China-Aligned Bronze Sandcastle Uses Sandboxie DLL Sideloading to Deploy Backdoors

Campaign overview

Sophos has disclosed a previously undocumented China-aligned threat cluster tracked as Bronze Sandcastle, active against organizations in Asia and Africa since mid-2025. Researcher Gabor Szappanos said its most distinctive marker is consistent use of Sandboxie DLL sideloading.

Between August 2025 and August 2026, attacks attributed to the cluster resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Sophos said evidence indicates Bronze Sandcastle is most active in the UTC+8 time zone.

DLL sideloading technique

DLL sideloading tricks a legitimate program into loading a malicious DLL: when an application does not give the full path to a required library, Windows searches a fixed sequence of directories, so an attacker can plant a same-named malicious DLL where it is found first.

Sophos observed legitimate Sandboxie executables in several victim environments next to a malicious sbiedll.dll, which makes the trusted SandboxieWUAU.exe load attacker code at runtime. The group used seven other combinations: javaw.exe with jli.dll, Krita.exe with Krita.dll, NvdaHelper.exe with NvdaHelperRemote.dll, Jcef_helper.exe with libcef.dll, Vmmap.exe with version.dll, LineAppMgr.exe with msvcp140.dll, and bginfo64.exe with snmpapi.dll.

Zscaler noted that because the code runs through a trusted, often digitally signed application, antivirus is less likely to flag it. If that application runs with elevated privileges, the malicious DLL inherits them, and persistence follows when the compromised program starts at boot.

Payload and infrastructure

The sideloaded DLLs read and execute payloads stored in encrypted config.ini files, a design Sophos said minimizes static detection and lets operators change behavior without replacing binaries. Renamed legitimate executables blend in, and execution leads to in-memory shellcode rather than disk artifacts.

The payload is a backdoor that enumerates local network and user accounts and collects system metadata, running processes, keystrokes and screenshots. Two versions exist, 1.1.5 and 1.1.7. It has contacted file[.]io, gofile[.]io, ably[.]net and ably[.]io, likely to receive further tasking.

Version 1.1.5 used dc.cathaypacifice[.]com and net.dpworldto[.]com for command and control. Version 1.1.7 talked to GitHub repositories through the API to fetch encrypted config files; that account is no longer accessible.

Detection and context

Sophos said the group relies on encrypted payload and configuration files decoded at runtime, so static file detections may be ineffective. It recommends watching behavioral indicators such as a DLL reading local files then executing in memory, which may indicate decoding and staging.

DLL sideloading is not new for Chinese groups, nor is Sandboxie. In July 2024 APT41 used another Sandboxie-signed executable, taskhost.exe, to sideload a malicious sbiedll.dll and deploy a backdoor called MoonWalk.

Sources: The Hacker News