Bronze Sandcastle uses Sandboxie DLL sideloading to deploy backdoors

Sophos researchers have detailed a previously undocumented threat cluster called Bronze Sandcastle, which has targeted organisations in Asia and Africa with a distinctive form of DLL sideloading. The group has been observed since mid-2025, and Sophos says its activity is likely connected to Chinese intelligence-gathering objectives.¹

The campaign's clearest technical marker is the use of legitimate Sandboxie executables alongside a malicious file called sbiedll.dll. When the trusted application starts, Windows loads the malicious library, allowing the attackers' code to run inside a legitimate process. The same basic weakness affects the way Windows searches for DLLs: if software does not specify a complete path, the operating system checks a sequence of locations that an attacker may be able to manipulate.¹²

Sophos said it found the technique in environments belonging to victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. The attacks observed between August 2025 and August 2026 used several combinations beyond Sandboxie, including Java, Krita, NVDA, Sysinternals tools and LINE's messaging software. Each pairing uses a legitimate executable and a malicious library with the name the program expects to load.

The sideloaded libraries typically read encrypted payloads from files disguised as configuration data. Sophos identified backdoors capable of enumerating local networks and user accounts, collecting system information, listing running processes and capturing keystrokes and screenshots. Some versions also communicate with external services for additional instructions, while another variant used a GitHub repository to retrieve encrypted configuration files.¹

Sophos said the operators often rename legitimate executables and execute shellcode in memory, reducing the number of obvious files left on disk. That makes simple signature-based detection less reliable. The company recommends looking instead for suspicious behaviour, such as a trusted application reading local files and then immediately decoding and executing code in memory.¹

Our opinion

The worrying part of Bronze Sandcastle is not that DLL sideloading is new. It is that the group appears to be applying a familiar Windows loading quirk across a rotating set of ordinary tools, while hiding the real payload in encrypted configuration files. That makes the campaign easier to blend into normal software inventories and harder to catch with a single filename blocklist. Behavioural monitoring, careful software provenance and attention to unexpected library-loading patterns matter more here than chasing one malicious DLL name.

Source: ¹ Sophos Counter Threat Unit; ² The Hacker News.