[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhqVkG1GHJzsZ_oy7vtreCf7xZFu3TFR-shxZcbbr4xU":3},{"article":4,"iocs":52,"watch_terms":70,"solutions":71,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"958fe701-19de-4589-8afa-06fbd03effab","China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors","china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backd-5ff1dd","Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. \"The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,\" Sophos security researcher Gabor Szappanos said in a post published","Sophos researchers disclosed Bronze Sandcastle, a previously undocumented China-aligned threat cluster active since mid-2025, targeting organizations in Asia and Africa. The group's signature technique is DLL sideloading using legitimate applications (Sandboxie, Java, Krita, and others) to load malicious DLLs that execute encrypted backdoor payloads. The backdoor collects system metadata, keystrokes, screenshots, and communicates with attacker-controlled C2 infrastructure via legitimate file-sharing and messaging services.","China-aligned Bronze Sandcastle targets Asia\u002FAfrica with Sandboxie DLL sideloading attacks since mid-2025.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fchina-aligned-bronze-sandcastle-abuses.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgq2iUs3zJHHrrskI-icX8x-nBeJxjr_O9uRE2lvcLQkaOhVUHFjTQYLItaZPVskt39VgI2ZYoMDuIhqkAAqEl1bYHLv5ctEfQvPe9UmLyzVEo46YS4xOEz7HcoYKSiNtT_g2bqfKLPFis98BVTTjSR9gafpKRceKKcj0rUf3pb89zBXVt_PequHoA-ta3t\u002Fs1600\u002Fsandboxie.png","2026-10-21T12:05:00+00:00","2026-10-21T14:00:13.627245+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Bronze Sandcastle","threat_actor",{"name":21,"type":22},"Sophos","vendor",{"name":24,"type":22},"Zscaler",{"name":26,"type":27},"Sandboxie","product",{"name":29,"type":30},"DLL sideloading","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60,63,65,68],{"type":54,"value":55,"context":56},"domain","dc.cathaypacifice.com","C2 domain used by Bronze Sandcastle backdoor payload version 1.1.5",{"type":54,"value":58,"context":59},"net.dpworldto.com","C2 domain associated with Bronze Sandcastle backdoor infrastructure",{"type":54,"value":61,"context":62},"file.io","Legitimate file-sharing service abused for payload delivery by Bronze Sandcastle",{"type":54,"value":64,"context":62},"gofile.io",{"type":54,"value":66,"context":67},"ably.net","Service abused by Bronze Sandcastle for C2 communication",{"type":54,"value":69,"context":67},"ably.io",[21,24,26],{"controls":72,"vendors":149},[73,94,120],{"slug":74,"name":75,"problem":76,"products":77},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[78,86],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":95,"name":96,"problem":97,"products":98},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":116,"product_name":117,"url":118,"description":119},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":121,"name":122,"problem":123,"products":124},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[150],{"slug":151,"name":21,"logo_path":152,"roles":153},"sophos","\u002Fvendor-logos\u002Fsophos.png",[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"bronze-sandcastle-exploits-dll-sideloading-via-legitimate-apps-to-deploy-backdoors","Bronze Sandcastle Exploits DLL Sideloading via Legitimate Apps to Deploy Backdoors","Bronze Sandcastle abuses a well-known technique called DLL sideloading, placing malicious DLLs alongside trusted, signed applications (Sandboxie, Java, Krita) so the OS loads attacker code with the application's implicit trust. This works because many environments do not enforce strict controls over which DLLs legitimate processes are permitted to load, nor do they monitor for unexpected DLL origins or hashes. The use of legitimate file-sharing and messaging platforms for C2 further blends malicious traffic into normal network activity, making detection harder without deep inspection and behavioral analytics. This campaign matters because it demonstrates how adversaries can compromise systems without exploiting any software vulnerability — instead abusing trusted application mechanics — meaning traditional patch-centric defenses alone are insufficient.",[160,161,162,163,164,165,166],"MITRE ATT&CK T1574.002: DLL Side-Loading","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":168,"CIS Control 10: Malware Defenses":169,"NIST SP 800-53 SI-2: Flaw Remediation":170,"MITRE ATT&CK T1574.002: DLL Side-Loading":171,"CIS Control 13: Network Monitoring and Defense":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":174},"NIS2 requires incident handling and network monitoring capabilities; detecting sideloaded DLLs communicating with attacker-controlled infrastructure demands exactly the behavioral detection and response processes Article 21(2)(b) mandates for essential entities.","CIS Control 10 mandates anti-exploitation features and behavioral monitoring that would detect abnormal DLL loading patterns by otherwise legitimate applications before the backdoor executes.","While DLL sideloading is a configuration abuse rather than a CVE, SI-2's broader mandate to identify and correct software weaknesses applies to hardening DLL search order and enforcing code-signing policies.","This technique directly maps to Bronze Sandcastle's core method of placing malicious DLLs alongside legitimate signed executables; understanding and detecting T1574.002 is the primary technical countermeasure for this campaign.","CIS Control 13 requires monitoring of outbound network traffic, which would surface the C2 communications Bronze Sandcastle routes through legitimate cloud file-sharing and messaging services.","A.8.8 requires organizations to track and remediate technical weaknesses in software configurations, including insecure DLL loading behaviors that Bronze Sandcastle deliberately targets.","Restricting which processes and users can load arbitrary DLLs — a core access control principle — would prevent untrusted code from executing under the guise of a legitimate signed application."]