China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading for Backdoor Deployment
A China-aligned threat group, dubbed Bronze Sandcastle, has been actively targeting organizations in Asia and Africa since mid-2025, consistently employing a distinctive DLL sideloading technique using Sandboxie to deploy backdoors.
A newly identified China-aligned threat cluster, operating under the moniker Bronze Sandcastle, has been actively engaged in cyberespionage campaigns targeting organizations across Asia and Africa since the middle of 2025. Cybersecurity researchers at Sophos have detailed the group's operations, highlighting a consistent and unique technical marker: the abuse of Sandboxie's DLL sideloading functionality.
This technique involves tricking the legitimate Sandboxie application, a sandbox environment designed to isolate potentially malicious software, into loading a compromised Dynamic Link Library (DLL) file. By replacing or manipulating a DLL that Sandboxie expects to load, Bronze Sandcastle can execute arbitrary code within the isolated environment, which can then be used to establish persistence, exfiltrate data, or deploy further malicious payloads.
The consistent use of this specific technique makes Bronze Sandcastle's operations easily identifiable, according to Sophos security researcher Gabor Szappanos. While the group's ultimate objectives remain under investigation, their targeting of organizations in Asia and Africa suggests a focus on regional geopolitical or economic interests.
The threat actor's modus operandi leverages a common software utility, Sandboxie, which is often used by security-conscious individuals to test suspicious files. This reliance on a legitimate, albeit potentially misused, tool can help the malware evade detection by security solutions that might not scrutinize the behavior of applications within a sandbox environment.
Details regarding the specific backdoors deployed by Bronze Sandcastle have not been fully disclosed, but the group's consistent approach indicates a well-rehearsed and effective operational procedure. The ability to maintain operations for over a year with a distinct technical signature suggests a degree of sophistication and operational security.
While no specific vulnerabilities have been attributed to Bronze Sandcastle's primary infection vector in this report, the reliance on DLL sideloading is a well-known exploitation method that often exploits weaknesses in how applications load external libraries. Organizations using Sandboxie, or those that might have it installed, should ensure their security software is configured to detect and block unauthorized DLL loading attempts.
The discovery of Bronze Sandcastle underscores the persistent threat posed by state-sponsored or state-aligned threat actors. Their continued adaptation and use of specific, repeatable techniques highlight the ongoing need for robust threat intelligence and proactive security measures to defend against sophisticated adversaries.