China-Linked Hackers Use Trusted Windows Apps as Backdoors for Credential Theft
BRONZE SANDCASTLE, a China-linked threat actor, is exploiting legitimate Windows applications like Sandboxie and Java to load malicious DLLs, enabling credential theft and backdoor installation.
A sophisticated campaign orchestrated by a China-linked threat actor, identified as BRONZE SANDCASTLE, has been uncovered, leveraging trusted Windows applications to establish backdoors and pilfer sensitive credentials. The group employs a technique known as DLL sideloading, where malicious code is disguised within legitimate software, allowing familiar applications to execute attacker-controlled payloads without altering the original program. This method enables the attackers to collect detailed system information and, critically, Active Directory credentials.
The campaign, observed by researchers from Sophos’ Counter Threat Unit and SophosLabs, targeted organizations across Asia and Africa between August 2025 and August 2026. Victims were identified in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. The technical report details how attackers place malicious libraries alongside legitimate executables, such as Sandboxie or Java components. When the trusted application is launched, it inadvertently loads the malicious library, handing over execution control to the threat actors.
Beyond Sandboxie, the threat actor has been observed abusing components from other widely used software, including Java, Krita, NVDA, LINE, and Microsoft Sysinternals tools. The malicious libraries are designed to read an encrypted payload from a local configuration file, decrypt it, and then execute the code directly in memory. This layered approach helps to separate the visible application from the hidden backdoor, allowing operators to modify the payload's behavior without needing to replace the initial loading library. The use of renamed executables further aids in blending the malicious files into the compromised system environment.
The backdoor payload itself exhibits custom features, resembling Metasploit shellcode but with unique function-resolution routines and a more complex codebase. Researchers noted payload versions 1.1.5 and 1.1.7, with the latter downloading encrypted configuration files via GitHub, while the former contacted dedicated control domains. The backdoor's primary function is to gather extensive system data, including computer and user names, domain details, operating system version, IP addresses, process information, and startup times, which are then sent to a command-and-control server in a structured JSON format.
Following initial compromise and data exfiltration, BRONZE SANDCASTLE operators proceed to inspect network accounts and local network configurations using standard Windows commands. A particularly concerning tactic involves creating Volume Shadow Copies before copying the Active Directory database (NTDS.dit). This sequence of actions directly links the backdoor's remote access capabilities with a clear intent to obtain domain-wide credential data, as shadow copies can expose protected database contents.
Sophos recommends implementing robust detection strategies focusing on libraries that read local files and execute code in memory, alongside monitoring for unusual executable headers and reflective loading techniques. Given that encrypted payloads can evade static file detection, behavioral and memory monitoring are crucial for identifying this type of threat. The campaign highlights the persistent ingenuity of nation-state-backed actors in weaponizing legitimate software to achieve their objectives.