophos advised defenders to watch for behavioral signs, such as DLLs reading local files followed by immediate in-memory execution, since static file-based detection may miss the encrypted payloads.

Source: The Hackers News