Cybersecurity researchers have revealed the activity of a previously unknown China-aligned hacking group called Bronze Sandcastle that has been striking organizations across Asia and Africa since the middle of 2025. Sophos published the findings Tuesday, identifying the group's signature tactic: consistently abusing Sandboxie through DLL sideloading. From August 2025 through August 2026, the hacking operation hit targets in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea, with evidence showing the group operates mainly in the UTC+8 time zone.
Bronze Sandcastle places legitimate Sandboxie executables in compromised networks alongside a malicious file named "sbiedll.dll," which tricks the trusted application "SandboxieWUAU.exe" into loading attacker code during operation. The group has also weaponized seven other DLL sideloading combinations, including javaw.exe paired with jli.dll, Krita.exe with Krita.dll, and LineAppMgr.exe with msvcp140.dll. These sideloaded DLLs read and execute payloads hidden in encrypted config.ini files, a design that reduces static detection and lets operators modify behavior without swapping DLL binaries. The malicious payload acts as a backdoor that catalogs local networks and user accounts, gathers system metadata, captures running processes, logs keystrokes, and takes screenshots. Two versions have been identified—1.1.5 and 1.1.7—with the earlier version communicating through dc.cathaypacifice[.]com and net.dpworldto[.]com for command-and-control, while the later version uses GitHub repositories to download encrypted configuration files.
According to Sophos security researcher Gabor Szappanos, "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading." The report notes that the sideloaded DLLs' design "minimizes static detection and allows operators to adjust behavior without replacing DLL binaries," with execution creating in-memory shellcode activity instead of leaving additional disk artifacts. Sophos also emphasized that "the threat group predominantly uses encrypted payload and configuration files that are decoded at runtime, meaning that static file-based detections may be ineffective."
DLL sideloading works by exploiting how Windows searches for required library files when applications launch. When a program doesn't specify the complete path to a needed DLL, the operating system hunts through a predetermined list of directories. Attackers plant a malicious DLL with an identical name in a location Windows checks before the folder holding the genuine file, causing the legitimate application to load and run the hostile code. Because a trusted and often digitally signed program executes the malicious code, security software is less likely to raise alarms. If the compromised application runs with elevated privileges, the malicious DLL inherits those permissions, enabling attackers to perform sensitive system actions. The technique also provides persistence when the compromised application is set to run automatically at reboot, ensuring the attacker's code executes each time the infected machine restarts. Bronze Sandcastle isn't the first Chinese hacking group to rely on this method—in July 2024, the APT41 threat actor used a different Sandboxie executable to sideload a malicious sbiedll.dll and deploy a backdoor called MoonWalk.
The report recommends organizations shift away from static file-based detection and concentrate on behavioral indicators such as DLLs reading local files followed by immediate in-memory execution, which may signal decoding and staging activity. The payload has been observed communicating with external sites including file[.]io, gofile[.]io, ably[.]net, and ably[.]io, likely to receive additional instructions from operators. The GitHub account used by version 1.1.7 payloads is no longer accessible. Companies should recognize that encrypted runtime payloads require monitoring execution patterns rather than scanning static signatures. Defenders who understand how trusted applications can become unwitting carriers of hostile code will be better positioned to identify and stop intrusions before backdoors take root.