Bronze Sandcastle Exploits DLL Sideloading via Legitimate Apps to Deploy Backdoors
Written by AI from the linked story. Not reviewed by an editor. How this works
Bronze Sandcastle abuses a well-known technique called DLL sideloading, placing malicious DLLs alongside trusted, signed applications (Sandboxie, Java, Krita) so the OS loads attacker code with the application's implicit trust. This works because many environments do not enforce strict controls over which DLLs legitimate processes are permitted to load, nor do they monitor for unexpected DLL origins or hashes. The use of legitimate file-sharing and messaging platforms for C2 further blends malicious traffic into normal network activity, making detection harder without deep inspection and behavioral analytics. This campaign matters because it demonstrates how adversaries can compromise systems without exploiting any software vulnerability — instead abusing trusted application mechanics — meaning traditional patch-centric defenses alone are insufficient.
Tactical Insight
Immediate actions
- Audit all endpoints for unexpected or unsigned DLLs co-located with legitimate signed applications and quarantine anomalies.
- Deploy application whitelisting (e.g., AppLocker or WDAC) to block execution of unauthorized DLLs, especially those loaded by trusted processes.
Long-term improvements
- Enforce DLL safe search order hardening and require code-signing validation for all DLLs loaded by privileged or internet-facing applications.
- Implement strict egress filtering and DNS monitoring to detect and block C2 communications routed through legitimate file-sharing and messaging services.
- Maintain an up-to-date software inventory and flag any deviation from known-good application file structures as a configuration drift alert.
Detection measures
- Enable process-level logging (e.g., Sysmon Event ID 7) to capture all DLL load events and alert on mismatches between DLL path and parent application directory.
- Deploy behavioral EDR rules to detect processes spawning unusual child processes or making unexpected outbound connections to cloud storage or messaging APIs.